Overview

overview

8

Static

static

3

2026-08-22...er.exe

windows10-2004-x64

8

2026-08-22...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/08/2026, 06:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-22_721db281c45e92ebe3da578f85873c29_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
  • Size 225KB
  • Sample260823-hfa3rsteqd
  • SHA256 67ca9a6390e7a9627ba07ae5c0aab853ebd7305474598e4658b5c6c7c2efe7b9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 3 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 50 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 11 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 17 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-22_721db281c45e92ebe3da578f85873c29_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-22_721db281c45e92ebe3da578f85873c29_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
    1⤵
    • Downloads MZ/PE file
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2636
    • C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /passive /msicl "VID=230 YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y "
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3308
    • C:\Users\Admin\AppData\Local\Temp\2026-08-22_721db281c45e92ebe3da578f85873c29_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-22_721db281c45e92ebe3da578f85873c29_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe --stat dwnldr/p=937853/cnt=0/dt=2/ct=0/rt=0 --dh 2476 --st 1787467222
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5344
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3228
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 59F9A1A10B489C69499859041E2A95CF
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:108
      • C:\Users\Admin\AppData\Local\Temp\0B08D493-019F-4A98-89E7-2ED8A2114C27\lite_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\0B08D493-019F-4A98-89E7-2ED8A2114C27\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSER
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:3540
      • C:\Users\Admin\AppData\Local\Temp\9B129ADF-9D59-4AAD-B530-67AAABD9C203\seederexe.exe
        "C:\Users\Admin\AppData\Local\Temp\9B129ADF-9D59-4AAD-B530-67AAABD9C203\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\5946FC45-4512-48C2-B555-25D0BBC9D1C0\sender.exe" "--is_elevated=yes" "--ui_level=2" "--good_token=x" "--no_opera=n"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4416
        • C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
          C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\WWWYAR~1.ICO"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3568
          • C:\Users\Admin\AppData\Local\Temp\pin\explorer.exe
            C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\WWWYAR~1.ICO" /pin-path="C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk" --is-pinning
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3396
        • C:\Users\Admin\AppData\Local\Temp\5946FC45-4512-48C2-B555-25D0BBC9D1C0\sender.exe
          C:\Users\Admin\AppData\Local\Temp\5946FC45-4512-48C2-B555-25D0BBC9D1C0\sender.exe --send "/status.xml?clid=12871334-230&uuid=39bfd74a-5335-4291-9f23-c437251bfcb9&vnt=Windows 11x64&file-no=8%0A10%0A11%0A12%0A13%0A15%0A17%0A18%0A20%0A21%0A22%0A25%0A36%0A40%0A42%0A45%0A57%0A61%0A89%0A102%0A103%0A111%0A123%0A124%0A125%0A"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:5052
  • C:\Users\Admin\AppData\Local\Temp\{C5739035-657D-46C7-B7B9-04DD33E1F6D4}.exe
    "C:\Users\Admin\AppData\Local\Temp\{C5739035-657D-46C7-B7B9-04DD33E1F6D4}.exe" --job-name=yBrowserDownloader-{054F5854-B62B-4782-A9F4-BB01BEBDA4BC} --send-statistics --local-path=C:\Users\Admin\AppData\Local\Temp\{C5739035-657D-46C7-B7B9-04DD33E1F6D4}.exe --YABROWSER --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=12871316-230&ui={39bfd74a-5335-4291-9f23-c437251bfcb9} --use-user-default-locale
    1⤵
    • Downloads MZ/PE file
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5988
    • C:\Users\Admin\AppData\Local\Temp\ybC7DA.tmp
      "C:\Users\Admin\AppData\Local\Temp\ybC7DA.tmp" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\7254036d-fc31-443c-837f-54029f9af6ce.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=616627537 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{054F5854-B62B-4782-A9F4-BB01BEBDA4BC} --local-path="C:\Users\Admin\AppData\Local\Temp\{C5739035-657D-46C7-B7B9-04DD33E1F6D4}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=12871316-230&ui={39bfd74a-5335-4291-9f23-c437251bfcb9} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\c49b07c1-ba9f-40c4-87ca-2203e14880df.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3068
      • C:\Users\Admin\AppData\Local\Temp\YB_6A865.tmp\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\YB_6A865.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_6A865.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\7254036d-fc31-443c-837f-54029f9af6ce.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=616627537 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{054F5854-B62B-4782-A9F4-BB01BEBDA4BC} --local-path="C:\Users\Admin\AppData\Local\Temp\{C5739035-657D-46C7-B7B9-04DD33E1F6D4}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=12871316-230&ui={39bfd74a-5335-4291-9f23-c437251bfcb9} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\c49b07c1-ba9f-40c4-87ca-2203e14880df.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3396
        • C:\Users\Admin\AppData\Local\Temp\YB_6A865.tmp\setup.exe
          "C:\Users\Admin\AppData\Local\Temp\YB_6A865.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_6A865.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\7254036d-fc31-443c-837f-54029f9af6ce.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=616627537 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{054F5854-B62B-4782-A9F4-BB01BEBDA4BC} --local-path="C:\Users\Admin\AppData\Local\Temp\{C5739035-657D-46C7-B7B9-04DD33E1F6D4}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=12871316-230&ui={39bfd74a-5335-4291-9f23-c437251bfcb9} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\c49b07c1-ba9f-40c4-87ca-2203e14880df.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico" --verbose-logging --run-as-admin --target-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=656886195
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Time Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2036
          • C:\Users\Admin\AppData\Local\Temp\YB_6A865.tmp\setup.exe
            C:\Users\Admin\AppData\Local\Temp\YB_6A865.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=2036 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.8.0.1788 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff764350490,0x7ff76435049c,0x7ff7643504a8
            5⤵
            • Executes dropped EXE
            PID:4476
          • C:\Windows\SystemTemp\sdwra_2036_224122606\service_update.exe
            "C:\Windows\SystemTemp\sdwra_2036_224122606\service_update.exe" --setup
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2620
            • C:\Program Files (x86)\Yandex\YandexBrowser\26.8.0.1788\service_update.exe
              "C:\Program Files (x86)\Yandex\YandexBrowser\26.8.0.1788\service_update.exe" --install
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:5600
          • C:\Windows\SystemTemp\scoped_dir2036_610232441\explorer.exe
            "C:\Windows\SystemTemp\scoped_dir2036_610232441\explorer.exe" --pttw1="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Яндекс Браузер с Алисой AI.lnk" --shortcut-name-with-alice-for-new-users-enabled
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2716
            • C:\Windows\SystemTemp\scoped_dir2036_610232441\explorer.exe
              C:\Windows\SystemTemp\scoped_dir2036_610232441\explorer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=2716 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.8.0.1788 --initial-client-data=0x290,0x294,0x298,0x1ec,0x29c,0x7ff61b2f0490,0x7ff61b2f049c,0x7ff61b2f04a8
              6⤵
              • Executes dropped EXE
              PID:2640
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Temp\clids.xml"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3008
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\source2036_1963369286\Browser-bin\clids_yandex_second.xml"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5040
  • C:\Program Files (x86)\Yandex\YandexBrowser\26.8.0.1788\service_update.exe
    "C:\Program Files (x86)\Yandex\YandexBrowser\26.8.0.1788\service_update.exe" --run-as-service
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Program Files (x86)\Yandex\YandexBrowser\26.8.0.1788\service_update.exe
      "C:\Program Files (x86)\Yandex\YandexBrowser\26.8.0.1788\service_update.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=2188 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.8.0.1788 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff7bfa31d18,0x7ff7bfa31d24,0x7ff7bfa31d30
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:1724
    • C:\Program Files (x86)\Yandex\YandexBrowser\26.8.0.1788\service_update.exe
      "C:\Program Files (x86)\Yandex\YandexBrowser\26.8.0.1788\service_update.exe" --update-scheduler
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:4548
      • C:\Program Files (x86)\Yandex\YandexBrowser\26.8.0.1788\service_update.exe
        "C:\Program Files (x86)\Yandex\YandexBrowser\26.8.0.1788\service_update.exe" --update-background-scheduler
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:976
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4588
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --progress-window=0 --install-start-time-no-uac=616627537
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1012
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id= --annotation=main_process_pid=1012 --annotation=metrics_client_id=f03c6cf3f3ab454eb59b2f0b90e27df7 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.8.0.1788 --initial-client-data=0x150,0x154,0x158,0x12c,0x15c,0x7ffc678f79a0,0x7ffc678f79ac,0x7ffc678f79b8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4888
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --gpu-process-kind=sandboxed --metrics-shmem-handle=2068,i,7502242718784597044,11440840851724208840,262144 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2312 /prefetch:2
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5584
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --gpu-process-kind=trampoline --metrics-shmem-handle=2164,i,4162166644653784876,17749078177781265822,262144 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2360 /prefetch:6
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:124
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2388,i,4938946762854279318,2739617611492843354,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2760 --brver=26.8.0.1788 /prefetch:11
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:828
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=ru --service-sandbox-type=none --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Video Capture" --metrics-shmem-handle=3348,i,14680275180841429413,14393691814915729422,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3396 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2140
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Storage Service" --metrics-shmem-handle=2972,i,5652729345749114738,17063227217497130475,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=1804 --brver=26.8.0.1788 /prefetch:13
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4328
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=ru --service-sandbox-type=audio --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Audio Service" --metrics-shmem-handle=3292,i,9452679506689108777,10896767328478512396,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3308 --brver=26.8.0.1788 /prefetch:12
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3052
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=ru --service-sandbox-type=none --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Импорт профилей" --metrics-shmem-handle=4512,i,7442434555533112661,16969021598528195766,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4680 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:3392
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --may-use-trampoline-gpu --metrics-shmem-handle=4672,i,1851666930714626415,17100239163412524243,2097152 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4748 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:2976
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --may-use-trampoline-gpu --metrics-shmem-handle=5276,i,10112320928743561336,16890450465561754727,2097152 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5292 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:4560
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=5480,i,4031063050418012456,7003884836906941427,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5472 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:616
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=uwp_cookie_provider.mojom.UwpCookieProvider --lang=ru --service-sandbox-type=utility --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name=uwp_cookie_provider.mojom.UwpCookieProvider --metrics-shmem-handle=5700,i,7930149623070504801,3391093295888169638,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5716 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4468
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=5940,i,800444701933548984,5993998545564766109,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5924 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2648
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=5932,i,13177698257063534359,18122622573871168927,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5948 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2808
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=5952,i,16769163799112606441,14377112636818482614,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5992 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3860
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6160,i,1800517730850599698,11062089866316989381,2097152 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6608 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:3468
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4832,i,3650382576007441077,1054695925092171238,2097152 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=4808 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:4192
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5760,i,3277533060679774874,9706659139629782214,2097152 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=5600 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:5752
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7216,i,16151039040097897853,8496101535943660070,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=7228 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2668
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7360,i,6041473689473498163,10578924523964514967,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7372 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4368
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=4928,i,878120853202355468,5336270404637305835,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7380 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2888
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7200,i,971242691974798759,13287927987623896782,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7696 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:3320
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7188,i,2696578277612545132,12996738486580246566,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=7828 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4756
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7984,i,12297193760369152463,1979898700312707965,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7996 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5188
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7636,i,13635658576187830876,11126889140427212321,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=7212 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3120
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7648,i,7608316564572812957,8592828236064103608,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=8244 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4848
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7672,i,12749187587161203036,5986647838046405894,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=7660 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4340
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7680,i,1421354374700342160,18429508271628372354,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=8500 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3236
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8632,i,10616738899836468342,17267731700623249755,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=8644 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4736
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7972,i,15424836809954108805,16606964638513260012,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=7960 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5456
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7980,i,11603182847941003151,4399352565726791188,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=8904 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:1692
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9060,i,15552019531733149644,7924124771330960684,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=9084 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:2964
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9072,i,13239136582017470480,1762951036551542729,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=9104 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:1652
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9352,i,13573300915846491718,16031064581072739573,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=9364 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4952
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9500,i,17744242981994788422,10260175413393719475,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=9512 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5756
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9056,i,10938500256775728841,13222779511149014709,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=9648 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5288
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9044,i,8344374834929398086,2259444148613526065,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=9788 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:260
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9036,i,3124307174763308485,612945721621482664,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=9924 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:2136
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9932,i,17821618878346877653,15462978581236115136,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=10064 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5952
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10192,i,8045290166242871041,11635402191299553140,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=10204 --brver=26.8.0.1788 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:6096
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10336,i,8403809310292912020,17451513742195856145,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=10348 --brver=26.8.0.1788 /prefetch:14
        2⤵
          PID:2040
        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10492,i,10925912928556579401,14925537955641001402,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=10504 --brver=26.8.0.1788 /prefetch:14
          2⤵
            PID:3292
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10512,i,11634279640672601417,2303328123630560613,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=10644 --brver=26.8.0.1788 /prefetch:14
            2⤵
              PID:5788
            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10652,i,8533149545310527082,17277393126242314839,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=10784 --brver=26.8.0.1788 /prefetch:14
              2⤵
                PID:1148
              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10792,i,5254138537054091228,5771292753890650216,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=10924 --brver=26.8.0.1788 /prefetch:14
                2⤵
                  PID:2256
                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11168,i,3423035099916350872,2225092788805402387,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=11180 --brver=26.8.0.1788 /prefetch:14
                  2⤵
                    PID:5664
                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11316,i,2106407314355764547,6818559687384543429,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=11328 --brver=26.8.0.1788 /prefetch:14
                    2⤵
                      PID:2428
                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11516,i,3314234873321023366,16630349506221393801,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=11528 --brver=26.8.0.1788 /prefetch:14
                      2⤵
                        PID:2112
                      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=ru --service-sandbox-type=none --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=11652,i,18176014851307917340,10443244729962097718,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=11656 --brver=26.8.0.1788 /prefetch:14
                        2⤵
                          PID:2928
                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=11732,i,8089244452528293992,5476449800594359819,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=11668 --brver=26.8.0.1788 /prefetch:14
                          2⤵
                            PID:5024
                          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=2376,i,3039378511573377874,10640247970952896733,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=2556 --brver=26.8.0.1788 /prefetch:14
                            2⤵
                              PID:2952
                            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=2560,i,3412954676847584412,14112645366427994945,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=2384 --brver=26.8.0.1788 /prefetch:14
                              2⤵
                                PID:4384
                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=3388,i,14803753811139983918,12762152137241840075,2097152 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=2504 /prefetch:1
                                2⤵
                                • System Time Discovery
                                PID:4240
                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=3392,i,17421597759616514738,9479495361294966999,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=3264 --brver=26.8.0.1788 /prefetch:14
                                2⤵
                                  PID:4768
                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=3372,i,13332295601736568006,810337821450895452,2097152 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=2332 /prefetch:1
                                  2⤵
                                  • System Time Discovery
                                  PID:5704
                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=11692,i,18307033928359737769,13163990362214860287,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=3256 --brver=26.8.0.1788 /prefetch:14
                                  2⤵
                                    PID:1176
                                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=2548,i,17509341388600414743,18320029841471467488,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=2552 --brver=26.8.0.1788 /prefetch:14
                                    2⤵
                                      PID:2832
                                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=2556,i,14034308549726184685,4266296800077498906,524288 --field-trial-handle=2316,i,15899115226067447891,11633727046485134243,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2320,i,12385670237691526844,5944901850015403920,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=3284 --brver=26.8.0.1788 /prefetch:14
                                      2⤵
                                        PID:124
                                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --shutdown-if-not-closed-by-system-restart
                                      1⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:2728
                                      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                        C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1787467325 --annotation=last_update_date=1787467325 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=2728 --annotation=metrics_client_id=f03c6cf3f3ab454eb59b2f0b90e27df7 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.8.0.1788 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffc678f79a0,0x7ffc678f79ac,0x7ffc678f79b8
                                        2⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:2816
                                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater --broupdater-origin=auto --bits_job_guid={E3894C10-F4B7-4E36-9F1B-E89A9AB7B37D}
                                      1⤵
                                      • Drops file in Windows directory
                                      • Enumerates system info in registry
                                      PID:4400
                                      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                        C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1787467325 --annotation=last_update_date=1787467325 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=4400 --annotation=metrics_client_id=f03c6cf3f3ab454eb59b2f0b90e27df7 --annotation=micromode=broupdater --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.8.0.1788 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffc678f79a0,0x7ffc678f79ac,0x7ffc678f79b8
                                        2⤵
                                          PID:2720
                                      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater-stat-bits --broupdater-stat-name=install --bits_job_guid={2EB1D06D-6693-4FC5-8032-CDA87032DEBD}
                                        1⤵
                                        • Checks processor information in registry
                                        • Enumerates system info in registry
                                        PID:1728
                                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                          C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1787467325 --annotation=last_update_date=1787467325 --annotation=launches_after_update=2 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=1728 --annotation=metrics_client_id=f03c6cf3f3ab454eb59b2f0b90e27df7 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.8.0.1788 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffc678f79a0,0x7ffc678f79ac,0x7ffc678f79b8
                                          2⤵
                                            PID:4672
                                          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2172,i,8118325470300774033,13832304650894846395,524288 --field-trial-handle=2320,i,13985696481352153068,13389671465204146830,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2324,i,10497713593839157296,4855113144848498147,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2352 --brver=26.8.0.1788 /prefetch:11
                                            2⤵
                                            • System Time Discovery
                                            PID:2704
                                          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --gpu-process-kind=sandboxed --metrics-shmem-handle=1988,i,17831908319157717442,15760465118500216247,262144 --field-trial-handle=2320,i,13985696481352153068,13389671465204146830,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2324,i,10497713593839157296,4855113144848498147,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2316 /prefetch:2
                                            2⤵
                                            • Network Service Discovery
                                            PID:2436
                                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater-stat-bits --broupdater-stat-name=dayuse --bits_job_guid={523AB3DB-D19F-4328-8A41-D559FD8EFEEB}
                                          1⤵
                                            PID:3336
                                            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                              C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1787467325 --annotation=last_update_date=1787467325 --annotation=launches_after_update=2 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=3336 --annotation=metrics_client_id=f03c6cf3f3ab454eb59b2f0b90e27df7 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.8.0.1788 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffc678f79a0,0x7ffc678f79ac,0x7ffc678f79b8
                                              2⤵
                                                PID:5024
                                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2172,i,17565409331091481109,14518905928240923507,524288 --field-trial-handle=2312,i,17176948336690218590,18107250808580813799,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2316,i,8436048638868513393,6239691331613016744,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2344 --brver=26.8.0.1788 /prefetch:11
                                                2⤵
                                                • System Time Discovery
                                                PID:3060
                                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=39bfd74a-5335-4291-9f23-c437251bfcb9 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --gpu-process-kind=sandboxed --metrics-shmem-handle=1988,i,2378674528180747951,3981826550690518316,262144 --field-trial-handle=2312,i,17176948336690218590,18107250808580813799,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2316,i,8436048638868513393,6239691331613016744,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2308 /prefetch:2
                                                2⤵
                                                • Network Service Discovery
                                                PID:124

                                            Network

                                                  MITRE ATT&CK Enterprise v16

                                                  Reconnaissance

                                                  Resource Development

                                                  Initial Access

                                                  Execution

                                                  Persistence

                                                  Boot or Logon Autostart Execution

                                                  1
                                                  T1547

                                                  Registry Run Keys / Startup Folder

                                                  1
                                                  T1547.001

                                                  Privilege Escalation

                                                  Boot or Logon Autostart Execution

                                                  1
                                                  T1547

                                                  Registry Run Keys / Startup Folder

                                                  1
                                                  T1547.001

                                                  Defense Evasion

                                                  Modify Registry

                                                  4
                                                  T1112

                                                  Subvert Trust Controls

                                                  1
                                                  T1553

                                                  Install Root Certificate

                                                  1
                                                  T1553.004

                                                  Credential Access

                                                  Credentials from Password Stores

                                                  1
                                                  T1555

                                                  Credentials from Web Browsers

                                                  1
                                                  T1555.003

                                                  Unsecured Credentials

                                                  1
                                                  T1552

                                                  Credentials In Files

                                                  1
                                                  T1552.001

                                                  Discovery

                                                  Browser Information Discovery

                                                  1
                                                  T1217

                                                  Network Service Discovery

                                                  1
                                                  T1046

                                                  Peripheral Device Discovery

                                                  1
                                                  T1120

                                                  Query Registry

                                                  5
                                                  T1012

                                                  System Information Discovery

                                                  4
                                                  T1082

                                                  System Location Discovery

                                                  1
                                                  T1614

                                                  System Language Discovery

                                                  1
                                                  T1614.001

                                                  System Time Discovery

                                                  1
                                                  T1124

                                                  Lateral Movement

                                                  Collection

                                                  Data from Local System

                                                  1
                                                  T1005

                                                  Command and Control

                                                  Exfiltration

                                                  Impact

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  e5947a1.rbs
                                                  • Path C:\Config.Msi\e5947a1.rbs
                                                  • Size 912B
                                                  • SHA256 4db505b2aa0845d2daab22cb225f3589b966226b86802cd169af17a619de2760
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                                  • Size 1KB
                                                  • SHA256 d8f294f37f62e9a4b725a2f00f54b7ad738748b4b354acc6423cfffca8b58ebb
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  349D186F1CB5682FA0194D4F3754EF36_39FA54E89881FB5CCD5CD9DF5E849801
                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_39FA54E89881FB5CCD5CD9DF5E849801
                                                  • Size 1KB
                                                  • SHA256 ab2c2cce9b7d13d1f177c7476ec868cada7b8c9d7dfcf44424e04313051cf2e5
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                                  • Size 1KB
                                                  • SHA256 00cc8c0b275acd7decb6ba9846bcde06fc414b2ef21b621dec4dd190b25c1d71
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
                                                  • Size 1KB
                                                  • SHA256 539967825fc3b418888aa906bd8e19bd2f3c7ba5c821d4fff6c0f0c61fc8b0d4
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                                  • Size 1KB
                                                  • SHA256 48e7236c1179a7ac0e74bf02ab3d021aef0eb361dfb46aff01c97cfb96243e50
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                                  • Size 1KB
                                                  • SHA256 404661a7a0fbe622c7aeff68e2dbbf4a1529cd258423389b68a8fa7134016275
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                                  • Size 508B
                                                  • SHA256 eb352f2f83badc0ca60850794decb771112b00f001d1758688f6ff25002df5fe
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  349D186F1CB5682FA0194D4F3754EF36_39FA54E89881FB5CCD5CD9DF5E849801
                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_39FA54E89881FB5CCD5CD9DF5E849801
                                                  • Size 532B
                                                  • SHA256 6694d1c4cedb22e226f3ebe09baa8727acdd45595ebd7c523a351eb614efdecc
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                                  • Size 536B
                                                  • SHA256 93e8d3dd43e3c37ed38a4c49bc7464a56b007dad2ded720a60f608ff846e1fe3
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_F9EC4AEA9882736924865A4CF427D722
                                                  • Size 536B
                                                  • SHA256 c1fb11e92a9607c73838f1ecca9d4980c8b3fa852aa21009c4a8f49f12a1203e
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                                  • Size 536B
                                                  • SHA256 23ea91c09d1fdd9372dee6ebbedc35cd25c7d4b3b587f95ad4756593d2d16468
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                                  • Size 506B
                                                  • SHA256 d9d3b580fd1642baa9b3277b32bcd5a073a4e8fc482cc6ef34592e00c8327bff
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  www.ya.ru.ico
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Services\www.ya.ru.ico
                                                  • Size 5KB
                                                  • SHA256 6bb91f1d74389b18bce6e71772e4c5573648c1a4823338193f700afdf8216be5
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  4a28b95105a70b561396c3e8c85d4bc5
                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\thumbnails\4a28b95105a70b561396c3e8c85d4bc5
                                                  • Size 15KB
                                                  • SHA256 2435c0376fca765b21d43e897f4baa52daa0958a7015d04103488c606c99d1d3
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  lite_installer.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\0B08D493-019F-4A98-89E7-2ED8A2114C27\lite_installer.exe
                                                  • Size 418KB
                                                  • SHA256 d5afe2f333908aa0e84b59851f8208a9dfc0838d13d59b3d76f6f6c9245f6afb
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  sender.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\5946FC45-4512-48C2-B555-25D0BBC9D1C0\sender.exe
                                                  • Size 258KB
                                                  • SHA256 38483f6f7ac7ba9ebc7294448575673142a4cb2e8c6500987c0cf7de59a6a082
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  YandexPackSetup.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
                                                  • Size 10.1MB
                                                  • SHA256 aee3b363f4a43dd8a731282a3fdd5648b05376a6711b2f841fea2f098b0cb53d
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  seederexe.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\9B129ADF-9D59-4AAD-B530-67AAABD9C203\seederexe.exe
                                                  • Size 8.6MB
                                                  • SHA256 71be9c579ff6385abc1a7c4157d73f126375ea722d6174d113077506a8936550
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  PartnerFile
                                                  • Path C:\Users\Admin\AppData\Local\Temp\PartnerFile
                                                  • Size 1.4MB
                                                  • SHA256 b940a380c839e3516641d3c49809648395401c1cf06324d02851dc15315312d9
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  BRAND_COMMON
                                                  • Path C:\Users\Admin\AppData\Local\Temp\YB_6A865.tmp\BRAND_COMMON
                                                  • Size 25.6MB
                                                  • SHA256 736cd788802009e805c60681c06577fc2d93ebb7765a41bdfd205dcd338a9617
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  brand_yandex
                                                  • Path C:\Users\Admin\AppData\Local\Temp\YB_6A865.tmp\brand_yandex
                                                  • Size 2.5MB
                                                  • SHA256 65a16acd7b19777fbaa75dda55dbd9752cc43c82b29daa33c58e7052b3270668
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  setup.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\YB_6A865.tmp\setup.exe
                                                  • Size 7.8MB
                                                  • SHA256 75a6d85fcd4680abc0b2113acb71c850ed3759a2be8b18f0ce62544bcd771258
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  YandexSearch00000.log
                                                  • Path C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
                                                  • Size 1KB
                                                  • SHA256 a29c62cb29f6e6d0a6f1596403b0da418e305ab71fd99e66fff74b0f309f3d15
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  clids-yasearch.xml
                                                  • Path C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml
                                                  • Size 729B
                                                  • SHA256 d4d46fc40ebca4aa0d55c805f33142d0effe56f905e203ef354679751e8a9eca
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  lite_installer.log
                                                  • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                                                  • Size 11KB
                                                  • SHA256 b0cf67ba6d5e6d2c5fa2a0f25c08336fcf824ac02d6d2ab050ee07e687405742
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  master_preferences
                                                  • Path C:\Users\Admin\AppData\Local\Temp\master_preferences
                                                  • Size 542B
                                                  • SHA256 0325fd8be2634b3b8fd40c2d7900b7816bc4cc456ed1b708d9b1f0ca1af4853b
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  vendor00000.xml
                                                  • Path C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
                                                  • Size 528B
                                                  • SHA256 ac715d8635e832b50ebcda36d5ccaad739cf9b557b921598022e013375b36890
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  yandex_browser_updater.log
                                                  • Path C:\Users\Admin\AppData\Local\Temp\yandex_browser_updater.log
                                                  • Size 5KB
                                                  • SHA256 0ef3803c8c218150fca92e8456a94d1903dcb3bd49d8ceebbac3b6132acd3131
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  YandexSearch.msi
                                                  • Path C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
                                                  • Size 9.8MB
                                                  • SHA256 76495a2601ea7a6ce24927cbce165a211f8b341f83bc4f03bdc2d61bafc49ad0
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  {C5739035-657D-46C7-B7B9-04DD33E1F6D4}.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\{C5739035-657D-46C7-B7B9-04DD33E1F6D4}.exe
                                                  • Size 12.0MB
                                                  • SHA256 fbdcf008c5ab2d3ab92f08bfbac513b0a500e1b413584816e33973daec4e89ca
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Yandex.exe
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
                                                  • Size 395KB
                                                  • SHA256 50d73db5c8098789f182bc6fff3d9308c3ad7957286389b5fa3c1438210f3d76
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Yandex.lnk
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk
                                                  • Size 2KB
                                                  • SHA256 54f815278cdd36f33b45fddb6a295ad3c24cd9b0c6f8f3bd049ad2ab8b666246
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  ru.bdic
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\YandexDictionaries\ru.bdic
                                                  • Size 4.5MB
                                                  • SHA256 af2bcc135f974aad505a8f55296117dbf4cbc095931e22f424698b181d273656
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  install_state.json
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\install_state.json
                                                  • Size 1KB
                                                  • SHA256 943753db209e3f5b063b52f744bce4e5d0c65a71610f237c2b3e6b0d667dd310
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  brand_config
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.8.0.1788\brand_config
                                                  • Size 6KB
                                                  • SHA256 b7e5fef3591a961800538ecf08004544a24c46c7f334be1fd065a5c6d291a27b
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  partner_config
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.8.0.1788\partner_config
                                                  • Size 341B
                                                  • SHA256 82e288090168abe15419015317fd38f56c1136e7481f66656d84e0a2d861d4d6
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  all_zip
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.8.0.1788\resources\configs\all_zip
                                                  • Size 1.4MB
                                                  • SHA256 88e172817fc0dc7e68f760b909fd20ec2b09e03eeef95aaf8908a1beaa7e1305
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  light_static.jpg
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.8.0.1788\resources\wallpapers\light.title\light_static.jpg
                                                  • Size 674KB
                                                  • SHA256 16df6e2f9e057ce2e90981f8dfc026d5deeda9266147256fbb787eb27e2f3ee1
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  sea_preview.jpg
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.8.0.1788\resources\wallpapers\sea_preview.jpg
                                                  • Size 59KB
                                                  • SHA256 f60c331f1336b891a44aeff7cc3429c5c6014007028ad81cca53441c5c6b293e
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  sea_static.jpg
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.8.0.1788\resources\wallpapers\sea_static.jpg
                                                  • Size 300KB
                                                  • SHA256 1605169330d8052d726500a2605da63b30613ac743a7fbfb04e503a4056c4e8a
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  56f2e428-0ce7-4b61-8cab-5dbeef885172.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\56f2e428-0ce7-4b61-8cab-5dbeef885172.tmp
                                                  • Size 218KB
                                                  • SHA256 c3bd2c5ca95138e4cf4cfaab484fe0b71d9c7209826cc02ef61b4362aab5451c
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  settings.dat
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad\settings.dat
                                                  • Size 48B
                                                  • SHA256 686e11efcf585efb0b08c933eb9fd0aba39b551049c887f5a71a9cd64ef85d97
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  data_0
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_0
                                                  • Size 44KB
                                                  • SHA256 4ec10187a3872f6264af10c0fcbc577e399115556fdfb57defefa799dc5e1943
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  data_2
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_2
                                                  • Size 8KB
                                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  data_3
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_3
                                                  • Size 8KB
                                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  f_000004
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\f_000004
                                                  • Size 40KB
                                                  • SHA256 5895185cf878a38cd172286ed97976e6ab620b2c5fd7f7810f9c9d2f7169da6d
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  f_000006
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\f_000006
                                                  • Size 48KB
                                                  • SHA256 b3cd587a747007fc5a365ceec5daa964c559e4862ae70aa98f5d0e1849d5ddf0
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  a45b5d2a-52db-4ed3-84f8-af0147af928c.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Code Cache\js\index-dir\a45b5d2a-52db-4ed3-84f8-af0147af928c.tmp
                                                  • Size 48B
                                                  • SHA256 0f6ec4d9b9c2ee9b957aec57cb89021640c55bb0c3da4ef83c279908436c9d40
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  the-real-index
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                  • Size 840B
                                                  • SHA256 485c10ef0a6821a288971fecd744928a7a7556f2282df8398796edc395976495
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                                  • Size 18KB
                                                  • SHA256 94eb7ea25f9a47d733d883949b59618927d9093697411542ffa54d66d796ef4f
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                                  • Size 15KB
                                                  • SHA256 4ca37ed7983435ee022ca1da8f3f65c05087c101a35e2014811277c3fcf0ebb5
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                                  • Size 9KB
                                                  • SHA256 60740c74a02f02449514f5047ad18f2362a47adaa6946bd1063cf5a66e808b95
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                                  • Size 13KB
                                                  • SHA256 a42c44e3babb9ee1e8bf004c03cc730714f6ae102470d049db30e4f8e43f0904
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                                  • Size 18KB
                                                  • SHA256 89c8cbd5abbeaee9f98725e4c4775917885b1d42e9eb50ac639815868c995cd9
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Secure Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
                                                  • Size 13KB
                                                  • SHA256 a32a31a99443859ea58724e553f40c1a76fbe7090ce7faba0381e026e6dde0bb
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Secure Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
                                                  • Size 13KB
                                                  • SHA256 a9e65cb25bf9d00502d1cc21779d5650e6698d4f67f105395035dd3a8869f660
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  index
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Service Worker\CacheStorage\df10055077ba6d055202a286871492a294099fa5\0a664409-9e14-4f55-8ebb-857af7a99d3e\index
                                                  • Size 24B
                                                  • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  128.png
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir1012_1136767536\Trusted Icons\Icons\128.png
                                                  • Size 6KB
                                                  • SHA256 6f6240bda239efc7969736dcb36212b55e0c026b6e191069a59b0319a871902e
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  256.png
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir1012_1136767536\Trusted Icons\Icons\256.png
                                                  • Size 5KB
                                                  • SHA256 4c8ab9772a662445717504802cf06755896080fb8cec679172acae975c98f67b
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  64.png
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir1012_1136767536\Trusted Icons\Icons\64.png
                                                  • Size 3KB
                                                  • SHA256 9c844d058a7125bb5e87b880dd6d73ad91473498d2840e109c8d01aca1d5905c
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  96.png
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir1012_1136767536\Trusted Icons\Icons\96.png
                                                  • Size 5KB
                                                  • SHA256 feba94135d0ae26db2694c294c124c30b5f7a385b6a64441d4ecadebe680ac93
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  a0dbf8c9-a1f5-42d0-81ff-060d87679672.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\a0dbf8c9-a1f5-42d0-81ff-060d87679672.tmp
                                                  • Size 148KB
                                                  • SHA256 0064d9ac2b06563f447236cdf310008b5e5cfa070632140a239aa84e568077f4
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  b448eef9-08ca-426e-9a38-8a58d7b8fab7.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\b448eef9-08ca-426e-9a38-8a58d7b8fab7.tmp
                                                  • Size 8KB
                                                  • SHA256 3fe24306954268b4cd263bf2363989e355e303d9f892fcbd6ab6e75440fe09da
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  fa5ad905-608a-4f49-958d-921e49d7e1d9.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\fa5ad905-608a-4f49-958d-921e49d7e1d9.tmp
                                                  • Size 5KB
                                                  • SHA256 299974a033f81f7c21b5e0e971b2ec4e2ef913094dbd04d2d4f9d34f22c6fd6a
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  MANIFEST-000001
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\shared_proto_db\MANIFEST-000001
                                                  • Size 41B
                                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  CURRENT
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\shared_proto_db\metadata\CURRENT
                                                  • Size 16B
                                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  data_1
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\GrShaderCache\data_1
                                                  • Size 264KB
                                                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Local State
                                                  • Size 236KB
                                                  • SHA256 00fafd321daf6e4d3d17a8cdecafec513f305c4eb77c31823128d911f71d3546
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Local State
                                                  • Size 237KB
                                                  • SHA256 4b25cfe0b35340d2125d325dd75c43c79ce50d4ba285d7decbe21368f2850d65
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Local State
                                                  • Size 237KB
                                                  • SHA256 6f79be4d6090126154cc79152d92e8ea9aec1144412b17a11324ef310de9e630
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                                  • Size 6KB
                                                  • SHA256 2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                                  • Size 21.6MB
                                                  • SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  metadata.json
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\metadata.json
                                                  • Size 13B
                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  metadata.json
                                                  • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\metadata.json
                                                  • Size 236B
                                                  • SHA256 df671539241fbc96e33ab6dbce06498e6dd1a0927a6f4c394b8f86ce27b541db
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Яндекс.website
                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Яндекс.website
                                                  • Size 516B
                                                  • SHA256 573a17ea8a59eb2c1227900e50853a1fd25e92beb7ca532376a7a877e7bc3214
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  places.sqlite
                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f5sv0tmr.Admin\places.sqlite
                                                  • Size 68KB
                                                  • SHA256 b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Bookmarks
                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks
                                                  • Size 1KB
                                                  • SHA256 2b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Preferences
                                                  • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences
                                                  • Size 319B
                                                  • SHA256 7e7e3285b033baf959ee891cc58006486317d019293ca57a616164be8d99dc7f
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  clids-yabrowser.xml
                                                  • Path C:\Users\Admin\AppData\Roaming\Yandex\clids-yabrowser.xml
                                                  • Size 755B
                                                  • SHA256 60c7c04d612ff2933d3f029de083cf380ec84651ed061f9010d32e0682cffdeb
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  ui
                                                  • Path C:\Users\Admin\AppData\Roaming\Yandex\ui
                                                  • Size 38B
                                                  • SHA256 c49a9b11bb68e2036dfd2b0c3c4c2ffe66b8d97a3d292bf722937f28e431a788
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  MSI4B09.tmp
                                                  • Path C:\Windows\Installer\MSI4B09.tmp
                                                  • Size 182KB
                                                  • SHA256 814b1644c8fe5f1af6b9207e5757c8bb80950e903cfb4e1166bb188ea8577bb7
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  MSI4BA6.tmp
                                                  • Path C:\Windows\Installer\MSI4BA6.tmp
                                                  • Size 187KB
                                                  • SHA256 2ceae73443e109cbdf36adcfdc0160f2363860dbfb4186cf47cb9130b0283205
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  yandex_browser_installer.log
                                                  • Path C:\Windows\SystemTemp\yandex_browser_installer.log
                                                  • Size 6KB
                                                  • SHA256 3203450e9a4432694c9059400504b29999fc29958e2feceb1491b68a20ffb7ca
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  yandex_browser_service_update.log
                                                  • Path C:\Windows\SystemTemp\yandex_browser_service_update.log
                                                  • Size 3KB
                                                  • SHA256 9fcad7811c0e5dbf1563a192fe0e5f3fe27c1ba881de114556830a219fc0b8ac
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  yandex_browser_service_update.log
                                                  • Path C:\Windows\SystemTemp\yandex_browser_service_update.log
                                                  • Size 4KB
                                                  • SHA256 6c9ccdd8dcf8b5b806cec5f1a7796b940a7694a2878c620441ed8ab8da638b95
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  memory/124-1384-0x0000017F048B0000-0x0000017F04A73000-memory.dmp
                                                  Download

                                                  memory/124-1446-0x0000017F048B0000-0x0000017F04A73000-memory.dmp
                                                  Download

                                                  memory/124-1719-0x000002CF73190000-0x000002CF73353000-memory.dmp
                                                  Download

                                                  memory/1012-1478-0x000002060F780000-0x000002060F9C1000-memory.dmp
                                                  Download

                                                  memory/2436-1592-0x000001F308DD0000-0x000001F308F93000-memory.dmp
                                                  Download

                                                  memory/2976-1263-0x0000020E6C210000-0x0000020E6C2B8000-memory.dmp
                                                  Download

                                                  memory/2976-1095-0x00007FFC8AC30000-0x00007FFC8AC31000-memory.dmp
                                                  Download

                                                  memory/2976-1096-0x00007FFC89F10000-0x00007FFC89F11000-memory.dmp
                                                  Download

                                                  memory/3468-1427-0x0000015425980000-0x0000015425A28000-memory.dmp
                                                  Download

                                                  memory/4192-1428-0x0000015F51B00000-0x0000015F51BA8000-memory.dmp
                                                  Download

                                                  memory/4240-1554-0x000001C724F60000-0x000001C725008000-memory.dmp
                                                  Download

                                                  memory/4560-1413-0x00000133701A0000-0x0000013370248000-memory.dmp
                                                  Download

                                                  memory/5584-1383-0x000001F817E30000-0x000001F817FF3000-memory.dmp
                                                  Download

                                                  memory/5584-962-0x00007FFC89D40000-0x00007FFC89D41000-memory.dmp
                                                  Download

                                                  memory/5704-1650-0x000001F9478B0000-0x000001F947958000-memory.dmp
                                                  Download

                                                  memory/5752-1464-0x000001FEB3820000-0x000001FEB38C8000-memory.dmp
                                                  Download