Overview

overview

8

Static

static

3

2026-08-03...er.exe

windows10-2004-x64

3

2026-08-03...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 02:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_42245890cb3c7acae1b95382bf60fc7f_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
  • Size 225KB
  • Sample260803-c9dsvsbb88
  • SHA256 09eb1d86adcaad433fef26a4a6a065f47989fb68c4ef499cbd686d0e3fa4eb96
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 50 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 11 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_42245890cb3c7acae1b95382bf60fc7f_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_42245890cb3c7acae1b95382bf60fc7f_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
    1⤵
    • Downloads MZ/PE file
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2540
    • C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /passive /msicl "VID=80 YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y "
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2036
    • C:\Users\Admin\AppData\Local\Temp\2026-08-03_42245890cb3c7acae1b95382bf60fc7f_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-03_42245890cb3c7acae1b95382bf60fc7f_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe --stat dwnldr/p=1095461/cnt=0/dt=5/ct=15/rt=0 --dh 2612 --st 1785725216
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3684
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3372
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 89984E6C948FA7A8EF95A22C4745831C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6064
      • C:\Users\Admin\AppData\Local\Temp\F2A8ADF6-3728-49C2-AB41-89F52CA37394\lite_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\F2A8ADF6-3728-49C2-AB41-89F52CA37394\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSER
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:5052
      • C:\Users\Admin\AppData\Local\Temp\03267BB0-F760-435F-BF36-D4FAB1CC8E5C\seederexe.exe
        "C:\Users\Admin\AppData\Local\Temp\03267BB0-F760-435F-BF36-D4FAB1CC8E5C\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\C6B46C0C-A687-4295-9F03-9BF9D88F1E68\sender.exe" "--is_elevated=yes" "--ui_level=2" "--good_token=x" "--no_opera=n"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2688
        • C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
          C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\WWWYAR~1.ICO"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2784
          • C:\Users\Admin\AppData\Local\Temp\pin\explorer.exe
            C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\WWWYAR~1.ICO" /pin-path="C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk" --is-pinning
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4608
        • C:\Users\Admin\AppData\Local\Temp\C6B46C0C-A687-4295-9F03-9BF9D88F1E68\sender.exe
          C:\Users\Admin\AppData\Local\Temp\C6B46C0C-A687-4295-9F03-9BF9D88F1E68\sender.exe --send "/status.xml?clid=14237117-80&uuid=3f6440b0-5514-4195-b6a2-d80455cfccef&vnt=Windows 11x64&file-no=8%0A10%0A11%0A12%0A13%0A15%0A36%0A40%0A42%0A45%0A57%0A61%0A102%0A103%0A111%0A123%0A124%0A125%0A"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2416
  • C:\Users\Admin\AppData\Local\Temp\ybAB79.exe
    "C:\Users\Admin\AppData\Local\Temp\ybAB79.exe" --job-name=yBrowserDownloader-D95A8B24-5271-4D35-9C15-483C9610EF5E --send-statistics --local-path=C:\Users\Admin\AppData\Local\Temp\ybAB79.exe --YABROWSER --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14237100-80&ui={3f6440b0-5514-4195-b6a2-d80455cfccef} --use-user-default-locale
    1⤵
    • Downloads MZ/PE file
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Users\Admin\AppData\Local\Temp\ybC162.tmp
      "C:\Users\Admin\AppData\Local\Temp\ybC162.tmp" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\724e9a96-9ae5-48cc-b0b7-f677a708f676.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=607702526 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-D95A8B24-5271-4D35-9C15-483C9610EF5E --local-path="C:\Users\Admin\AppData\Local\Temp\ybAB79.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14237100-80&ui={3f6440b0-5514-4195-b6a2-d80455cfccef} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\100f1c1a-ba23-4c8d-a65e-09a4ef2e0867.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5268
      • C:\Users\Admin\AppData\Local\Temp\YB_29DF5.tmp\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\YB_29DF5.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_29DF5.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\724e9a96-9ae5-48cc-b0b7-f677a708f676.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=607702526 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-D95A8B24-5271-4D35-9C15-483C9610EF5E --local-path="C:\Users\Admin\AppData\Local\Temp\ybAB79.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14237100-80&ui={3f6440b0-5514-4195-b6a2-d80455cfccef} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\100f1c1a-ba23-4c8d-a65e-09a4ef2e0867.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2736
        • C:\Users\Admin\AppData\Local\Temp\YB_29DF5.tmp\setup.exe
          "C:\Users\Admin\AppData\Local\Temp\YB_29DF5.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_29DF5.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\724e9a96-9ae5-48cc-b0b7-f677a708f676.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=607702526 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-D95A8B24-5271-4D35-9C15-483C9610EF5E --local-path="C:\Users\Admin\AppData\Local\Temp\ybAB79.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14237100-80&ui={3f6440b0-5514-4195-b6a2-d80455cfccef} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\100f1c1a-ba23-4c8d-a65e-09a4ef2e0867.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico" --verbose-logging --run-as-admin --target-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=639221266
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Time Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2452
          • C:\Users\Admin\AppData\Local\Temp\YB_29DF5.tmp\setup.exe
            C:\Users\Admin\AppData\Local\Temp\YB_29DF5.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=2452 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.4.760 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff6e4ea5220,0x7ff6e4ea522c,0x7ff6e4ea5238
            5⤵
            • Executes dropped EXE
            PID:5952
          • C:\Windows\SystemTemp\sdwra_2452_1275248338\service_update.exe
            "C:\Windows\SystemTemp\sdwra_2452_1275248338\service_update.exe" --setup
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2692
            • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.4.760\service_update.exe
              "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.4.760\service_update.exe" --install
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:4308
          • C:\Windows\SystemTemp\scoped_dir2452_1797091366\explorer.exe
            "C:\Windows\SystemTemp\scoped_dir2452_1797091366\explorer.exe" --pttw1="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Яндекс Браузер с Алисой AI.lnk" --shortcut-name-with-alice-for-new-users-enabled
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:5804
            • C:\Windows\SystemTemp\scoped_dir2452_1797091366\explorer.exe
              C:\Windows\SystemTemp\scoped_dir2452_1797091366\explorer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=5804 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.4.760 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff781b45220,0x7ff781b4522c,0x7ff781b45238
              6⤵
              • Executes dropped EXE
              PID:700
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Temp\clids.xml"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1060
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\source2452_524732889\Browser-bin\clids_yandex_second.xml"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4664
  • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.4.760\service_update.exe
    "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.4.760\service_update.exe" --run-as-service
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:3084
    • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.4.760\service_update.exe
      "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.4.760\service_update.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=3084 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.4.760 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6e7b20a98,0x7ff6e7b20aa4,0x7ff6e7b20ab0
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:3248
    • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.4.760\service_update.exe
      "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.4.760\service_update.exe" --update-scheduler
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:4772
      • C:\Program Files (x86)\Yandex\YandexBrowser\26.6.4.760\service_update.exe
        "C:\Program Files (x86)\Yandex\YandexBrowser\26.6.4.760\service_update.exe" --update-background-scheduler
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:1264
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:1100
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --progress-window=0 --install-start-time-no-uac=607702526
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5788
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id= --annotation=main_process_pid=5788 --annotation=metrics_client_id=ace457b15bab42b4b0eaee69880faebf --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.4.760 --initial-client-data=0x150,0x154,0x158,0x12c,0x15c,0x7ffa847b27f8,0x7ffa847b2804,0x7ffa847b2810
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:612
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --gpu-process-kind=sandboxed --metrics-shmem-handle=2064,i,9970499694157570983,11020405469456804759,262144 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2280 /prefetch:2
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:460
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --gpu-process-kind=trampoline --metrics-shmem-handle=2124,i,3905925277224990558,16809481397165969796,262144 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2344 /prefetch:6
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4396
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2440,i,1898732246081910309,13056596565611940187,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2660 --brver=26.6.4.760 /prefetch:11
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:1744
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=ru --service-sandbox-type=none --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Video Capture" --metrics-shmem-handle=3204,i,11950843626807135899,3847903345842979614,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3344 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4152
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Storage Service" --metrics-shmem-handle=2800,i,13937258926277087804,8485593382431655418,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3320 --brver=26.6.4.760 /prefetch:13
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5360
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=ru --service-sandbox-type=audio --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Audio Service" --metrics-shmem-handle=3140,i,17067642924518138391,3476558243424568338,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=2992 --brver=26.6.4.760 /prefetch:12
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4080
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --may-use-trampoline-gpu --metrics-shmem-handle=4324,i,3133438739499389089,9872709493589079758,2097152 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4248 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:3340
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=ru --service-sandbox-type=none --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Импорт профилей" --metrics-shmem-handle=4660,i,1681194973724736012,11846075297326135454,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4684 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:4424
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --may-use-trampoline-gpu --metrics-shmem-handle=5144,i,13124249573579169559,2903162654221494904,2097152 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5160 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:2624
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=5460,i,6677344220496886407,10780711472808436429,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5420 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5336
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=uwp_cookie_provider.mojom.UwpCookieProvider --lang=ru --service-sandbox-type=utility --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name=uwp_cookie_provider.mojom.UwpCookieProvider --metrics-shmem-handle=5556,i,12827108236907035961,9550962583088403424,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5544 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3396
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4660,i,13631209476845767727,7017258029334168929,2097152 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4596 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:748
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6284,i,3339000043365808069,394898203127889668,2097152 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6264 /prefetch:1
        2⤵
        • Executes dropped EXE
        • System Time Discovery
        PID:2964
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6484,i,832717578522793793,3528706556028224758,2097152 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6508 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:5644
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7464,i,10197369424133228891,17207479399892657193,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=7452 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4676
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7572,i,3625477569681250179,5936809212181414552,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=7584 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5796
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7548,i,4028817110694213416,13501287708932309363,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=7712 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4424
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7556,i,7347702329923725349,16215270727973463164,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=7852 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5704
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7720,i,9005604774758890023,2969277995632787541,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7988 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5716
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8280,i,10009299429232186713,1031878635944657045,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=8292 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1660
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=6472,i,13588436723809563419,5205271338789149263,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=8428 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4124
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8196,i,9449175733366215388,3696652152681999637,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=8180 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:3476
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8172,i,3219352400070887091,7310940726907438898,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=8636 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2584
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8236,i,5789389578814791879,17753574061992315910,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=8224 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:2656
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8216,i,698497936552466732,5914039398266274166,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=8888 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:2148
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9024,i,11607232628955340782,9414699697658678176,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=8276 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1324
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8268,i,1293635574027279521,393149753109703582,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=9184 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5012
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8644,i,13610308333330786243,11529295226662905339,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=9324 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:936
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9056,i,2918876143810495197,1933871134064198941,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=9044 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:3976
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9332,i,5092584829526856256,18425732790841437343,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=9584 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5044
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9724,i,4042581232737611603,14612464055331004907,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=9748 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5928
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9736,i,12360238288255751981,3357977560833742108,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=9768 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:1228
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9880,i,17611572028458686430,13070475556620949628,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=10020 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:1412
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10168,i,16726326492764933222,12938275109146142823,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=10180 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:368
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10348,i,5758112231352822111,14274343769779259853,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=10360 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4156
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10524,i,6243670042243389514,15766772229833530608,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=10536 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:2036
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10668,i,1101514935307115310,8903415944542574321,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=10680 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4520
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10688,i,5270550941863977027,14099598784925288060,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=10820 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:3792
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10828,i,13554750824034635704,9069882005494298163,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=10976 --brver=26.6.4.760 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:3292
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10544,i,6927099984958849598,3920282440617476242,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=11112 --brver=26.6.4.760 /prefetch:14
        2⤵
          PID:2404
        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11248,i,1449481760939559556,17456427527792908118,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=11260 --brver=26.6.4.760 /prefetch:14
          2⤵
            PID:5880
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11272,i,6006866868446805883,12982294885510375250,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=11404 --brver=26.6.4.760 /prefetch:14
            2⤵
              PID:704
            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11556,i,701068091596605986,1789936804456067443,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=11568 --brver=26.6.4.760 /prefetch:14
              2⤵
                PID:5608
              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11716,i,9349705368544276674,13531965553639981025,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=11720 --brver=26.6.4.760 /prefetch:14
                2⤵
                  PID:1284
                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=ru --service-sandbox-type=none --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=11904,i,4013379740133180681,1545618601368887589,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=11908 --brver=26.6.4.760 /prefetch:14
                  2⤵
                    PID:5888
                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=11996,i,11936347088997755914,5862417979353324194,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=12008 --brver=26.6.4.760 /prefetch:14
                    2⤵
                      PID:2028
                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=5680,i,9913350147564280838,17103958305626266074,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=4308 --brver=26.6.4.760 /prefetch:14
                      2⤵
                        PID:3580
                      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=12228,i,7750751415300732190,10935960534245078539,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=5460 --brver=26.6.4.760 /prefetch:14
                        2⤵
                          PID:4716
                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=12224,i,2183628318042637776,8092117729096424861,2097152 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=4296 /prefetch:1
                          2⤵
                          • System Time Discovery
                          PID:5140
                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=4420,i,11926574231133038992,5923942841027734769,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=4444 --brver=26.6.4.760 /prefetch:14
                          2⤵
                            PID:3352
                          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=12196,i,7066105098834859840,244454722807676705,2097152 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=7592 /prefetch:1
                            2⤵
                            • System Time Discovery
                            PID:4556
                          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=7668,i,8028446104662701767,14164203873602085315,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=12220 --brver=26.6.4.760 /prefetch:14
                            2⤵
                              PID:6116
                            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=7704,i,11679584422951746451,10653341507774416340,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=2124 --brver=26.6.4.760 /prefetch:14
                              2⤵
                                PID:1484
                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=7652,i,6639664435131421486,2456901321664377456,524288 --field-trial-handle=2284,i,2865814734997244091,9422365899007972289,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2288,i,10085580441686477033,3147188749687628275,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=7604 --brver=26.6.4.760 /prefetch:14
                                2⤵
                                  PID:3000
                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --shutdown-if-not-closed-by-system-restart
                                1⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:1892
                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                  C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1785725290 --annotation=last_update_date=1785725290 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=1892 --annotation=metrics_client_id=ace457b15bab42b4b0eaee69880faebf --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.4.760 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffa847b27f8,0x7ffa847b2804,0x7ffa847b2810
                                  2⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:5512
                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater --broupdater-origin=auto --bits_job_guid={2FC4DC59-2A0E-4366-98FA-1B686C94B46E}
                                1⤵
                                • Drops file in Windows directory
                                • Enumerates system info in registry
                                PID:5936
                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                  C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1785725290 --annotation=last_update_date=1785725290 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=5936 --annotation=metrics_client_id=ace457b15bab42b4b0eaee69880faebf --annotation=micromode=broupdater --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.4.760 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffa847b27f8,0x7ffa847b2804,0x7ffa847b2810
                                  2⤵
                                    PID:4920
                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater-stat-bits --broupdater-stat-name=install --bits_job_guid={1E70F3E2-05E0-4B67-B434-A39C7EB273F7}
                                  1⤵
                                  • Checks processor information in registry
                                  • Enumerates system info in registry
                                  PID:4192
                                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                    C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1785725290 --annotation=last_update_date=1785725290 --annotation=launches_after_update=2 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=4192 --annotation=metrics_client_id=ace457b15bab42b4b0eaee69880faebf --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.4.760 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffa847b27f8,0x7ffa847b2804,0x7ffa847b2810
                                    2⤵
                                      PID:2924
                                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2140,i,10808686651486664189,10046547687709951422,524288 --field-trial-handle=2324,i,1613549605529240659,8923834773483339808,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2328,i,16149415403152500122,17951048267309717564,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2356 --brver=26.6.4.760 /prefetch:11
                                      2⤵
                                      • System Time Discovery
                                      PID:4156
                                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --gpu-process-kind=sandboxed --metrics-shmem-handle=1948,i,9539855665537618297,8772922787859691378,262144 --field-trial-handle=2324,i,1613549605529240659,8923834773483339808,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2328,i,16149415403152500122,17951048267309717564,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2320 /prefetch:2
                                      2⤵
                                      • Network Service Discovery
                                      PID:1288
                                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater-stat-bits --broupdater-stat-name=dayuse --bits_job_guid={39E3996D-9508-43F6-A0E5-982152E9C596}
                                    1⤵
                                    • Checks processor information in registry
                                    • Enumerates system info in registry
                                    PID:6136
                                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                      C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1785725290 --annotation=last_update_date=1785725290 --annotation=launches_after_update=2 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=6136 --annotation=metrics_client_id=ace457b15bab42b4b0eaee69880faebf --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.6.4.760 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffa847b27f8,0x7ffa847b2804,0x7ffa847b2810
                                      2⤵
                                        PID:4104
                                      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --gpu-process-kind=sandboxed --metrics-shmem-handle=1964,i,17635035468826577252,3716045033093997123,262144 --field-trial-handle=2308,i,12899304110611540707,11959588556162106098,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2312,i,7760519252196134642,10928648611207058626,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2304 /prefetch:2
                                        2⤵
                                        • Network Service Discovery
                                        PID:5668
                                      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=3f6440b0-5514-4195-b6a2-d80455cfccef --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2140,i,15932144816565370793,16691110152956983599,524288 --field-trial-handle=2308,i,12899304110611540707,11959588556162106098,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2312,i,7760519252196134642,10928648611207058626,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2340 --brver=26.6.4.760 /prefetch:11
                                        2⤵
                                        • System Time Discovery
                                        PID:4824

                                    Network

                                          MITRE ATT&CK Enterprise v16

                                          Reconnaissance

                                          Resource Development

                                          Initial Access

                                          Execution

                                          Persistence

                                          Boot or Logon Autostart Execution

                                          1
                                          T1547

                                          Registry Run Keys / Startup Folder

                                          1
                                          T1547.001

                                          Privilege Escalation

                                          Boot or Logon Autostart Execution

                                          1
                                          T1547

                                          Registry Run Keys / Startup Folder

                                          1
                                          T1547.001

                                          Defense Evasion

                                          Modify Registry

                                          2
                                          T1112

                                          Subvert Trust Controls

                                          1
                                          T1553

                                          Install Root Certificate

                                          1
                                          T1553.004

                                          Credential Access

                                          Credentials from Password Stores

                                          1
                                          T1555

                                          Credentials from Web Browsers

                                          1
                                          T1555.003

                                          Unsecured Credentials

                                          1
                                          T1552

                                          Credentials In Files

                                          1
                                          T1552.001

                                          Discovery

                                          Browser Information Discovery

                                          1
                                          T1217

                                          Network Service Discovery

                                          1
                                          T1046

                                          Peripheral Device Discovery

                                          1
                                          T1120

                                          Query Registry

                                          5
                                          T1012

                                          System Information Discovery

                                          4
                                          T1082

                                          System Location Discovery

                                          1
                                          T1614

                                          System Language Discovery

                                          1
                                          T1614.001

                                          System Time Discovery

                                          1
                                          T1124

                                          Lateral Movement

                                          Collection

                                          Data from Local System

                                          1
                                          T1005

                                          Command and Control

                                          Exfiltration

                                          Impact

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          e599218.rbs
                                          • Path C:\Config.Msi\e599218.rbs
                                          • Size 912B
                                          • SHA256 c782c394b6a36ef9c997b28e5abd6ede4fafff13b3ade3b6fffffc20960ccd0d
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          3B9DF3EA7CFCFDED92A8B4356F4D6C86_199B3EB75A5B6EBC4E82359B529314CB
                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B9DF3EA7CFCFDED92A8B4356F4D6C86_199B3EB75A5B6EBC4E82359B529314CB
                                          • Size 1KB
                                          • SHA256 501e13ab686f5314940f7659bd7c28fb352781b78720c8cc567f944f0b82ff69
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          439F613B3D55693954E1B080DE3085B4_C14B486881EE76829D3D6096AF53D23B
                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\439F613B3D55693954E1B080DE3085B4_C14B486881EE76829D3D6096AF53D23B
                                          • Size 1KB
                                          • SHA256 36c6da425a8b95d5659ce6c9b02dc1cb3a6919176988f0df58428ed608ee1ed7
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          61A1C5C63BEAA1EA2A7E6CD3BE62EA26_892A9C841DD128677076CA4EDA2B76E2
                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\61A1C5C63BEAA1EA2A7E6CD3BE62EA26_892A9C841DD128677076CA4EDA2B76E2
                                          • Size 1KB
                                          • SHA256 f5569fa268af8a96de826891feb95a7181f9ad2b621f655c0a386414e4db9511
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          A90AB99B5CC057007BC33B2303FE2710
                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A90AB99B5CC057007BC33B2303FE2710
                                          • Size 37KB
                                          • SHA256 545790dd65d30de8ade33e60322e42c96d491939add308a9edf4efac4dc0b3e0
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          BD92F95DED26541D3AF7F44DC7914843
                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BD92F95DED26541D3AF7F44DC7914843
                                          • Size 721B
                                          • SHA256 5095bd2c84d29a158935f583d99f6c82d83f7d9af9fdc4a427f4e6c8d60c2f1e
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          3B9DF3EA7CFCFDED92A8B4356F4D6C86_199B3EB75A5B6EBC4E82359B529314CB
                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B9DF3EA7CFCFDED92A8B4356F4D6C86_199B3EB75A5B6EBC4E82359B529314CB
                                          • Size 524B
                                          • SHA256 f777a8cdda38db038c548837e6144215f2a6553ce6eee091db66a049df527e2e
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          439F613B3D55693954E1B080DE3085B4_C14B486881EE76829D3D6096AF53D23B
                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\439F613B3D55693954E1B080DE3085B4_C14B486881EE76829D3D6096AF53D23B
                                          • Size 510B
                                          • SHA256 0c9789af30912ca9cb67d33824938499e71f43192745cf152d6164577e74d314
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          61A1C5C63BEAA1EA2A7E6CD3BE62EA26_892A9C841DD128677076CA4EDA2B76E2
                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\61A1C5C63BEAA1EA2A7E6CD3BE62EA26_892A9C841DD128677076CA4EDA2B76E2
                                          • Size 554B
                                          • SHA256 5330255414107c25b44def3fd3c12a820e5bebd1de38329ab556ff5ccb84aff0
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          A90AB99B5CC057007BC33B2303FE2710
                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A90AB99B5CC057007BC33B2303FE2710
                                          • Size 226B
                                          • SHA256 1928513f47753c6443fdf121155a4b3f5a1fc7b37cbe2da7ad6dfe96bee61efb
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          BD92F95DED26541D3AF7F44DC7914843
                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BD92F95DED26541D3AF7F44DC7914843
                                          • Size 214B
                                          • SHA256 3ff67b6497e8219829238639346938d0673c9f9685a766996abc3dfdda12cd64
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          cf942aba5dd88306a6aa1e9d6e227572
                                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\thumbnails\cf942aba5dd88306a6aa1e9d6e227572
                                          • Size 15KB
                                          • SHA256 2435c0376fca765b21d43e897f4baa52daa0958a7015d04103488c606c99d1d3
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          fc9acca9e2a0668d979b5501b6c2e7b2
                                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\thumbnails\fc9acca9e2a0668d979b5501b6c2e7b2
                                          • Size 6KB
                                          • SHA256 cbd302b0ea2218f495b9f0a814f34733f2c5f13a6634d74c6e85a5c0863b5621
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          seederexe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\03267BB0-F760-435F-BF36-D4FAB1CC8E5C\seederexe.exe
                                          • Size 8.5MB
                                          • SHA256 a2f5780c9d334c42323ae2cf3328227e7d04a5f6983ff862dc73627f1e970431
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          YandexPackSetup.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
                                          • Size 10.1MB
                                          • SHA256 dd52062569fba53f9bf8de2bb6fad0eccd6bd997a359827458da46432abec9ae
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          sender.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\C6B46C0C-A687-4295-9F03-9BF9D88F1E68\sender.exe
                                          • Size 260KB
                                          • SHA256 e249d09956aa2ef44db6a3cdab525abb73d01e7ad46bd83984e0d22d71c9dcc6
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          lite_installer.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\F2A8ADF6-3728-49C2-AB41-89F52CA37394\lite_installer.exe
                                          • Size 420KB
                                          • SHA256 985d3c2eb69a9f681c876d7a3d28b53f177ebcde90af9ca9d1d8d8be79b03a31
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          PartnerFile
                                          • Path C:\Users\Admin\AppData\Local\Temp\PartnerFile
                                          • Size 1.4MB
                                          • SHA256 1fce5cd6e35be95425985d1aaa46b6ed5a4bb2e036507fcb8b3085b2b6c4eca6
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          BRAND_COMMON
                                          • Path C:\Users\Admin\AppData\Local\Temp\YB_29DF5.tmp\BRAND_COMMON
                                          • Size 25.6MB
                                          • SHA256 148dd64880a8a6716df3dac2c98c935b02d110a2bab25a7b5491babfce989497
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          brand_yandex
                                          • Path C:\Users\Admin\AppData\Local\Temp\YB_29DF5.tmp\brand_yandex
                                          • Size 2.5MB
                                          • SHA256 487be414d5a4a42a8177b82778fc845ac4a96c99979fff61a18d2945038d9d92
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          setup.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\YB_29DF5.tmp\setup.exe
                                          • Size 7.5MB
                                          • SHA256 5d02e0e896fa50deb15e374b6497b55047d4102bd457aad963f8652025899c76
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          YandexSearch00000.log
                                          • Path C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
                                          • Size 1KB
                                          • SHA256 644783a3fe5c221cddb2fe9a5f8c61a82dc7e36c8f707f14719eee6c0ec959a5
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          clids-yasearch.xml
                                          • Path C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml
                                          • Size 712B
                                          • SHA256 d88da0e8854874c1a5fd3ad6fc776a7d0a849bd729d55210181e5da9a35641ab
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          lite_installer.log
                                          • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                                          • Size 1KB
                                          • SHA256 cedba295da8084b21279d8c63262f3f453d6026f50f146c0924a9d1b2530dc98
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          lite_installer.log
                                          • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                                          • Size 13KB
                                          • SHA256 0205c40c739ea3585e926403233719f2707d74bc4cb7ce427ea79e09ecc22ce2
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          lite_installer.log
                                          • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                                          • Size 7KB
                                          • SHA256 dfe329b645f47aeaffabfd4ea518f07c07aaf6bd54cef998d80358d8e5cf7b88
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          lite_installer.log
                                          • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                                          • Size 14KB
                                          • SHA256 1ff0f925af1a3a80edf146f25e35b61ddabb63ca06d0e78c357efba39f6f8edc
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          master_preferences
                                          • Path C:\Users\Admin\AppData\Local\Temp\master_preferences
                                          • Size 542B
                                          • SHA256 0325fd8be2634b3b8fd40c2d7900b7816bc4cc456ed1b708d9b1f0ca1af4853b
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          vendor00000.xml
                                          • Path C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
                                          • Size 529B
                                          • SHA256 682b5e8ff1efc8ca0ce00b921c1e582fc9d9afe962cb818c7d9ae367474e99cd
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          yandex_browser_updater.log
                                          • Path C:\Users\Admin\AppData\Local\Temp\yandex_browser_updater.log
                                          • Size 5KB
                                          • SHA256 44f5c6e95958e1cd16aeaa1c53b4d2fa2bcf9d01e98677c95d8e944c1bce2613
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          ybAB79.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\ybAB79.exe
                                          • Size 12.0MB
                                          • SHA256 9a1c28f6c68a6f8cc969da152c792598f0cfdd225ecc2dc3bd77f35df8389cc4
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          YandexSearch.msi
                                          • Path C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
                                          • Size 9.7MB
                                          • SHA256 edaacbba08d08a0bc897a4c6912dc1750dc120416c3145dd38ec97d6c31291d8
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Yandex.exe
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
                                          • Size 395KB
                                          • SHA256 50d73db5c8098789f182bc6fff3d9308c3ad7957286389b5fa3c1438210f3d76
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Yandex.lnk
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk
                                          • Size 2KB
                                          • SHA256 d8bfaa5e4f2721e43d16db54cdc1d4767c535bade89a2426b95c2ea445f17d2f
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          ru.bdic
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\YandexDictionaries\ru.bdic
                                          • Size 4.5MB
                                          • SHA256 af2bcc135f974aad505a8f55296117dbf4cbc095931e22f424698b181d273656
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          install_state.json
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\install_state.json
                                          • Size 1KB
                                          • SHA256 6fd31e7e9b2409afbd4417d3abdc3ec450ef4b8863b4d37e76b40ab3bc026d66
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          brand_config
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.4.760\brand_config
                                          • Size 6KB
                                          • SHA256 12ca1aa1c45fc768ad015d0f394ec9a8ec745941056a8d57f07957943606e85d
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          partner_config
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.4.760\partner_config
                                          • Size 341B
                                          • SHA256 82e288090168abe15419015317fd38f56c1136e7481f66656d84e0a2d861d4d6
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          all_zip
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.4.760\resources\configs\all_zip
                                          • Size 1.4MB
                                          • SHA256 aaec6a172360722d499f96791096fb7d3bf0f7896642d224946b4350bdf4358a
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          light_static.jpg
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.4.760\resources\wallpapers\light.title\light_static.jpg
                                          • Size 674KB
                                          • SHA256 16df6e2f9e057ce2e90981f8dfc026d5deeda9266147256fbb787eb27e2f3ee1
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          sea_preview.jpg
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.4.760\resources\wallpapers\sea_preview.jpg
                                          • Size 59KB
                                          • SHA256 f60c331f1336b891a44aeff7cc3429c5c6014007028ad81cca53441c5c6b293e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          sea_static.jpg
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.6.4.760\resources\wallpapers\sea_static.jpg
                                          • Size 300KB
                                          • SHA256 1605169330d8052d726500a2605da63b30613ac743a7fbfb04e503a4056c4e8a
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          settings.dat
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad\settings.dat
                                          • Size 48B
                                          • SHA256 33c64679ed1cd39ca456eaf9ab8a1f506cc55e8f00eafad8d43d9d02b14781bb
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          3c2776d6-5839-4e2b-981a-1af80681fb2d.tmp
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\3c2776d6-5839-4e2b-981a-1af80681fb2d.tmp
                                          • Size 5KB
                                          • SHA256 6ee89fd775bb85e0173ea05fb4bc854800fc7166f054fc6506621e637bee1b6a
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          data_0
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_0
                                          • Size 44KB
                                          • SHA256 3049f6a05d0c079214d45ffa142d6a9c3d37051c3ce95c295f029aea6b045fa7
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          data_2
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_2
                                          • Size 8KB
                                          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          data_3
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_3
                                          • Size 8KB
                                          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          f_000004
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\f_000004
                                          • Size 40KB
                                          • SHA256 5895185cf878a38cd172286ed97976e6ab620b2c5fd7f7810f9c9d2f7169da6d
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          f_000006
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\f_000006
                                          • Size 48KB
                                          • SHA256 b3cd587a747007fc5a365ceec5daa964c559e4862ae70aa98f5d0e1849d5ddf0
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          accfb9af-a423-4721-a62f-57f7b7b97401.tmp
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Code Cache\js\index-dir\accfb9af-a423-4721-a62f-57f7b7b97401.tmp
                                          • Size 48B
                                          • SHA256 d896f17f065b014c0117d247a7376a3e892996fe27b6bae52b45b9be97c5451f
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          the-real-index
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Code Cache\js\index-dir\the-real-index
                                          • Size 840B
                                          • SHA256 672b63971323c3ffe20e02d546fc51991e38a821ee3b563f4825dd0eee8e5b5f
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          MANIFEST-000001
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Extension Rules\MANIFEST-000001
                                          • Size 41B
                                          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          96722a5a-efb4-4554-8b8d-156e9ea5eec1.tmp
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Network\96722a5a-efb4-4554-8b8d-156e9ea5eec1.tmp
                                          • Size 59B
                                          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          Preferences
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                          • Size 15KB
                                          • SHA256 5ddfc17bd45efe431d9a81378e06770640f526eaf08313855b2cd08f5b1cf765
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Preferences
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                          • Size 18KB
                                          • SHA256 57c8b38b7dcef2a85bce3658b5b1bd98921b7d70fef392dd57899ec38fddc4bd
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Preferences
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                          • Size 18KB
                                          • SHA256 9195b8b1b69fbe211133be6d62e7e9e5da4f08c2c1d9b11a012e64f484b3a465
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Preferences
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                          • Size 9KB
                                          • SHA256 f665ed6838a1b37176bf98840fcb4a14af3d2bf519e791f404c784ea9e354584
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Preferences
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                          • Size 13KB
                                          • SHA256 100f4bddfc165683b68e4237dd159a9136d95d6800d8177e524498ec0d5ffe77
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Secure Preferences
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
                                          • Size 15KB
                                          • SHA256 2fbf93bafd78d4c2520fbc90ecb8d59991b54b536bf7e05e5ce76500954972a4
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Secure Preferences
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
                                          • Size 15KB
                                          • SHA256 c69052647196c8e5ef49cdaeb89af0f4df1a77d0c3c975a3af9348e733ee9eb7
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          2d60dc46-05c5-4ada-9ddb-40caaee3c232.tmp
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Service Worker\CacheStorage\df10055077ba6d055202a286871492a294099fa5\2d60dc46-05c5-4ada-9ddb-40caaee3c232.tmp
                                          • Size 153B
                                          • SHA256 4f07a164eed92b9e59ca9490dcfb4ede94cd5c10392cc558824b1879ba478770
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          index
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Service Worker\CacheStorage\df10055077ba6d055202a286871492a294099fa5\6c25b684-cbac-4a8f-a170-976c39e03bce\index
                                          • Size 24B
                                          • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          696d97d2-ba80-4e36-b704-94d5d486eef5.tmp
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Service Worker\CacheStorage\df10055077ba6d055202a286871492a294099fa5\6c25b684-cbac-4a8f-a170-976c39e03bce\index-dir\696d97d2-ba80-4e36-b704-94d5d486eef5.tmp
                                          • Size 48B
                                          • SHA256 56456cdd3e100e81800c949f8363fb61d3277d0d73d42bf006f53eb756799af5
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          the-real-index
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Service Worker\CacheStorage\df10055077ba6d055202a286871492a294099fa5\6c25b684-cbac-4a8f-a170-976c39e03bce\index-dir\the-real-index
                                          • Size 480B
                                          • SHA256 1e0c6d734dfde9d4a7f66e5c3bafd8ef630247d7d29df62f867cfe183d5148fa
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          index.txt
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Service Worker\CacheStorage\df10055077ba6d055202a286871492a294099fa5\index.txt
                                          • Size 148B
                                          • SHA256 1e693fe7c4592c6cb530087fd45e507a6370a3386902d5a8f5020aa44fc43b57
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          57cee644-f0bb-4ad1-9496-dd0cdd004a3e.tmp
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Service Worker\ScriptCache\index-dir\57cee644-f0bb-4ad1-9496-dd0cdd004a3e.tmp
                                          • Size 48B
                                          • SHA256 263ec636292333dfc61466c5b5bfeb09d4b02f3fa4e2eed0138edfcf092b0afc
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          the-real-index
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                          • Size 72B
                                          • SHA256 4febfbbc3e29554559470942b36f0d9b4d388bf0fb03098898545393e4ffc254
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          CURRENT
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Sync Data\LevelDB\CURRENT
                                          • Size 16B
                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          128.png
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir5788_154652574\Trusted Icons\Icons\128.png
                                          • Size 6KB
                                          • SHA256 6f6240bda239efc7969736dcb36212b55e0c026b6e191069a59b0319a871902e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          256.png
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir5788_154652574\Trusted Icons\Icons\256.png
                                          • Size 5KB
                                          • SHA256 4c8ab9772a662445717504802cf06755896080fb8cec679172acae975c98f67b
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          64.png
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir5788_154652574\Trusted Icons\Icons\64.png
                                          • Size 3KB
                                          • SHA256 9c844d058a7125bb5e87b880dd6d73ad91473498d2840e109c8d01aca1d5905c
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          96.png
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir5788_154652574\Trusted Icons\Icons\96.png
                                          • Size 5KB
                                          • SHA256 feba94135d0ae26db2694c294c124c30b5f7a385b6a64441d4ecadebe680ac93
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          c793d775-32c1-4ba3-8f0f-15b3babebee1.tmp
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\c793d775-32c1-4ba3-8f0f-15b3babebee1.tmp
                                          • Size 8KB
                                          • SHA256 963f8cb7ff4537e29e8114bbd8f18179f81fc867e5841aea7f3d3885ca32daa6
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          f001c7ee-3322-424d-9858-9f25c6c820a8.tmp
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\f001c7ee-3322-424d-9858-9f25c6c820a8.tmp
                                          • Size 149KB
                                          • SHA256 c98934f68fee70e22ed5d7a96999d02b7840391c38ade2f2bdf73e88fa50d4f2
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          data_1
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\GraphiteDawnCache\data_1
                                          • Size 264KB
                                          • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Local State
                                          • Size 235KB
                                          • SHA256 3dc5adcdebe038d3dc26795f42d5619a5a705abf4b52dad2178ea9a43257e038
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Local State
                                          • Size 235KB
                                          • SHA256 d0cc6db53246cb37e4069dfc10d7ba3b3b13c53713af91f2086eb98160cc6c14
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Local State
                                          • Size 210KB
                                          • SHA256 b5a4c87bc0aefc85caea9b24846624631d6f59a75b983c865af1af10322226a1
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                          • Size 6KB
                                          • SHA256 2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                          • Size 21.6MB
                                          • SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          metadata.json
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\metadata.json
                                          • Size 236B
                                          • SHA256 df671539241fbc96e33ab6dbce06498e6dd1a0927a6f4c394b8f86ce27b541db
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          metadata.json
                                          • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\metadata.json
                                          • Size 13B
                                          • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Яндекс.website
                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Яндекс.website
                                          • Size 515B
                                          • SHA256 f30c368abc7b6d9c54affcab23c48ed0147781492d1912dcc6b202ed50743178
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          places.sqlite
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cxykicyu.Admin\places.sqlite
                                          • Size 68KB
                                          • SHA256 b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          clids-yabrowser.xml
                                          • Path C:\Users\Admin\AppData\Roaming\Yandex\clids-yabrowser.xml
                                          • Size 738B
                                          • SHA256 2e7e8beb2149d914390f742f4b67e27e2961207548090847053ffa64153f9ae9
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          ui
                                          • Path C:\Users\Admin\AppData\Roaming\Yandex\ui
                                          • Size 38B
                                          • SHA256 9fe810b463e8c6c26298f6bd35de871223b15b1c15620f1edd0199f57c93530b
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          MSI95FD.tmp
                                          • Path C:\Windows\Installer\MSI95FD.tmp
                                          • Size 181KB
                                          • SHA256 1ad18330acc4f254d8a37ffdf6d14283e1617b1e163ee8d05c876bb41ac6f316
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          MSI969A.tmp
                                          • Path C:\Windows\Installer\MSI969A.tmp
                                          • Size 197KB
                                          • SHA256 c149276c0b4427c1149fc5a85dc42b4c71c027c2b5fcbc73e6e659f7b3a75562
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          service_update.exe
                                          • Path C:\Windows\SystemTemp\sdwra_2452_1275248338\service_update.exe
                                          • Size 4.9MB
                                          • SHA256 c73c111e67e8a33810fecf7b61f8d460eea4472eab59c513e4a0fa45990f1c7b
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          yandex_browser_installer.log
                                          • Path C:\Windows\SystemTemp\yandex_browser_installer.log
                                          • Size 9KB
                                          • SHA256 b1db0f43097560a2a1246d1e939c92291f89f2374c9ab00709542395bf99bd13
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          yandex_browser_service_update.log
                                          • Path C:\Windows\SystemTemp\yandex_browser_service_update.log
                                          • Size 3KB
                                          • SHA256 5d049c9c436ef8ce7096046eca04b28a02e35eb2b99bc97ed3da459e9bd4805d
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          yandex_browser_service_update.log
                                          • Path C:\Windows\SystemTemp\yandex_browser_service_update.log
                                          • Size 4KB
                                          • SHA256 569cfd6fdb33cab7660f6940ab8b8ec1961c3b3d9e23acce8c648b3f39f6f86f
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          memory/460-1311-0x000001B522410000-0x000001B52243A000-memory.dmp
                                          Download

                                          memory/460-928-0x00007FFAA63F0000-0x00007FFAA63F1000-memory.dmp
                                          Download

                                          memory/748-1389-0x00000297C2C60000-0x00000297C2C8F000-memory.dmp
                                          Download

                                          memory/1288-1636-0x00000266CE6A0000-0x00000266CE6CA000-memory.dmp
                                          Download

                                          memory/2624-1338-0x000002AABF800000-0x000002AABF82F000-memory.dmp
                                          Download

                                          memory/2964-1405-0x00000246CA8D0000-0x00000246CA8FF000-memory.dmp
                                          Download

                                          memory/3340-1337-0x000001424F110000-0x000001424F13F000-memory.dmp
                                          Download

                                          memory/3340-1058-0x00007FFAA6540000-0x00007FFAA6541000-memory.dmp
                                          Download

                                          memory/3340-1059-0x00007FFAA6550000-0x00007FFAA6551000-memory.dmp
                                          Download

                                          memory/4396-1312-0x00000216E9A00000-0x00000216E9A2A000-memory.dmp
                                          Download

                                          memory/4556-1641-0x0000028683C60000-0x0000028683C8F000-memory.dmp
                                          Download

                                          memory/5140-1469-0x000001801CDE0000-0x000001801CE0F000-memory.dmp
                                          Download

                                          memory/5644-1406-0x0000028B87C80000-0x0000028B87CAF000-memory.dmp
                                          Download

                                          memory/5668-1738-0x000002389E9A0000-0x000002389E9CA000-memory.dmp
                                          Download