Overview

overview

8

Static

static

3

2026-09-05...er.exe

windows10-2004-x64

8

2026-09-05...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    142s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/09/2026, 12:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-05_94963abab483a78422b4dc0812776a55_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
  • Size 225KB
  • Sample260907-pax4nstyfz
  • SHA256 6c9122d4647007d54f88b6620680fca086fd37058428f7b5913feb58b2ebfdbd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 52 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 11 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-05_94963abab483a78422b4dc0812776a55_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-05_94963abab483a78422b4dc0812776a55_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
    1⤵
    • Downloads MZ/PE file
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:4844
    • C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /passive /msicl "VID=382 YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y "
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5452
    • C:\Users\Admin\AppData\Local\Temp\2026-09-05_94963abab483a78422b4dc0812776a55_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-05_94963abab483a78422b4dc0812776a55_coinminer_elex_hawkeye_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe --stat dwnldr/p=1095462/cnt=0/dt=3/ct=18/rt=0 --dh 2636 --st 1788782915
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2520
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4904
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 81CD67369C0ED5ABFA02468734C149DB
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5964
      • C:\Users\Admin\AppData\Local\Temp\663FC92D-DEBF-4FC9-90CC-A213BAC6E5C8\lite_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\663FC92D-DEBF-4FC9-90CC-A213BAC6E5C8\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSER
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:2420
      • C:\Users\Admin\AppData\Local\Temp\4405E5B2-A714-4C2A-9307-513BD0F6EC86\seederexe.exe
        "C:\Users\Admin\AppData\Local\Temp\4405E5B2-A714-4C2A-9307-513BD0F6EC86\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\FD6B3EFE-04BD-4230-9727-93F53FF0E858\sender.exe" "--is_elevated=yes" "--ui_level=2" "--good_token=x" "--no_opera=n"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5560
        • C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
          C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\WWWYAR~1.ICO"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2392
          • C:\Users\Admin\AppData\Local\Temp\pin\explorer.exe
            C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\WWWYAR~1.ICO" /pin-path="C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk" --is-pinning
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:408
        • C:\Users\Admin\AppData\Local\Temp\FD6B3EFE-04BD-4230-9727-93F53FF0E858\sender.exe
          C:\Users\Admin\AppData\Local\Temp\FD6B3EFE-04BD-4230-9727-93F53FF0E858\sender.exe --send "/status.xml?clid=14237140-382&uuid=e506ec1c-8f98-455b-9b4c-0ed00d54ada4&vnt=Windows 11x64&file-no=8%0A10%0A11%0A12%0A13%0A15%0A36%0A40%0A42%0A45%0A57%0A61%0A102%0A103%0A111%0A123%0A124%0A125%0A"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1720
  • C:\Users\Admin\AppData\Local\Temp\yb8052.exe
    "C:\Users\Admin\AppData\Local\Temp\yb8052.exe" --job-name=yBrowserDownloader-9262CB6E-9A65-46DE-A809-497F4B64A32C --send-statistics --local-path=C:\Users\Admin\AppData\Local\Temp\yb8052.exe --YABROWSER --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14237136-382&ui={e506ec1c-8f98-455b-9b4c-0ed00d54ada4} --use-user-default-locale
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4152
    • C:\Users\Admin\AppData\Local\Temp\yb8CC5.tmp
      "C:\Users\Admin\AppData\Local\Temp\yb8CC5.tmp" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\9626b085-ab08-4f4e-8e9f-c9de7256d7a9.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=603911181 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-9262CB6E-9A65-46DE-A809-497F4B64A32C --local-path="C:\Users\Admin\AppData\Local\Temp\yb8052.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14237136-382&ui={e506ec1c-8f98-455b-9b4c-0ed00d54ada4} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\b8d1a8f4-2817-41f5-a65c-77b946c137b8.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4204
      • C:\Users\Admin\AppData\Local\Temp\YB_1AE65.tmp\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\YB_1AE65.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_1AE65.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\9626b085-ab08-4f4e-8e9f-c9de7256d7a9.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=603911181 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-9262CB6E-9A65-46DE-A809-497F4B64A32C --local-path="C:\Users\Admin\AppData\Local\Temp\yb8052.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14237136-382&ui={e506ec1c-8f98-455b-9b4c-0ed00d54ada4} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\b8d1a8f4-2817-41f5-a65c-77b946c137b8.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1692
        • C:\Users\Admin\AppData\Local\Temp\YB_1AE65.tmp\setup.exe
          "C:\Users\Admin\AppData\Local\Temp\YB_1AE65.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_1AE65.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\9626b085-ab08-4f4e-8e9f-c9de7256d7a9.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=603911181 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-9262CB6E-9A65-46DE-A809-497F4B64A32C --local-path="C:\Users\Admin\AppData\Local\Temp\yb8052.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=14237136-382&ui={e506ec1c-8f98-455b-9b4c-0ed00d54ada4} --send-statistics --shortcut-name-with-alice-for-new-users-enabled --silent --source=lite --use-user-default-locale --variations-resource-file="C:\Users\Admin\AppData\Local\Temp\variations_resource" --variations-update-path="C:\Users\Admin\AppData\Local\Temp\b8d1a8f4-2817-41f5-a65c-77b946c137b8.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico" --verbose-logging --run-as-admin --target-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=634799711
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Time Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4668
          • C:\Users\Admin\AppData\Local\Temp\YB_1AE65.tmp\setup.exe
            C:\Users\Admin\AppData\Local\Temp\YB_1AE65.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=4668 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.8.1.1024 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff74aff2490,0x7ff74aff249c,0x7ff74aff24a8
            5⤵
            • Executes dropped EXE
            PID:4184
          • C:\Windows\SystemTemp\sdwra_4668_45503538\service_update.exe
            "C:\Windows\SystemTemp\sdwra_4668_45503538\service_update.exe" --setup
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:4576
            • C:\Program Files (x86)\Yandex\YandexBrowser\26.8.1.1024\service_update.exe
              "C:\Program Files (x86)\Yandex\YandexBrowser\26.8.1.1024\service_update.exe" --install
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:2032
          • C:\Windows\SystemTemp\scoped_dir4668_256199554\explorer.exe
            "C:\Windows\SystemTemp\scoped_dir4668_256199554\explorer.exe" --pttw1="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Алиса AI.lnk" --shortcut-name-with-alice-for-new-users-enabled
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:5528
            • C:\Windows\SystemTemp\scoped_dir4668_256199554\explorer.exe
              C:\Windows\SystemTemp\scoped_dir4668_256199554\explorer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=5528 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.8.1.1024 --initial-client-data=0x290,0x294,0x298,0xa0,0x29c,0x7ff706022490,0x7ff70602249c,0x7ff7060224a8
              6⤵
              • Executes dropped EXE
              PID:1532
          • C:\Windows\SystemTemp\scoped_dir4668_1546444132\explorer.exe
            "C:\Windows\SystemTemp\scoped_dir4668_1546444132\explorer.exe" --pttw1="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Яндекс Браузер с Алисой AI.lnk" --shortcut-name-with-alice-for-new-users-enabled
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:5752
            • C:\Windows\SystemTemp\scoped_dir4668_1546444132\explorer.exe
              C:\Windows\SystemTemp\scoped_dir4668_1546444132\explorer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=5752 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.8.1.1024 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff6184c2490,0x7ff6184c249c,0x7ff6184c24a8
              6⤵
              • Executes dropped EXE
              PID:2520
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Temp\clids.xml"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:200
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\source4668_73980675\Browser-bin\clids_yandex_second.xml"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2992
  • C:\Program Files (x86)\Yandex\YandexBrowser\26.8.1.1024\service_update.exe
    "C:\Program Files (x86)\Yandex\YandexBrowser\26.8.1.1024\service_update.exe" --run-as-service
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Program Files (x86)\Yandex\YandexBrowser\26.8.1.1024\service_update.exe
      "C:\Program Files (x86)\Yandex\YandexBrowser\26.8.1.1024\service_update.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=2884 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.8.1.1024 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff7a5342d18,0x7ff7a5342d24,0x7ff7a5342d30
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:1192
    • C:\Program Files (x86)\Yandex\YandexBrowser\26.8.1.1024\service_update.exe
      "C:\Program Files (x86)\Yandex\YandexBrowser\26.8.1.1024\service_update.exe" --update-scheduler
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:5520
      • C:\Program Files (x86)\Yandex\YandexBrowser\26.8.1.1024\service_update.exe
        "C:\Program Files (x86)\Yandex\YandexBrowser\26.8.1.1024\service_update.exe" --update-background-scheduler
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:4348
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:552
    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --progress-window=0 --install-start-time-no-uac=603911181
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5788
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id= --annotation=main_process_pid=5788 --annotation=metrics_client_id=015c994423a24012b8b880c5ad6414a8 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.8.1.1024 --initial-client-data=0x150,0x154,0x158,0xdc,0x15c,0x7ffd19da89a0,0x7ffd19da89ac,0x7ffd19da89b8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4928
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --gpu-process-kind=trampoline --metrics-shmem-handle=2152,i,8256921948656218907,6626437263046908059,262144 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2324 /prefetch:6
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1260
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --gpu-process-kind=sandboxed --metrics-shmem-handle=2036,i,16242305487679024833,12847516699590540760,262144 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2248 /prefetch:2
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2724
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2440,i,7298833006236167528,3617874258698406576,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2624 --brver=26.8.1.1024 /prefetch:11
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:4528
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Storage Service" --metrics-shmem-handle=2980,i,8843526982378445167,9723518732711538722,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3068 --brver=26.8.1.1024 /prefetch:13
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2040
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=ru --service-sandbox-type=none --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Video Capture" --metrics-shmem-handle=3576,i,9306200698528982037,12480669643736672203,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3560 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2368
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=ru --service-sandbox-type=audio --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Audio Service" --metrics-shmem-handle=3460,i,8906424898420232955,12987209502544258649,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3504 --brver=26.8.1.1024 /prefetch:12
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4308
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --may-use-trampoline-gpu --metrics-shmem-handle=4276,i,7663982541851637029,3112815233548062153,2097152 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4284 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:4104
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=ru --service-sandbox-type=none --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Импорт профилей" --metrics-shmem-handle=4840,i,3677747254658213022,11396865035721075528,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4260 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:200
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --may-use-trampoline-gpu --metrics-shmem-handle=5260,i,12265219093928551981,15462949541222542911,2097152 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5276 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:5000
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=2232,i,8589116723367831389,3595776547708807144,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5468 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5812
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=5784,i,13849009171306525147,5581033828001146956,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5676 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1908
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=uwp_cookie_provider.mojom.UwpCookieProvider --lang=ru --service-sandbox-type=utility --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name=uwp_cookie_provider.mojom.UwpCookieProvider --metrics-shmem-handle=5752,i,12512527168891594897,2340893913223544944,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5688 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2060
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=5772,i,14699573759611528402,10489096293430472792,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5792 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5056
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=5808,i,2013974856278222914,12242198332949871957,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5856 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2736
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4216,i,10815467185915331060,13912273326698376376,2097152 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=4916 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:4540
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6624,i,16711792417052648055,15139349371925057645,2097152 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6640 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:1844
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5628,i,9477396282136597290,15183076061612974690,2097152 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6880 /prefetch:1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:5844
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=ru --service-sandbox-type=none --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=7856,i,7195710813944975109,9332967377816578417,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=7840 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5348
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7884,i,13773718524079779043,7943191228555145022,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=8068 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:2748
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8264,i,10764761763304382787,7042831856698931702,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=8280 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2900
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7832,i,2550109197883977926,6645432392805585810,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=8416 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:3164
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8424,i,12836643661542264405,13472426482803751905,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=8556 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2848
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7956,i,6499990456071099188,10997290234863232143,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7944 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4456
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7968,i,15531653834173954935,17100725263676437152,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=8772 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:3356
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7984,i,16279916648502999346,9696394600324769882,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=8904 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1648
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7876,i,11163760347575555037,12600590023498567355,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=9040 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1760
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8008,i,1413199638086893526,17611551224661915189,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=7996 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3388
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8024,i,13202848941190968366,12681777185519921768,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=9296 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4628
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9304,i,1812113225710437155,11116825900484615876,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=9436 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4956
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8052,i,1622111516219518876,5104000336329736930,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=9568 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:948
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8040,i,696496970054821301,17444732889368743903,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=9588 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4688
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8200,i,3654654493966559312,7534910142502370031,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=9700 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4500
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9836,i,15012292183483109995,10520335780686931417,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=9968 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4648
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9988,i,17040996773798028215,8486700485984221503,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=10112 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:8
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8248,i,15431316038979360717,14197047843222330085,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=8232 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:4652
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=7928,i,15251870618063004129,3770866190929729673,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=10356 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5504
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=8260,i,15275694988859812946,13627668596802002833,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=10504 --brver=26.8.1.1024 /prefetch:14
        2⤵
        • Executes dropped EXE
        PID:5076
      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10512,i,6437518242672369034,4252654753047149620,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=10524 --brver=26.8.1.1024 /prefetch:14
        2⤵
          PID:6340
        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10780,i,11998593077056592044,15151121683684444758,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=10792 --brver=26.8.1.1024 /prefetch:14
          2⤵
            PID:6360
          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=10924,i,16937790390006664881,2657824524765564869,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=10936 --brver=26.8.1.1024 /prefetch:14
            2⤵
              PID:6400
            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11068,i,488831419945503011,15727649075301057926,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=11080 --brver=26.8.1.1024 /prefetch:14
              2⤵
                PID:6412
              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=4960,i,15512568363874034362,5192107243763287053,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=4948 --brver=26.8.1.1024 /prefetch:14
                2⤵
                  PID:6524
                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11228,i,8707688325832910379,9206817358656835166,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=11372 --brver=26.8.1.1024 /prefetch:14
                  2⤵
                    PID:6536
                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11524,i,4051093446153925897,2667396730810310344,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=11536 --brver=26.8.1.1024 /prefetch:14
                    2⤵
                      PID:6640
                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11692,i,13945382359551163017,14779463567499091763,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=11704 --brver=26.8.1.1024 /prefetch:14
                      2⤵
                        PID:6804
                      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11864,i,7347311402469497771,10206301487693865304,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709033163963944 --mojo-platform-channel-handle=11876 --brver=26.8.1.1024 /prefetch:14
                        2⤵
                          PID:6876
                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=11860,i,984956792133916772,6198883117285567415,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709034101005793 --mojo-platform-channel-handle=12016 --brver=26.8.1.1024 /prefetch:14
                          2⤵
                            PID:6936
                          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=12152,i,1908260031911681869,6273410638507088728,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709035038047642 --mojo-platform-channel-handle=12168 --brver=26.8.1.1024 /prefetch:14
                            2⤵
                              PID:6984
                            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=7924,i,3745796420754949939,813838665012473883,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709035975089491 --mojo-platform-channel-handle=11316 --brver=26.8.1.1024 /prefetch:14
                              2⤵
                                PID:6208
                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=9428,i,18420991175360522681,1675738340429002782,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709036912131340 --mojo-platform-channel-handle=9436 --brver=26.8.1.1024 /prefetch:14
                                2⤵
                                  PID:4232
                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Распаковщик файлов" --metrics-shmem-handle=11528,i,2892885414087093357,16980341389678508987,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709037849173189 --mojo-platform-channel-handle=11520 --brver=26.8.1.1024 /prefetch:14
                                  2⤵
                                    PID:4108
                                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=12448,i,18274775329277360155,3823799098324593646,2097152 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709038786215038 --mojo-platform-channel-handle=10712 /prefetch:1
                                    2⤵
                                    • System Time Discovery
                                    PID:6544
                                  • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                    "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Data Decoder Service" --metrics-shmem-handle=4332,i,10069871357886753433,13546123383629134605,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709039723256887 --mojo-platform-channel-handle=5068 --brver=26.8.1.1024 /prefetch:14
                                    2⤵
                                      PID:5208
                                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=chrome://ntp/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=11468,i,13604449956663817543,4357915518167572368,2097152 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709040660298736 --mojo-platform-channel-handle=10616 /prefetch:1
                                      2⤵
                                      • System Time Discovery
                                      PID:6880
                                    • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                      "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=4284,i,14611732216415513680,2902567352537129189,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709041597340585 --mojo-platform-channel-handle=2336 --brver=26.8.1.1024 /prefetch:14
                                      2⤵
                                        PID:5504
                                      • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                        "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=2328,i,998842051882216495,15013642118729758713,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709042534382434 --mojo-platform-channel-handle=10692 --brver=26.8.1.1024 /prefetch:14
                                        2⤵
                                          PID:6500
                                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ru --service-sandbox-type=none --message-loop-type-ui --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --force-high-res-timeticks=disabled --process-name="Утилиты Windows" --metrics-shmem-handle=10696,i,10773938030241557754,8757054002400391090,524288 --field-trial-handle=2252,i,14751117393990185853,3647923056917762511,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2284,i,15787200013978491468,2829657420742360705,4 --trace-process-track-uuid=3190709043471424283 --mojo-platform-channel-handle=10680 --brver=26.8.1.1024 /prefetch:14
                                          2⤵
                                            PID:6572
                                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --shutdown-if-not-closed-by-system-restart
                                          1⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:120
                                          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                            C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1788782991 --annotation=last_update_date=1788782991 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=120 --annotation=metrics_client_id=015c994423a24012b8b880c5ad6414a8 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.8.1.1024 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffd19da89a0,0x7ffd19da89ac,0x7ffd19da89b8
                                            2⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            PID:4560
                                        • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                          "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater --broupdater-origin=auto --bits_job_guid={02FE653F-7A68-4A58-B5B2-671DD7C0735C}
                                          1⤵
                                          • Drops file in Windows directory
                                          • Enumerates system info in registry
                                          PID:6580
                                          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                            C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1788782991 --annotation=last_update_date=1788782991 --annotation=launches_after_update=1 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=6580 --annotation=metrics_client_id=015c994423a24012b8b880c5ad6414a8 --annotation=micromode=broupdater --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.8.1.1024 --initial-client-data=0x158,0x15c,0x160,0x134,0x164,0x7ffd19da89a0,0x7ffd19da89ac,0x7ffd19da89b8
                                            2⤵
                                              PID:6652
                                          • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                            "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater-stat-bits --broupdater-stat-name=install --bits_job_guid={CF543C0F-A2C3-4411-BFBA-3F861FC17359}
                                            1⤵
                                            • Checks processor information in registry
                                            • Enumerates system info in registry
                                            PID:6252
                                            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                              C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1788782991 --annotation=last_update_date=1788782991 --annotation=launches_after_update=2 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=6252 --annotation=metrics_client_id=015c994423a24012b8b880c5ad6414a8 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.8.1.1024 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffd19da89a0,0x7ffd19da89ac,0x7ffd19da89b8
                                              2⤵
                                                PID:6176
                                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2192,i,8427901088016605565,12258890777482848085,524288 --field-trial-handle=2328,i,2745004309555680893,8900149246557281130,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,14938997119755690658,16516695067069601984,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2360 --brver=26.8.1.1024 /prefetch:11
                                                2⤵
                                                • System Time Discovery
                                                PID:2244
                                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --gpu-process-kind=sandboxed --metrics-shmem-handle=2004,i,6864128730846882918,9734589526512512989,262144 --field-trial-handle=2328,i,2745004309555680893,8900149246557281130,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,14938997119755690658,16516695067069601984,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2324 /prefetch:2
                                                2⤵
                                                • Network Service Discovery
                                                PID:6196
                                            • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                              "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater-stat-bits --broupdater-stat-name=dayuse --bits_job_guid={A1ECD260-CCEA-49DE-93FC-1A248749DC51}
                                              1⤵
                                              • Enumerates system info in registry
                                              PID:6476
                                              • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1788782991 --annotation=last_update_date=1788782991 --annotation=launches_after_update=2 --annotation=machine_id=488DCA4C15F9A1D330AD312B391A804E --annotation=main_process_pid=6476 --annotation=metrics_client_id=015c994423a24012b8b880c5ad6414a8 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=26.8.1.1024 --initial-client-data=0x154,0x158,0x15c,0x130,0x160,0x7ffd19da89a0,0x7ffd19da89ac,0x7ffd19da89b8
                                                2⤵
                                                  PID:6492
                                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --process-name="Network Service" --metrics-shmem-handle=2200,i,16188694499300968890,11124492396012531901,524288 --field-trial-handle=2328,i,13566142083785731790,10280705665570014223,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,10859629946652885007,7466541127884335671,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2360 --brver=26.8.1.1024 /prefetch:11
                                                  2⤵
                                                  • System Time Discovery
                                                  PID:6820
                                                • C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
                                                  "C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=e506ec1c-8f98-455b-9b4c-0ed00d54ada4 --brand-id=yandex --partner-id=pseudoportal-ru --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --gpu-process-kind=sandboxed --metrics-shmem-handle=2004,i,15410617759220156844,4569005075027804722,262144 --field-trial-handle=2328,i,13566142083785731790,10280705665570014223,262144 --enable-features=ShortcutNameWithAlice --disable-features=Fledge,InterestGroupStorage,PrivateAggregationApi,PrivateAggregationApiProtectedAudienceAdditionalExtensions --variations-seed-version --pseudonymization-salt-handle=2332,i,10859629946652885007,7466541127884335671,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2324 /prefetch:2
                                                  2⤵
                                                  • Network Service Discovery
                                                  PID:7072

                                              Network

                                                    MITRE ATT&CK Enterprise v16

                                                    Reconnaissance

                                                    Resource Development

                                                    Initial Access

                                                    Execution

                                                    Persistence

                                                    Boot or Logon Autostart Execution

                                                    1
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Privilege Escalation

                                                    Boot or Logon Autostart Execution

                                                    1
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Defense Evasion

                                                    Modify Registry

                                                    2
                                                    T1112

                                                    Subvert Trust Controls

                                                    1
                                                    T1553

                                                    Install Root Certificate

                                                    1
                                                    T1553.004

                                                    Credential Access

                                                    Credentials from Password Stores

                                                    1
                                                    T1555

                                                    Credentials from Web Browsers

                                                    1
                                                    T1555.003

                                                    Unsecured Credentials

                                                    1
                                                    T1552

                                                    Credentials In Files

                                                    1
                                                    T1552.001

                                                    Discovery

                                                    Browser Information Discovery

                                                    1
                                                    T1217

                                                    Network Service Discovery

                                                    1
                                                    T1046

                                                    Peripheral Device Discovery

                                                    1
                                                    T1120

                                                    Query Registry

                                                    5
                                                    T1012

                                                    System Information Discovery

                                                    4
                                                    T1082

                                                    System Location Discovery

                                                    1
                                                    T1614

                                                    System Language Discovery

                                                    1
                                                    T1614.001

                                                    System Time Discovery

                                                    1
                                                    T1124

                                                    Lateral Movement

                                                    Collection

                                                    Data from Local System

                                                    1
                                                    T1005

                                                    Command and Control

                                                    Exfiltration

                                                    Impact

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    e59648f.rbs
                                                    • Path C:\Config.Msi\e59648f.rbs
                                                    • Size 912B
                                                    • SHA256 f5636b4e6c7e513d91ffc3533cd5860571d084a046d13fe28b2a8b3fdae5eea2
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                                    • Size 1KB
                                                    • SHA256 bdd258d6456f2f44d1823bff276a6fc1037506cbca7efb8138509d3b21a62bb2
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    349D186F1CB5682FA0194D4F3754EF36_39FA54E89881FB5CCD5CD9DF5E849801
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_39FA54E89881FB5CCD5CD9DF5E849801
                                                    • Size 1KB
                                                    • SHA256 43c59cb394fac31ffb9a8c38a0dccf22aa4295bd32bef400dc455d360c466fac
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                                    • Size 1KB
                                                    • SHA256 dd9b72d8b5c9e082418ad7932619899c0255e556392a7ddcf76ef5042d8d8b1a
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                                    • Size 1KB
                                                    • SHA256 a2a7ecc920baa215ae7624e9dd56642181ed7d286f593747acce2d593bfb9479
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    BD92F95DED26541D3AF7F44DC7914843
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BD92F95DED26541D3AF7F44DC7914843
                                                    • Size 721B
                                                    • SHA256 5095bd2c84d29a158935f583d99f6c82d83f7d9af9fdc4a427f4e6c8d60c2f1e
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
                                                    • Size 508B
                                                    • SHA256 c3ab1f693b24695fbf6897ec8e4eb13dca59301a6dc49e1c721149919c441b0c
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    349D186F1CB5682FA0194D4F3754EF36_39FA54E89881FB5CCD5CD9DF5E849801
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_39FA54E89881FB5CCD5CD9DF5E849801
                                                    • Size 532B
                                                    • SHA256 bbd9fe5f4cbf8020cb076ec1dd1e694809793df0ba43fe3a00fbb8ad8b14c199
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_7A6F6CCB2247ED9DD8BDF7A00E0525CD
                                                    • Size 536B
                                                    • SHA256 3283c804cd680bfd981b9bb8b435f5e81a94995336f0e5736c8369c8e7c71d9e
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    439F613B3D55693954E1B080DE3085B4_C14B486881EE76829D3D6096AF53D23B
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\439F613B3D55693954E1B080DE3085B4_C14B486881EE76829D3D6096AF53D23B
                                                    • Size 510B
                                                    • SHA256 f5792b6ff5481da37d8bf2208dcb69281a7e139783ccc22a043ae3f0952f6b90
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
                                                    • Size 506B
                                                    • SHA256 e6d27aa81c8984d63d4b2eda4d11dd2a355ab11b2231bac682a08b1b5e640a88
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    BD92F95DED26541D3AF7F44DC7914843
                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BD92F95DED26541D3AF7F44DC7914843
                                                    • Size 214B
                                                    • SHA256 8edbaba4d5685e6f103a643de51bd05dd8472ae364604555b53faddeb084b035
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    420e463bcdb7026b06dede31dc9f9c28
                                                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\thumbnails\420e463bcdb7026b06dede31dc9f9c28
                                                    • Size 15KB
                                                    • SHA256 2435c0376fca765b21d43e897f4baa52daa0958a7015d04103488c606c99d1d3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    seederexe.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\4405E5B2-A714-4C2A-9307-513BD0F6EC86\seederexe.exe
                                                    • Size 8.5MB
                                                    • SHA256 a2f5780c9d334c42323ae2cf3328227e7d04a5f6983ff862dc73627f1e970431
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    lite_installer.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\663FC92D-DEBF-4FC9-90CC-A213BAC6E5C8\lite_installer.exe
                                                    • Size 420KB
                                                    • SHA256 985d3c2eb69a9f681c876d7a3d28b53f177ebcde90af9ca9d1d8d8be79b03a31
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    YandexPackSetup.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
                                                    • Size 10.1MB
                                                    • SHA256 d6622353f41b0e8f66a6c35e4efc1c122171f476c602b905223c584d3a4c08e5
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    sender.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\FD6B3EFE-04BD-4230-9727-93F53FF0E858\sender.exe
                                                    • Size 260KB
                                                    • SHA256 e249d09956aa2ef44db6a3cdab525abb73d01e7ad46bd83984e0d22d71c9dcc6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    PartnerFile
                                                    • Path C:\Users\Admin\AppData\Local\Temp\PartnerFile
                                                    • Size 1.4MB
                                                    • SHA256 d33972ba74ce2c3c25c06411e6a0aee27afaa66c32afc9898424978f27d5b36a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    BRAND_COMMON
                                                    • Path C:\Users\Admin\AppData\Local\Temp\YB_1AE65.tmp\BRAND_COMMON
                                                    • Size 25.6MB
                                                    • SHA256 0e65e7352509ac11ea843649a13339e20cbc1423e2830650863aaf3f32c9e84e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    brand_yandex
                                                    • Path C:\Users\Admin\AppData\Local\Temp\YB_1AE65.tmp\brand_yandex
                                                    • Size 2.5MB
                                                    • SHA256 460eb4a21fe50237b6c2cfdc569b81a2234090555eb442c1ead32cae73cac2fe
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    setup.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\YB_1AE65.tmp\setup.exe
                                                    • Size 7.8MB
                                                    • SHA256 7edcbdd363ac98e6f2de70ccd1cc1237eccb4f394519bb374cc780593ed0a64b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    YandexSearch00000.log
                                                    • Path C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
                                                    • Size 1KB
                                                    • SHA256 26993317bcb2001fb3c57051c8e102fb165d282553bd257c64da8026e5e91f06
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    clids-yasearch.xml
                                                    • Path C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml
                                                    • Size 730B
                                                    • SHA256 3e7c9e2b723fcd8535cf480b04e79317bb89664f12ed0cffb0a2eba547df3173
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    lite_installer.log
                                                    • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                                                    • Size 5KB
                                                    • SHA256 5cf19fa6af8c6f2206c96fa536a151f837512daba5fb0801579737271abf51ee
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    lite_installer.log
                                                    • Path C:\Users\Admin\AppData\Local\Temp\lite_installer.log
                                                    • Size 12KB
                                                    • SHA256 6e547d7e7407b8d4061e37eeafd1a80a78662acd2ecf11d89a6fdf63dfaea277
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    master_preferences
                                                    • Path C:\Users\Admin\AppData\Local\Temp\master_preferences
                                                    • Size 542B
                                                    • SHA256 0325fd8be2634b3b8fd40c2d7900b7816bc4cc456ed1b708d9b1f0ca1af4853b
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    vendor00000.xml
                                                    • Path C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
                                                    • Size 529B
                                                    • SHA256 1e15adab0d9556fbf7067feccb3175c0788b8db0ab100a7c93394014f4b5a4b8
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    yandex_browser_updater.log
                                                    • Path C:\Users\Admin\AppData\Local\Temp\yandex_browser_updater.log
                                                    • Size 5KB
                                                    • SHA256 40e5484b62d4f9d7c692e80e013a3d0432b4b04ad6736a6ce99c752ed8c4530f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    yb8052.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\yb8052.exe
                                                    • Size 12.1MB
                                                    • SHA256 ee92f6f2e05e13f3cd7a5b1cea10bc89539bea76ce7cb197417458208a20ff82
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    YandexSearch.msi
                                                    • Path C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
                                                    • Size 9.7MB
                                                    • SHA256 a0093634c803116c31a1abe9ffd2189893245ec26362574c5905c5c1467f9a46
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Yandex.exe
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
                                                    • Size 395KB
                                                    • SHA256 50d73db5c8098789f182bc6fff3d9308c3ad7957286389b5fa3c1438210f3d76
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Yandex.lnk
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk
                                                    • Size 2KB
                                                    • SHA256 3157d1dc3f77d47ceeca002313e400bc094c983bd526eb9acdab2eac4427e92a
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    ru.bdic
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\YandexDictionaries\ru.bdic
                                                    • Size 4.5MB
                                                    • SHA256 af2bcc135f974aad505a8f55296117dbf4cbc095931e22f424698b181d273656
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    install_state.json
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\install_state.json
                                                    • Size 1KB
                                                    • SHA256 e9d99e09184ec948cdfd09ff61871a09cf10a56ac5ee7a38c50b016a66b3fa46
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    brand_config
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.8.1.1024\brand_config
                                                    • Size 6KB
                                                    • SHA256 3b42bf681e3fd6c8f6fb758dc2bb135555fd9a80ee07371e0289682d17bee5d4
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    partner_config
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.8.1.1024\partner_config
                                                    • Size 341B
                                                    • SHA256 82e288090168abe15419015317fd38f56c1136e7481f66656d84e0a2d861d4d6
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    all_zip
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.8.1.1024\resources\configs\all_zip
                                                    • Size 1.4MB
                                                    • SHA256 9558771503ca4a2bc5fc8ad3a169ac389a8228653661e4cf7aa22719f110b073
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    light_static.jpg
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.8.1.1024\resources\wallpapers\light.title\light_static.jpg
                                                    • Size 674KB
                                                    • SHA256 16df6e2f9e057ce2e90981f8dfc026d5deeda9266147256fbb787eb27e2f3ee1
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    sea_preview.jpg
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.8.1.1024\resources\wallpapers\sea_preview.jpg
                                                    • Size 59KB
                                                    • SHA256 f60c331f1336b891a44aeff7cc3429c5c6014007028ad81cca53441c5c6b293e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    sea_static.jpg
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\BrandPackageTemp\26.8.1.1024\resources\wallpapers\sea_static.jpg
                                                    • Size 300KB
                                                    • SHA256 1605169330d8052d726500a2605da63b30613ac743a7fbfb04e503a4056c4e8a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    01b57e96-d35e-4029-a179-460427127ba1.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\01b57e96-d35e-4029-a179-460427127ba1.tmp
                                                    • Size 220KB
                                                    • SHA256 88002b8642128269800989beaeea8ba21d1f34e43548d8d7898808260286c931
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad\settings.dat
                                                    • Size 48B
                                                    • SHA256 f7741e0e49613cc57de065432eec0917e4defccea4afda9443d464b7cbb810df
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad\settings.dat
                                                    • Size 48B
                                                    • SHA256 5629e015cf2f8630f315129e58bccead26ba9a888f78fe6245efe544af2315fe
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    83e69031-a4ff-4849-ad28-17ae3569391c.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\83e69031-a4ff-4849-ad28-17ae3569391c.tmp
                                                    • Size 143KB
                                                    • SHA256 6cfd085fb66783cbc8795cbf06cc99a487c5f0d62ebd29860966fedefdcfc35c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    data_0
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_0
                                                    • Size 44KB
                                                    • SHA256 967dfc2f0c3fa81ecb3349813fccc08f12943f92f791d510ac50963eea256545
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    data_2
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_2
                                                    • Size 8KB
                                                    • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    data_3
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\data_3
                                                    • Size 8KB
                                                    • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    f_000004
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\f_000004
                                                    • Size 40KB
                                                    • SHA256 5895185cf878a38cd172286ed97976e6ab620b2c5fd7f7810f9c9d2f7169da6d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    f_000006
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\Cache_Data\f_000006
                                                    • Size 48KB
                                                    • SHA256 b3cd587a747007fc5a365ceec5daa964c559e4862ae70aa98f5d0e1849d5ddf0
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    0ac36fa9-6488-48a6-9ffe-9fafe97eedd9.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Code Cache\js\index-dir\0ac36fa9-6488-48a6-9ffe-9fafe97eedd9.tmp
                                                    • Size 48B
                                                    • SHA256 cdddf6557bddc51d7810701a40e355f50ff8d257b4ffdda17257c0ecb10c6be8
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    the-real-index
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                    • Size 840B
                                                    • SHA256 53d529f0eb62760ee7962aa5f93d267457524b398df54ad8eb77af7617fcaa6c
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    data_1
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\GPUCache\data_1
                                                    • Size 264KB
                                                    • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                                    • Size 18KB
                                                    • SHA256 77b75a7d6e13ab46084250eaf3e1d76ab475c1d895439ac30612d7ef110fcfd3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                                    • Size 14KB
                                                    • SHA256 a7c2408cc12c8c25f63c0a342bc8fd1a0753730c1d435ea5ce971c996e63bccf
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                                    • Size 15KB
                                                    • SHA256 f0651b4a5cef5fed36df34d1ae8418c3e669ca389bc939d42517a8080a9b4626
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                                    • Size 18KB
                                                    • SHA256 989a252984bd4fbcb2cc1c17fabf06b3df56e9c13854d2eae081079556086744
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Preferences
                                                    • Size 9KB
                                                    • SHA256 dc1beebfbf2ffaa4688e60d5e8f2d07c7bcd07d772a3908f65e4d566228fcc9a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Secure Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
                                                    • Size 13KB
                                                    • SHA256 93763227de02c68458590274d7e7de88d8b5ca479f76cf72283fc624539bc71b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Secure Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Secure Preferences
                                                    • Size 13KB
                                                    • SHA256 c7f28ff5bd65c069779790c7a6ae0f75f8daf3e5970450bd8ba68db327c12200
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    index
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Service Worker\CacheStorage\df10055077ba6d055202a286871492a294099fa5\5fb8d60e-d377-4964-8605-b3b0c4a43530\index
                                                    • Size 24B
                                                    • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    8da13dcb-8a52-495a-88eb-a44d07ea623c.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Service Worker\CacheStorage\df10055077ba6d055202a286871492a294099fa5\5fb8d60e-d377-4964-8605-b3b0c4a43530\index-dir\8da13dcb-8a52-495a-88eb-a44d07ea623c.tmp
                                                    • Size 48B
                                                    • SHA256 0d20ba6cade18765467915496988b4d6f737e93dea6d3f9a23ac15e01ca0f5bc
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    the-real-index
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Service Worker\CacheStorage\df10055077ba6d055202a286871492a294099fa5\5fb8d60e-d377-4964-8605-b3b0c4a43530\index-dir\the-real-index
                                                    • Size 480B
                                                    • SHA256 ab7aededb14a27096779f85b1f3b773ee46acb6443b6e73bb2429b3980dfae45
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    dba04bf4-a01d-4499-b841-f60226e57660.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Service Worker\CacheStorage\df10055077ba6d055202a286871492a294099fa5\dba04bf4-a01d-4499-b841-f60226e57660.tmp
                                                    • Size 153B
                                                    • SHA256 32e28fb2924fe3a245c53b224837cca79e6b0a897dd40ea932e132199b638339
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    index.txt
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Service Worker\CacheStorage\df10055077ba6d055202a286871492a294099fa5\index.txt
                                                    • Size 148B
                                                    • SHA256 ff0520fefe20b2322c78bcaa652a612f129b6adc5bbbe37ec9a867042eb4d6ef
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    d2a01834-42af-45a6-94be-2066071827cb.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Service Worker\ScriptCache\index-dir\d2a01834-42af-45a6-94be-2066071827cb.tmp
                                                    • Size 48B
                                                    • SHA256 0c10b60edca542d3a4aedabe7a69d0699e8647bde924833b19e04b5b071b19a7
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    the-real-index
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                    • Size 72B
                                                    • SHA256 c674abd0a0ecb84f09512e9fe0e288300383618e1a5e08bb0d19eb6ef2b5ef06
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    CURRENT
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Sync Data\LevelDB\CURRENT
                                                    • Size 16B
                                                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    128.png
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir5788_898533508\Trusted Icons\Icons\128.png
                                                    • Size 6KB
                                                    • SHA256 6f6240bda239efc7969736dcb36212b55e0c026b6e191069a59b0319a871902e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    256.png
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir5788_898533508\Trusted Icons\Icons\256.png
                                                    • Size 5KB
                                                    • SHA256 4c8ab9772a662445717504802cf06755896080fb8cec679172acae975c98f67b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    64.png
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir5788_898533508\Trusted Icons\Icons\64.png
                                                    • Size 3KB
                                                    • SHA256 9c844d058a7125bb5e87b880dd6d73ad91473498d2840e109c8d01aca1d5905c
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    96.png
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Applications\Temp\scoped_dir5788_898533508\Trusted Icons\Icons\96.png
                                                    • Size 5KB
                                                    • SHA256 feba94135d0ae26db2694c294c124c30b5f7a385b6a64441d4ecadebe680ac93
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    d6762be6-d99f-48a7-904b-ece200375e7c.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\d6762be6-d99f-48a7-904b-ece200375e7c.tmp
                                                    • Size 5KB
                                                    • SHA256 299974a033f81f7c21b5e0e971b2ec4e2ef913094dbd04d2d4f9d34f22c6fd6a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    f17d7d60-a853-4e89-917e-1ddfccff4543.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\f17d7d60-a853-4e89-917e-1ddfccff4543.tmp
                                                    • Size 8KB
                                                    • SHA256 f58697826825c27f52df4edd65f8b3333cf13fe5ca8d3c84517713ab9bbe231a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    MANIFEST-000001
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Default\shared_proto_db\metadata\MANIFEST-000001
                                                    • Size 41B
                                                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Local State
                                                    • Size 236KB
                                                    • SHA256 f83facc77b29da82405a0363501f39d6a5b2d8de91ad7b9f347f5502f9920c3d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Local State
                                                    • Size 237KB
                                                    • SHA256 bee5496aad61dc03e4b8d51bb1d59550dc5e34586d946deab7948d49f9dcb37a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Local State
                                                    • Size 237KB
                                                    • SHA256 33f0e8044ccc54116d8361fb6581c44c79c16275f917d843b9153018c9de48dc
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                                    • Size 6KB
                                                    • SHA256 2e0d2c7021c2c896947b6ad8f9a077c34173af1f8036c1962f78c256c2b74e02
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                                    • Size 21.6MB
                                                    • SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    metadata.json
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\metadata.json
                                                    • Size 236B
                                                    • SHA256 df671539241fbc96e33ab6dbce06498e6dd1a0927a6f4c394b8f86ce27b541db
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    metadata.json
                                                    • Path C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\component_crx_cache\metadata.json
                                                    • Size 13B
                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    Яндекс.website
                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Яндекс.website
                                                    • Size 516B
                                                    • SHA256 be658936209d8a7c03ef097aba66cbf0a281ddb93e5142f7ae3bf182c0d0b5fe
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    places.sqlite
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f5sv0tmr.Admin\places.sqlite
                                                    • Size 68KB
                                                    • SHA256 b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    clids-yabrowser.xml
                                                    • Path C:\Users\Admin\AppData\Roaming\Yandex\clids-yabrowser.xml
                                                    • Size 756B
                                                    • SHA256 172d6554f620ae9e713742679c9f844f4d63c1ef2b13c61fc1ad9460b512dc1c
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    ui
                                                    • Path C:\Users\Admin\AppData\Roaming\Yandex\ui
                                                    • Size 38B
                                                    • SHA256 22e282738e1deeaa3264eaa053f189d2c134f724fc94ca7829ffd7a8012a7ed2
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    MSI6930.tmp
                                                    • Path C:\Windows\Installer\MSI6930.tmp
                                                    • Size 181KB
                                                    • SHA256 1ad18330acc4f254d8a37ffdf6d14283e1617b1e163ee8d05c876bb41ac6f316
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    MSI69CD.tmp
                                                    • Path C:\Windows\Installer\MSI69CD.tmp
                                                    • Size 197KB
                                                    • SHA256 c149276c0b4427c1149fc5a85dc42b4c71c027c2b5fcbc73e6e659f7b3a75562
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    yandex_browser_installer.log
                                                    • Path C:\Windows\SystemTemp\yandex_browser_installer.log
                                                    • Size 6KB
                                                    • SHA256 2f4d45f8886bcacf903e227b02b6c5d39df96c8b7aeba6920ceac05d29517eab
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    yandex_browser_service_update.log
                                                    • Path C:\Windows\SystemTemp\yandex_browser_service_update.log
                                                    • Size 3KB
                                                    • SHA256 9d2e5752df26919fde1590415b86d2d25f06df91bbae2a32d675ed25357f4b0f
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    yandex_browser_service_update.log
                                                    • Path C:\Windows\SystemTemp\yandex_browser_service_update.log
                                                    • Size 4KB
                                                    • SHA256 6839bd2da2253a0d6e9aae55ce554f9161267d24d20625f5167f80d0e718bcfd
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    memory/1260-944-0x00007FFD3C620000-0x00007FFD3C621000-memory.dmp
                                                    Download

                                                    memory/4104-1078-0x00007FFD3CBD0000-0x00007FFD3CBD1000-memory.dmp
                                                    Download

                                                    memory/4104-1079-0x00007FFD3BF50000-0x00007FFD3BF51000-memory.dmp
                                                    Download