Overview

overview

10

Static

static

3

2025-01-29...er.exe

windows7-x64

10

2025-01-29...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29-01-2025 14:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-29_ae34229e1b4be9b4b5d35db860731029_hawkeye_luca-stealer_magniber.exe

  • Size

    9.5MB

  • MD5

    ae34229e1b4be9b4b5d35db860731029

  • SHA1

    3e09eae8e35cd0f63cb8369639d8aba54991f4d9

  • SHA256

    db1ed472924b2185009176a8f214fe49a83781dc2ab7c534a026e42b47175aa5

  • SHA512

    4a392dacc2b75384e15001d7f0616a664e569c20d505613b4842b8e585b9593b9a1fe744f37039c06d9e3b35c4a76a27f18dd92ebefd6f1c9c1bd713592facf2

  • SSDEEP

    196608:V78cEXTRiA3JjtvqiAxhv9sg1tKCTpYAQEWrqufezvGWUJ/:VocYRiIt07vJYZEW2uGz+WUJ/

Score
10/10
salitybackdoordefense_evasiondiscoveryspywarestealertrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
    defense_evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Sality family
    sality
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    defense_evasiontrojan
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 7 IoCs
    defense_evasiontrojan
  • Blocklisted process makes network request 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 16 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1104
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1168
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1196
          • C:\Windows\System32\3kmwe8.exe
            "C:\Windows\System32\3kmwe8.exe"
            2⤵
              PID:1568
            • C:\Users\Admin\AppData\Local\Temp\2025-01-29_ae34229e1b4be9b4b5d35db860731029_hawkeye_luca-stealer_magniber.exe
              "C:\Users\Admin\AppData\Local\Temp\2025-01-29_ae34229e1b4be9b4b5d35db860731029_hawkeye_luca-stealer_magniber.exe"
              2⤵
              • Modifies firewall policy service
              • UAC bypass
              • Windows security bypass
              • Windows security modification
              • Checks whether UAC is enabled
              • Enumerates connected drives
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1732
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
            1⤵
              PID:1428
            • C:\Windows\system32\msiexec.exe
              C:\Windows\system32\msiexec.exe /V
              1⤵
              • Blocklisted process makes network request
              • Enumerates connected drives
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2360
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding 56B2D032DCF58652A3DDC4E927171847
                2⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1204
                • C:\Users\Admin\AppData\Local\Temp\4F009613-93EF-4E86-8EAC-828D9B6A3062\lite_installer.exe
                  "C:\Users\Admin\AppData\Local\Temp\4F009613-93EF-4E86-8EAC-828D9B6A3062\lite_installer.exe" --use-user-default-locale --silent --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2096
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding 5736C199D0AD74A4C1A0315143819CDB M Global\MSI0000
                2⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1312
                • C:\Users\Admin\AppData\Local\Temp\E320DE6F-86BF-42C1-B952-4B3007A7A52A\seederexe.exe
                  "C:\Users\Admin\AppData\Local\Temp\E320DE6F-86BF-42C1-B952-4B3007A7A52A\seederexe.exe" "--yqs=" "--yhp=" "--ilight=" "--locale=us" "--browser=" "--browser_default=" "--yabm=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\764A3627-CF18-4768-A3B7-F22604972A93\sender.exe" "--is_elevated=yes" "--ui_level=5"
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Modifies Internet Explorer settings
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:872
                  • C:\Users\Admin\AppData\Local\Temp\764A3627-CF18-4768-A3B7-F22604972A93\sender.exe
                    C:\Users\Admin\AppData\Local\Temp\764A3627-CF18-4768-A3B7-F22604972A93\sender.exe --send "/status.xml?clid=2255393&uuid=%7BDAFC5416-029A-46E8-9700-C3F78D47B9CF%7D&vnt=Windows 7x64&file-no=6%0A15%0A25%0A38%0A45%0A57%0A59%0A106%0A108%0A111%0A125%0A129%0A"
                    4⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3616

            Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Privilege Escalation

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Defense Evasion

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Impair Defenses

            4
            T1562

            Disable or Modify System Firewall

            1
            T1562.004

            Disable or Modify Tools

            3
            T1562.001

            Modify Registry

            6
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Browser Information Discovery

            1
            T1217

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            2
            T1012

            System Information Discovery

            3
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Config.Msi\f76ed5d.rbs
              Filesize

              591B

              MD5

              a1252a8bd71ebeef256c6994f4ffe64d

              SHA1

              379f0aae864eedae59f47605510cbb17d992d033

              SHA256

              eb22962898aca05f568c149ac8207b9eed1b9391065634248aef70ed237efb23

              SHA512

              31e13b9f45d4262acda69f95f0f702c48ce64e456da4d5d87a5700d1409b4fbb1c7ef4438568a093d084003fb72cb34581769fd9cae25396b434096434d70520

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A026C9CD7BA14377D055F4A2325D4501
              Filesize

              1KB

              MD5

              4b8c1268d2f74f397d261a53cf96f732

              SHA1

              1f836cce2e1b905a379183d212eee2aadc5b59e4

              SHA256

              7d87ba6faf4fe3a01ba77f40c7644b8f2b9f81f0af75349a1a808e98b5a91d09

              SHA512

              61fb7948f115bd389eeef6abb486ef77a394b3f8780b7915b8a302a438a2e60f10fcfd46229ff003e5e3aea78b9ba651d14982fc2f34b0a44dad564e4f886a74

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B0B1E3C3B1330A269DBEE4BA6313E7B4
              Filesize

              1KB

              MD5

              2ffbdb98df2a2b022a48adeb94a3af50

              SHA1

              6c86923b5c5832bb102f041cb7d38db397074f12

              SHA256

              dd12c5733bc4b682e1da6353c8c27650f53d11a8ada8fd8a2d06f23cecae5ebd

              SHA512

              a5f29661ac78ea205dd945fcc53e015152277426af4bcce688231ca1a564dc49144b2953409651737733fec72e9042468c780917543c007d7de74ed44058dbfb

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDA81A73291E20E6ACF6CACA76D5C942_4EA93225B46C4B45501FF0DDE9E306D0
              Filesize

              5B

              MD5

              5bfa51f3a417b98e7443eca90fc94703

              SHA1

              8c015d80b8a23f780bdd215dc842b0f5551f63bd

              SHA256

              bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

              SHA512

              4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A026C9CD7BA14377D055F4A2325D4501
              Filesize

              508B

              MD5

              f136f4570024107501d841bc73a1769f

              SHA1

              b6b924b1b9186685be7437fc3120b0451a9a54c3

              SHA256

              220ecb32ccd5068aad9b841cf9296fcc6b460b48f16a7ac7c1591aae730821d5

              SHA512

              16b976238f742648e395dea17c8c5a520990dece4ece2c0e4aa436a34ac43db0d956c58c25a850c34ac35f8736da07d9066c68dc7403613c7ae167260e3335ca

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B0B1E3C3B1330A269DBEE4BA6313E7B4
              Filesize

              208B

              MD5

              fb005e105f808941e946977675e2f8b3

              SHA1

              ff9f52cf37937d46d52a04793681649fb5641be6

              SHA256

              abc68cdf8847d5366d004bdd18274b3e866ac4afabec5a092e98f30076cd17f4

              SHA512

              87ec2fea1fdc9afc39fc1c4483485d3a2d3399550e60ee4529aaceab8480854888c77ac55129b65c2a2e081290d4e44895f3b03ec3d54dd6441cad0ba39bced5

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDA81A73291E20E6ACF6CACA76D5C942_4EA93225B46C4B45501FF0DDE9E306D0
              Filesize

              440B

              MD5

              b8ca5c2fd1667013ae01d1e70d001607

              SHA1

              72b848e2f8dd565523ad027c25fb31d2ccbb6bfd

              SHA256

              893a87c46ecf93e676e54bebb3964382246406335e6a0f43097961da9578bf01

              SHA512

              b441f3cafb53e5d1075dabd82710b00e30daa8b7c570f9a15e283cff2aa62e4043303ac76eda6e91f8d8ddf673c7733c21d371130f34851506d60d41f3091acb

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\4F009613-93EF-4E86-8EAC-828D9B6A3062\lite_installer.exe
              Filesize

              415KB

              MD5

              4958fe818ee0910209de2482bceed571

              SHA1

              c687e280b374c25b17a7f70e8c78f0ab331857bc

              SHA256

              3317ab61f7fbd98199f961ff8b3b68e310c12b6a76312819daed873d172054d4

              SHA512

              b54d4727200d9c473b3b2fde613a7ace8220aaa7ac52e0e29ae39aa22bd05c15fabb47b119b2085f81bbc864100fd78bfe2d74a1c122a80d143be17c6eb25cd8

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\764A3627-CF18-4768-A3B7-F22604972A93\sender.exe
              Filesize

              264KB

              MD5

              eb796e1048dd306d7ef2d09189b98bc2

              SHA1

              c2a6ee261e26619bea43e53a51407ccc6a9e0778

              SHA256

              b8dbc06ff7b0e10451a773e054337854b957be6650d5839b27f92706c8f75aa3

              SHA512

              26375f5e039e51db7f990f6e7183aabf9cfea48c6f5e25bea588f26ea9a5e7a704485584eaab9f465111158952a07b9a87943be7986e0c0abca26e850909d2eb

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\CabEF10.tmp
              Filesize

              70KB

              MD5

              49aebf8cbd62d92ac215b2923fb1b9f5

              SHA1

              1723be06719828dda65ad804298d0431f6aff976

              SHA256

              b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

              SHA512

              bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\E320DE6F-86BF-42C1-B952-4B3007A7A52A\seederexe.exe
              Filesize

              7.4MB

              MD5

              f4a72fa8bd9c0583bfa4e1e5a9b2780e

              SHA1

              00ef9ebc448f345a26598ea68ff4b5737d0d9fbb

              SHA256

              b4a72919d83b22ad06aca95fc8603e3b00f5804f5cc3f53dbd1c6e16ff2b8bf9

              SHA512

              9a27b6a0245987496ae17ebb3610d231245594db4a1c4fdf19ec004cf7bfe5a67246946c6d8d441824609bb2d6fee1287688ec21c6177d4394e8f7c9d82f5034

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\OMNIJA~1.ZIP
              Filesize

              41.3MB

              MD5

              e06a2381d0d89db24262c39cad3f6a2f

              SHA1

              aa9c6fc15c9c7130d3d4b21aae6dad585a8aa6fa

              SHA256

              a0ffe0c9b9cb466532e9f4db6f3cacb5a5c28af4346106c9ca2cf4acf98e1bc6

              SHA512

              4a47c2063a9fffbdbf7e0d3ec0b94d215e8d03033a9d5dacbe2477eed6108450e709829f9dc3480d10c2b0f1b9a7ff13cc4229969b0722364c53a4c6db0d26dd

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
              Filesize

              34KB

              MD5

              95a01015f9a2023f0df8b71aef14f94f

              SHA1

              c26241eafd774c9b79e22d5891d85a3b49f00228

              SHA256

              68c13596f67467d63ac618349b2d59fa335ee59fa0e692bac3e892aca741cf6c

              SHA512

              59e7ad72b6d2cc7d2e855453f514d28861100f535a7a9a419692639ad13911e27e39330ec09f3393e344f71823405ee89d281455c0d8bf0de7308aa820d2d32f

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml
              Filesize

              560B

              MD5

              bb86a574d808f235e346aa71aba2ef2f

              SHA1

              37171e01f066fcd21ceb0b4a3961c55a8491dc55

              SHA256

              b5a25aa7d1f28ad3fe60d91ef0e3dd4b4352dcacd0215e2d8e6ba45394e27750

              SHA512

              40112649f82243cc6bee9a276229c868ce8e09881ae9698fda2a35cbf946d7db90ee3c05585907183052821a5e774e90f85a41381f6da4b980230e84826fc3bc

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
              Filesize

              597B

              MD5

              b4b89b203968f4fb1b7850fd05a94094

              SHA1

              91aec65c34241053d2e49431739929c038d7d881

              SHA256

              cc6c2d3f348e5b0b548b3d2e8ad2db90700962b8a8dc4851feb94fe339d07e44

              SHA512

              570976aed5e0bde0e535e464d0c649d14815cb5c9f8cf12fead489e6faa041efc5f1e7c9f5b03889f3d6b9c8a0069f7c744e0c8fef46b2b858889d527a379148

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
              Filesize

              9.1MB

              MD5

              91eb14f38b109168410a2413c8e8ec02

              SHA1

              716f778fb0ee3da11c215e3278afd071411cc7d8

              SHA256

              52d09e30ad5a0c2bf880fe5dde2da9efc237fa55ced7feed2baf3e91b322ef8d

              SHA512

              183b691bb6c59e284a88412bb5408d6d67724d1a4afff0fe1eb7d3c07132d3d3d06225f16ce085721687ff7209429aad3871f907077d3c33231161226d39b521

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.Admin\places.sqlite-20250129143127.932800.backup
              Filesize

              68KB

              MD5

              58b4f36e4874cbc6a0a930e91ffb2c89

              SHA1

              207138ddac715a55c24babb609fb1a480658f3f6

              SHA256

              69d959aa7616101ea0d194cbb3afa08047ea7a9d169ca72a9d375f7e96125e48

              SHA512

              cd6b989135fa8d7951606e1ff1285fe3f2ac2859414a4c88b3b7c71e02c765988775ce60d4e382183528d55cffdfd9fb08be1e9b96f692ad50ba473a9f84edee

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\extensions\staged\[email protected]
              Filesize

              1KB

              MD5

              5a40649cf7f6923e1e00e67a8e5fc6c8

              SHA1

              fc849b64b31f2b3d955f0cb205db6921eacc1b53

              SHA256

              6d432ba7096090837f9533a33a686c846ad67aed8ecc43af7ce8af42649cd51a

              SHA512

              0fc42a2cc61528b14478f4b9ae098ea90e6b05ddbe10f3a6cdd6326d0d8e6185b49d2b8143b76a9f329bdc277cf02b54d98f374edd65df68a1ffc41e1c817786

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\extensions\staged\[email protected]
              Filesize

              688KB

              MD5

              ab6d42f949df8d7e6a48c07e9b0d86e0

              SHA1

              1830399574b1973e2272e5dcc368c4c10dbbe06b

              SHA256

              205ebf52c47b42fa0ad1a734a1d882d96b567e15a32b19bdb907562db8ea09e2

              SHA512

              6c4f9bb726384c87b6523e08339f7821ad4ec8717b26db902ca51df74eb89b46e4ded1504a131683b07b2bba3e6e911a549a8a83b2aad3971047c0fe315a1ad5

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\extensions\staged\[email protected]
              Filesize

              5KB

              MD5

              856242624386f56874a3f3e71d7993f4

              SHA1

              96d3199c5eebb0d48c944050fbc753535ee09801

              SHA256

              d86ed80d2a9e4e1af843a991a6553a2fefd5433b2144be0cfb63a2f18deb86be

              SHA512

              76d440fe2ed535677a1d249b289463bfedfc5d2afc0e269e4593bb113393f165856c07117735cf3e5a230b5d04a61c7126df24a466594d8c27b47b2047834a09

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\extensions\staged\[email protected]
              Filesize

              1.7MB

              MD5

              e68cea8c6d4b16641f30dd930a952ebb

              SHA1

              7e8c4b51e6e56f35a2983ab6cb121341aeda565c

              SHA256

              a7f3f788323a12158d66f341c4711d71fc2244a2b07a68fb8df4baec0ff76f35

              SHA512

              96351e36a4c5020ed464b96b72bb3063db819981440bde7c6c3a50f7fe470e1d70f0350ec7c4bcd4808fcabe2ddfbdebfc7039ae2248c1455e2245f53ce44ec0

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks-20250129143128.151200.backup
              Filesize

              1KB

              MD5

              3adec702d4472e3252ca8b58af62247c

              SHA1

              35d1d2f90b80dca80ad398f411c93fe8aef07435

              SHA256

              2b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335

              SHA512

              7562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences-20250129143128.151200.backup
              Filesize

              313B

              MD5

              af006f1bcc57b11c3478be8babc036a8

              SHA1

              c3bb4fa8c905565ca6a1f218e39fe7494910891e

              SHA256

              ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c

              SHA512

              3d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Yandex\ui
              Filesize

              38B

              MD5

              a01f2591afbb8d8596c48ab26eb70292

              SHA1

              5c3e86ec66d7a273bf11362602e91f478e6da10f

              SHA256

              fac2170fc212548cb4a879ff48ba3281e0363cb85f5239265c16c166ecb52097

              SHA512

              287ae3b084dd2ed4b2b6c9013accf02fd3a555c892eeebfb2734d05b7862042310284d0c5f9c36e6a6adabfea937cc8481cb45b2a5708f46af2d9f13ca8268dc

              Download Submit

            • C:\Windows\Installer\MSIEF9E.tmp
              Filesize

              171KB

              MD5

              cb48b56d733e4e923d368674b02b4459

              SHA1

              92362e400cc53c2729d3d97a753c2ef24cacf614

              SHA256

              3e3bcad00d145302e91c37c763144a37e694430b430527a440cc46c700c33f21

              SHA512

              aa89d1e61a318751f10a88802ad4713c7b708e8074acc0a2b80c4e763f53bcfbf712b27049ccf53c2f94a18be9ded082ef8206804b63195aac1e97c44cf97489

              Download Submit

            • \Windows\Installer\MSIEFED.tmp
              Filesize

              190KB

              MD5

              351e5c03e84f43ef17ecac2b77b8f7e1

              SHA1

              4d71bcb5cc3ff04add17245f9e2846398fecceb7

              SHA256

              5a1e53a4295f93005f2188d1bba6d61710193102cb5bd144e487c018988bb1bc

              SHA512

              eabcea3966fa320055e320b271b68dcb32df5af934cf43ca2dec76b2f255ffb781816739a92470a125b802a4e9cc7e907f581a5268b3745e84e3bf29a385dbd6

              Download Submit

            • \Windows\Installer\MSIF498.tmp
              Filesize

              202KB

              MD5

              d773d9bd091e712df7560f576da53de8

              SHA1

              165cfbdce1811883360112441f7237b287cf0691

              SHA256

              e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7

              SHA512

              15a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd

              Download Submit

            • memory/1104-11-0x0000000000220000-0x0000000000222000-memory.dmp

              Filesize

              8KB

              Download

            • memory/1732-30-0x0000000002800000-0x000000000388E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/1732-80-0x0000000002800000-0x000000000388E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/1732-45-0x0000000002800000-0x000000000388E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/1732-136-0x0000000002800000-0x000000000388E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/1732-135-0x0000000002800000-0x000000000388E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/1732-41-0x0000000002800000-0x000000000388E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/1732-9-0x0000000002800000-0x000000000388E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/1732-25-0x00000000002D0000-0x00000000002D1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1732-24-0x0000000002800000-0x000000000388E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/1732-31-0x0000000002800000-0x000000000388E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/1732-27-0x00000000002C0000-0x00000000002C2000-memory.dmp

              Filesize

              8KB

              Download

            • memory/1732-2935-0x0000000002800000-0x000000000388E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/1732-5473-0x0000000002800000-0x000000000388E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/1732-7647-0x0000000002800000-0x000000000388E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/1732-29-0x00000000002C0000-0x00000000002C2000-memory.dmp

              Filesize

              8KB

              Download

            • memory/1732-0-0x0000000002800000-0x000000000388E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/1732-10-0x0000000000400000-0x0000000000D7D000-memory.dmp

              Filesize

              9.5MB

              Download

            • memory/1732-5-0x0000000002800000-0x000000000388E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/1732-6-0x0000000002800000-0x000000000388E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/1732-7-0x0000000002800000-0x000000000388E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/1732-20-0x00000000002C0000-0x00000000002C2000-memory.dmp

              Filesize

              8KB

              Download

            • memory/1732-21-0x00000000002D0000-0x00000000002D1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1732-8-0x0000000002800000-0x000000000388E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/1732-8272-0x0000000002800000-0x000000000388E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/1732-8276-0x00000000002C0000-0x00000000002C2000-memory.dmp

              Filesize

              8KB

              Download

            • memory/1732-8289-0x0000000000400000-0x0000000000D7D000-memory.dmp

              Filesize

              9.5MB

              Download