Overview

overview

10

Static

static

3

2025-01-29...er.exe

windows7-x64

10

2025-01-29...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    0s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-01-2025 14:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-29_526525d75f161d27a3f036f434708d68_bkransomware_hawkeye_luca-stealer_magniber.exe

  • Size

    7.9MB

  • MD5

    526525d75f161d27a3f036f434708d68

  • SHA1

    1c2bcedd7f7c1cf9102be93f95c89641dcff7b89

  • SHA256

    c783c11471ac1c8bb78cb0d814f77efbbb655cb645872e77b2681806364628f5

  • SHA512

    1ea8d925a5c61ae392323d4b39dd55acab1a531b643d8143c197f990ced22c1edc695f4f9ff8d9467f205a569e11c0a26b0c99a70a1b260febedfe6777cf7a86

  • SSDEEP

    196608:BG9cL2kwBDQIzfsiKhfkfGxm+LTmLbSq7ii9GY7kQX:p2kwBM23KhfkOxRsD7T9hB

Score
10/10
salitybackdoordefense_evasiondiscoverytrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
    defense_evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Sality family
    sality
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    defense_evasiontrojan
  • Windows security modification 2 TTPs 7 IoCs
    defense_evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:776
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:780
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:60
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2892
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2908
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:2996
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3452
                  • C:\Users\Admin\AppData\Local\Temp\2025-01-29_526525d75f161d27a3f036f434708d68_bkransomware_hawkeye_luca-stealer_magniber.exe
                    "C:\Users\Admin\AppData\Local\Temp\2025-01-29_526525d75f161d27a3f036f434708d68_bkransomware_hawkeye_luca-stealer_magniber.exe"
                    2⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:512
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                    PID:3592
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    1⤵
                      PID:3780
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3868
                      • C:\Windows\System32\RuntimeBroker.exe
                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                        1⤵
                          PID:3984
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4060
                          • C:\Windows\System32\RuntimeBroker.exe
                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                            1⤵
                              PID:2220
                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                              1⤵
                                PID:2320
                              • C:\Windows\System32\RuntimeBroker.exe
                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                1⤵
                                  PID:2400
                                • C:\Windows\system32\backgroundTaskHost.exe
                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
                                  1⤵
                                    PID:1948
                                  • C:\Windows\system32\backgroundTaskHost.exe
                                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                    1⤵
                                      PID:4160
                                    • C:\Windows\system32\BackgroundTaskHost.exe
                                      "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
                                      1⤵
                                        PID:3840
                                      • C:\Windows\System32\RuntimeBroker.exe
                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                        1⤵
                                          PID:1608
                                        • C:\Windows\system32\msiexec.exe
                                          C:\Windows\system32\msiexec.exe /V
                                          1⤵
                                            PID:1508
                                            • C:\Windows\syswow64\MsiExec.exe
                                              C:\Windows\syswow64\MsiExec.exe -Embedding 95E80B1885EBE9CC10112F9EB37B68B9
                                              2⤵
                                                PID:3880
                                                • C:\Users\Admin\AppData\Local\Temp\88DB602B-5EB5-4C02-AA2A-B058E807AEA4\lite_installer.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\88DB602B-5EB5-4C02-AA2A-B058E807AEA4\lite_installer.exe" --use-user-default-locale --silent --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/
                                                  3⤵
                                                    PID:1676
                                                • C:\Windows\syswow64\MsiExec.exe
                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 064F26F83E12AA2FADE5809FB2316B7A E Global\MSI0000
                                                  2⤵
                                                    PID:3312
                                                    • C:\Users\Admin\AppData\Local\Temp\D0ACD8F3-A68C-43C0-9688-3DDDEE0E6ADB\seederexe.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\D0ACD8F3-A68C-43C0-9688-3DDDEE0E6ADB\seederexe.exe" "--yqs=" "--yhp=" "--ilight=" "--locale=us" "--browser=" "--browser_default=" "--yabm=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\1A890B6A-BBF5-43C8-83BE-E4A5C63CEDB5\sender.exe"
                                                      3⤵
                                                        PID:3096
                                                        • C:\Users\Admin\AppData\Local\Temp\1A890B6A-BBF5-43C8-83BE-E4A5C63CEDB5\sender.exe
                                                          C:\Users\Admin\AppData\Local\Temp\1A890B6A-BBF5-43C8-83BE-E4A5C63CEDB5\sender.exe --send "/status.xml?clid=2226558&uuid=51e3548d-dedd-11ef-b673-fa3c58f628cc&vnt=6.2 (Build 9200)IA32&cpc=1&file-no=8%0A25%0A37%0A38%0A45%0A47%0A102%0A106%0A111%0A129%0A"
                                                          4⤵
                                                            PID:1304

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Config.Msi\e57927d.rbs
                                                      Filesize

                                                      153KB

                                                      MD5

                                                      0d9f45bde700258730424c7c9214f457

                                                      SHA1

                                                      b1532466d75584b085dfffb626680b7db3fd0e06

                                                      SHA256

                                                      331b94bafca2c5acb565e93643d118d08f7d567f5fa6051c093772f9ee6a1da9

                                                      SHA512

                                                      238e0d2633677ed9daa9ea51ffb16dd7744a03174a9dba6b122d24fb46795c9e1fac18629cec379bac60508e89dd36d5d26279e2cc1b98dd6fef88ff8f575075

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37570AF16029C559A6224EE4AF54691D
                                                      Filesize

                                                      2KB

                                                      MD5

                                                      a35f92fdd1180c8ca07d532d488dfff7

                                                      SHA1

                                                      d8af3862c30ade8d1ae788271dc955bde9162fd5

                                                      SHA256

                                                      b95513f949e866966062f1f8b2ce216bfcef2fc70b066cdfe5aa90ae9791aeb9

                                                      SHA512

                                                      4443293c9a24a0a0531e3c73cb8093ada24a6e09bbee47f507f2d64bc6ab9dd2bb3be0ca3b0dfa814daebc059ddf7aab0b7a2fe5f9bb7ad5cd5428f4681f4312

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B179347615B32FE859CEABBE50C3EE6_8E70042F884A67193ED52832BA9E5354
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      c359f260c6f2b6e8022c72d14d7f9574

                                                      SHA1

                                                      1cbfe6c7081de56fade061dbd906e01318cf29fd

                                                      SHA256

                                                      22d94801b74c02dbcf3086d468f39d17195a1e38775872a842d00af36fef424e

                                                      SHA512

                                                      f2e51bb62e1186819b03d740e3d956fc0825d8c5f608457426fb98c0b590cbd19410b3cc186bcded43bca7956919da7ee9737bde4b65e2685d5f5847223ef1f9

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9F08575E2099C04869F34A6342C1C728_8F07E6EF7CC937BD7A0B05652DB74461
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      0d76e7d5e9edd035e058476afbf1ea81

                                                      SHA1

                                                      f33b6682b0f7f3964d552bd2caec8afb9eb89705

                                                      SHA256

                                                      6904caaa5463abaf67d53ef2cfcec94e17382b0263387934fb3205606c25afb9

                                                      SHA512

                                                      1186cf4322107fa4903b59f347cb06092cbd56398eca867f7db2d9521c906bc829e1c6ff5a00581fc1c80e8d337220984eadcf8f5d801c07977f08f632d145ea

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E7EC0C85688F4738F3BE49B104BA67
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      c9be626e9715952e9b70f92f912b9787

                                                      SHA1

                                                      aa2e946d9ad9027172d0d321917942b7562d6abe

                                                      SHA256

                                                      c13e8d22800c200915f87f71c31185053e4e60ca25de2e41e160e09cd2d815d4

                                                      SHA512

                                                      7581b7c593785380e9db3ae760af85c1a889f607a3cd2aa5a2695a0e5a0fe8ee751578e88f7d8c997faeda804e2fc2655d859bee2832eace526ed4379edaa3f5

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37570AF16029C559A6224EE4AF54691D
                                                      Filesize

                                                      192B

                                                      MD5

                                                      53b51aa0dfba6e1d84288fe7a3040829

                                                      SHA1

                                                      a9f9d286f585903011f59e81e6945ed6f5cfe3e0

                                                      SHA256

                                                      92a66666309ac000ed4918c7a4ffe679e3a9bc9ce8b007dab262cfa56c58b95e

                                                      SHA512

                                                      628a987b6ac2ab4be8b3f2fd0d36fc6f146523bc6777be014a29ec50427909b44f8a87909bc0ba7738e3b387d7f6adb20591110fde141b4f0a6bc6f12450c865

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B179347615B32FE859CEABBE50C3EE6_8E70042F884A67193ED52832BA9E5354
                                                      Filesize

                                                      538B

                                                      MD5

                                                      dbbc75ac208c515e544b4c2c7d648edc

                                                      SHA1

                                                      c0d209a8b51e46f90433cb93bfe2b75c2d3afe5b

                                                      SHA256

                                                      1072ad0b2428f12164463d7acf30ba36c34bd08876eea92cbbaed20f9c62afb0

                                                      SHA512

                                                      db4976074e17fb6d9030209a31459ac8be77f4d7d3a829baec70affde941e8866426a04e479152229e636ea9c7f3f5dcd809059a49cf34cca8abcd214a423492

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9F08575E2099C04869F34A6342C1C728_8F07E6EF7CC937BD7A0B05652DB74461
                                                      Filesize

                                                      550B

                                                      MD5

                                                      8a4233503ea6aeff3c7172a3f784e480

                                                      SHA1

                                                      f0515598c910037f5dfa73881410723db44d88ec

                                                      SHA256

                                                      63f2e1b1c115c777647de8f898cffba9c4bfb78385239f0866750012f41d5720

                                                      SHA512

                                                      3b71477a4abb7c884122efd6d330091bf26f303e1c3a8686b686d353080268771792b9218999ff2701850fba848bbeaed01dac6159d61c2f3acaa69ed2292e9b

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E7EC0C85688F4738F3BE49B104BA67
                                                      Filesize

                                                      186B

                                                      MD5

                                                      1f970e30bed6c74730cfab4b7a6d5217

                                                      SHA1

                                                      5f6243765605b4155980c6bd062f3253146d00e4

                                                      SHA256

                                                      460ae4e62010c5c832c808da42e58d00f07ac2684939b286f100b6fddf847546

                                                      SHA512

                                                      e01bed4d7d8037697df93045459d29b512a452f2dff2cc6d816dabca73ac84fd1995c0ece644446758e91abf34240763f0828f844149efc00392c8f5e57bc186

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\1A890B6A-BBF5-43C8-83BE-E4A5C63CEDB5\sender.exe
                                                      Filesize

                                                      229KB

                                                      MD5

                                                      a3844aed7c51f3f46e225a2ed9a45721

                                                      SHA1

                                                      6de97751b0592b14d58a9783f1b0513b391fc10c

                                                      SHA256

                                                      971dd6a5a04bc5bb5bb7ab1644ccb3477740e6c5d98626bc2184750b5a8f63f9

                                                      SHA512

                                                      d808bc3ba123949a1403442aef468b91092d3682008bc40b4170f007a4544e6038010a528f23b2c8befa8f83c1d26c821097fec89db7ab7273fc769148738b78

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\88DB602B-5EB5-4C02-AA2A-B058E807AEA4\lite_installer.exe
                                                      Filesize

                                                      361KB

                                                      MD5

                                                      89928e2b55c9ee0c021fcb2f1acf3ac0

                                                      SHA1

                                                      96810e911124a1ffaf717bc1c06d8dea07d69bf6

                                                      SHA256

                                                      9c0291f1a68009dde56a66d6856eeff15ecbc5bd89460399238b59408d972e0c

                                                      SHA512

                                                      ca334377cb5e8edaea91c30216fc71c0d393f096f42be97d828d217e4d6bdd6fe7bc61542571226518dbf218f1478136863dc0509d8de5986ee7fd355313ae83

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\D0ACD8F3-A68C-43C0-9688-3DDDEE0E6ADB\seederexe.exe
                                                      Filesize

                                                      1.4MB

                                                      MD5

                                                      00cb9099715659bf319634684b7feb81

                                                      SHA1

                                                      4626724df8ba23920aafea628d57244ad20eafd4

                                                      SHA256

                                                      883ff88119375946e24b81cb15e427d31f60ac9d1f5d092517522bf301eacadd

                                                      SHA512

                                                      c3bf5bdc4b9d90f4681ba06c4eae6fef4261beb781f0cd8f902ad7e39d6e5ebf9a220e2312d62dafdaf3b2d71f7f6d93dcf9fa60dd33589ba8ccc56e9699d61f

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\D0ACD8F3-A68C-43C0-9688-3DDDEE0E6ADB\seederexe.exe
                                                      Filesize

                                                      1.5MB

                                                      MD5

                                                      ddb6ff0bf1c2647a799d0ef6d4b73be8

                                                      SHA1

                                                      705da51b2925306c307bb275435e267a0eccf379

                                                      SHA256

                                                      508e4a8b16b0124d0d09542f6c3c8eac7547b154f3c3ff7a8337d11f72600caf

                                                      SHA512

                                                      5743c0ae967fd9a52fe01103598369612275a1993b117acf2a5ab72cf9e60f5097237b01f2845ac58fc3acf273b23f53689a159067bb0484b8b406f578a4e76f

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
                                                      Filesize

                                                      37KB

                                                      MD5

                                                      f7dfa9ae59cc27e9890a25cc7fb80eab

                                                      SHA1

                                                      ba5ff0338f3d8216a32e1bcd24da430570198300

                                                      SHA256

                                                      6e2ccfd746d6a66590b517482016efbf52bf1f27b076045b62abb7773cf73995

                                                      SHA512

                                                      554d58c88026172328b987ef1cb8c02c0603ab4f3940adc1420cf020cd5a00389f346c6e8c5cd6dde1a601448e55d8dac1a4c6425d4cedf22fbe1a6a47666fb4

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml
                                                      Filesize

                                                      511B

                                                      MD5

                                                      368943ae8a939c90f9777c7ddd94ab8c

                                                      SHA1

                                                      33743b6baae443197007acbf6ccfef12aabf2069

                                                      SHA256

                                                      4a88f04271c2df8de686599bc9a2b8cfa2fe000c0d9ea1fd34c5820641f934df

                                                      SHA512

                                                      64699505d5cb4b066bdcb808ff6fa09ca690b187809281a473732c644c4e28615b81110678ddf07dc59ded201036dbf6cb94008b1eee981830738f1eb4fc152e

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
                                                      Filesize

                                                      491B

                                                      MD5

                                                      96c5288ee3038aa3db131df62a971535

                                                      SHA1

                                                      d31bf62a6a22f090623fd027400a1068c1cac945

                                                      SHA256

                                                      b2571f54cc8735e1f293e049a6ff1fb950f8c11ce6953d123583426962ced24c

                                                      SHA512

                                                      8af0f47d68442f595bec8f94a8b9076118cb04a03e169f7ab7dba77a9b386a45f17fab743dad3ac033ea9ea05119fe6d89ec0bb716a2b885882b777dd6042966

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
                                                      Filesize

                                                      2.4MB

                                                      MD5

                                                      cfa3a333008ac082b33a36a631733015

                                                      SHA1

                                                      d98046239422bfbef7ca2ad12554e8e7a8617222

                                                      SHA256

                                                      ec476cd4d5a2e58781c86721a5d562ed7bfd7f92a193e2aa63db204c3d06d32a

                                                      SHA512

                                                      e5508aa7f76f3f183175c63b57dbb101eb8ae06f8230854c668659224296cf8977b9c0ec79e83bcb904c4784dce0df9a3505f5110c82e50c4bc01aa782bd26dc

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
                                                      Filesize

                                                      1.2MB

                                                      MD5

                                                      08910a17982f66a8d3a68771b65376e2

                                                      SHA1

                                                      48483ddfe4466b1ea8aa131f698bd476f64d23b8

                                                      SHA256

                                                      dd3e22c27c37df9380602e6c1b1a33b949d15035fcd301e14c9121e50be46b56

                                                      SHA512

                                                      fad028aa34178846bc7185ca0a725c955063e78b66565dd802e9115165a5003c54e389225458fd9dd122d2e09deca325e5233986e9beabfc699d58a0731a6bc9

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\places.sqlite
                                                      Filesize

                                                      68KB

                                                      MD5

                                                      d57cd95de07d3b15eb5cf8baa80471af

                                                      SHA1

                                                      322c0e13f2022ab255a8d2a50c5835779b6ccc3e

                                                      SHA256

                                                      651efdc8961efbf6476e4cc4b3965a4da72690ebedda009fd800c6d936a67696

                                                      SHA512

                                                      2e98256a9e76ae384f88b83075a321f60cb13ee6f7e8cb93f1919103b82ba79a67b5eec8a7d3043fe26b377fae58545e82323813897c0e67adfacaa885d6f68e

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      3adec702d4472e3252ca8b58af62247c

                                                      SHA1

                                                      35d1d2f90b80dca80ad398f411c93fe8aef07435

                                                      SHA256

                                                      2b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335

                                                      SHA512

                                                      7562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences
                                                      Filesize

                                                      313B

                                                      MD5

                                                      af006f1bcc57b11c3478be8babc036a8

                                                      SHA1

                                                      c3bb4fa8c905565ca6a1f218e39fe7494910891e

                                                      SHA256

                                                      ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c

                                                      SHA512

                                                      3d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Yandex\ui
                                                      Filesize

                                                      38B

                                                      MD5

                                                      65851cc81ece9242dab7a40c8d625b45

                                                      SHA1

                                                      371aeeebe45780d868ec8f7866cea83a0801dbec

                                                      SHA256

                                                      d68917f23c29ed71fb9ca917ca254417771f39bca950fe1498bcb142ca13843f

                                                      SHA512

                                                      307b82168864205b0adca7784e436f4db829a48e70cc4a1f0d38b7b39604229d74216d2a421e41cd2b15375fb9e931d7fae20b2e0329b5e975dba495c4480006

                                                      Download Submit

                                                    • C:\Windows\Installer\MSI9366.tmp
                                                      Filesize

                                                      152KB

                                                      MD5

                                                      bee9b5c9cef61745273dddde492f9dee

                                                      SHA1

                                                      8febecfa373a1e14ac77189d0aa3d1b62160c2fe

                                                      SHA256

                                                      a9409a33bc88b521f0fb3f9b1028170de48a2bd1a11d7aa2dc10a4ef3028623e

                                                      SHA512

                                                      8f8b495b5a3747e6dbacf143a58691008119aed91ab4d665c3267bd528f354dc62b54ff163848be49564bf114377e2fd7e352f9c0a4f4169d8269c232068f8a9

                                                      Download Submit

                                                    • C:\Windows\Installer\MSI9414.tmp
                                                      Filesize

                                                      160KB

                                                      MD5

                                                      2783e8851ffd39263195f7a53b2941c3

                                                      SHA1

                                                      1b2e587a7ba027eea39f809f7e6494fda8876f93

                                                      SHA256

                                                      da2dc5131952f0473c8365a39d86866ede088440ab9c0b3f74d6715a90197999

                                                      SHA512

                                                      e8a65cadf7063870849e10a51c0cc9a4b3dfd2f338fcf66f19d4818fef41df45244fcf869bb41172c4d423191bed0d510302001d9e4aebcb7287b18088c5a6c9

                                                      Download Submit

                                                    • C:\Windows\Installer\MSI9533.tmp
                                                      Filesize

                                                      168KB

                                                      MD5

                                                      a0962dd193b82c1946dc67e140ddf895

                                                      SHA1

                                                      7f36c38d80b7c32e750e22907ac7e1f0df76e966

                                                      SHA256

                                                      b9e73e5ab78d033e0328fc74a9e4ebbd1af614bc4a7c894beb8c59d24ee3ede9

                                                      SHA512

                                                      118b0bd2941d48479446ed16ab23861073d23f9cc815f5f1d380f9977f18c34a71f61496c78b77b9a70f8b0a6cd08fe1edc1adb376dad5762ad0dd2068c64751

                                                      Download Submit

                                                    • memory/512-211-0x0000000002A30000-0x0000000003ABE000-memory.dmp

                                                      Filesize

                                                      16.6MB

                                                      Download

                                                    • memory/512-14-0x00000000042C0000-0x00000000042C2000-memory.dmp

                                                      Filesize

                                                      8KB

                                                      Download

                                                    • memory/512-25-0x0000000002A30000-0x0000000003ABE000-memory.dmp

                                                      Filesize

                                                      16.6MB

                                                      Download

                                                    • memory/512-7-0x0000000002A30000-0x0000000003ABE000-memory.dmp

                                                      Filesize

                                                      16.6MB

                                                      Download

                                                    • memory/512-10-0x00000000042C0000-0x00000000042C2000-memory.dmp

                                                      Filesize

                                                      8KB

                                                      Download

                                                    • memory/512-212-0x0000000002A30000-0x0000000003ABE000-memory.dmp

                                                      Filesize

                                                      16.6MB

                                                      Download

                                                    • memory/512-26-0x0000000002A30000-0x0000000003ABE000-memory.dmp

                                                      Filesize

                                                      16.6MB

                                                      Download

                                                    • memory/512-31-0x0000000002A30000-0x0000000003ABE000-memory.dmp

                                                      Filesize

                                                      16.6MB

                                                      Download

                                                    • memory/512-47-0x0000000002A30000-0x0000000003ABE000-memory.dmp

                                                      Filesize

                                                      16.6MB

                                                      Download

                                                    • memory/512-24-0x0000000002A30000-0x0000000003ABE000-memory.dmp

                                                      Filesize

                                                      16.6MB

                                                      Download

                                                    • memory/512-1-0x0000000002A30000-0x0000000003ABE000-memory.dmp

                                                      Filesize

                                                      16.6MB

                                                      Download

                                                    • memory/512-0-0x0000000000400000-0x0000000000BED000-memory.dmp

                                                      Filesize

                                                      7.9MB

                                                      Download

                                                    • memory/512-12-0x0000000002A30000-0x0000000003ABE000-memory.dmp

                                                      Filesize

                                                      16.6MB

                                                      Download

                                                    • memory/512-8-0x0000000002A30000-0x0000000003ABE000-memory.dmp

                                                      Filesize

                                                      16.6MB

                                                      Download

                                                    • memory/512-13-0x0000000002A30000-0x0000000003ABE000-memory.dmp

                                                      Filesize

                                                      16.6MB

                                                      Download

                                                    • memory/512-15-0x00000000042C0000-0x00000000042C2000-memory.dmp

                                                      Filesize

                                                      8KB

                                                      Download

                                                    • memory/512-278-0x0000000002A30000-0x0000000003ABE000-memory.dmp

                                                      Filesize

                                                      16.6MB

                                                      Download

                                                    • memory/512-279-0x0000000002A30000-0x0000000003ABE000-memory.dmp

                                                      Filesize

                                                      16.6MB

                                                      Download

                                                    • memory/512-280-0x0000000002A30000-0x0000000003ABE000-memory.dmp

                                                      Filesize

                                                      16.6MB

                                                      Download

                                                    • memory/512-11-0x0000000004410000-0x0000000004411000-memory.dmp

                                                      Filesize

                                                      4KB

                                                      Download

                                                    • memory/512-32-0x0000000002A30000-0x0000000003ABE000-memory.dmp

                                                      Filesize

                                                      16.6MB

                                                      Download

                                                    • memory/512-320-0x0000000000400000-0x0000000000BED000-memory.dmp

                                                      Filesize

                                                      7.9MB

                                                      Download

                                                    • memory/512-318-0x0000000002A30000-0x0000000003ABE000-memory.dmp

                                                      Filesize

                                                      16.6MB

                                                      Download

                                                    • memory/512-3-0x0000000002A30000-0x0000000003ABE000-memory.dmp

                                                      Filesize

                                                      16.6MB

                                                      Download