Overview

overview

10

Static

static

3

2025-02-01...er.exe

windows7-x64

10

2025-02-01...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-02-2025 13:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-02-01_48f47dfef969ad187f63e6a2e7d8d4be_hawkeye_luca-stealer_magniber.exe

  • Size

    9.3MB

  • MD5

    48f47dfef969ad187f63e6a2e7d8d4be

  • SHA1

    89941f5a93da8c7e679800714c794f21e8aa397a

  • SHA256

    64d8228ab44e493d6574e34b4642c97ee4127e4d0c422dc6e5b1bc8b0dcf6fb1

  • SHA512

    4d0fbc54b983c89977578ad28e4633b019087b371a6bd124990b44382b5ce5633c2542ecde841739153d1a3f87b47fb63877857c940558446aef4fdfcc1eba15

  • SSDEEP

    196608:DzzoF/uD9jckrCFsu3iqo/U0/YIBjWrqufezvnU72:DHOeCz0/YojW2uGz/U72

Score
10/10
salitybackdoordefense_evasiondiscoveryspywarestealertrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
    defense_evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Sality family
    sality
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    defense_evasiontrojan
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 7 IoCs
    defense_evasiontrojan
  • Blocklisted process makes network request 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 18 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 6 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:800
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:804
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:384
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:3016
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2140
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:784
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3452
                  • C:\Users\Admin\AppData\Local\Temp\2025-02-01_48f47dfef969ad187f63e6a2e7d8d4be_hawkeye_luca-stealer_magniber.exe
                    "C:\Users\Admin\AppData\Local\Temp\2025-02-01_48f47dfef969ad187f63e6a2e7d8d4be_hawkeye_luca-stealer_magniber.exe"
                    2⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Enumerates connected drives
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Modifies system certificate store
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:2216
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                    PID:3568
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    1⤵
                      PID:3752
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3876
                      • C:\Windows\System32\RuntimeBroker.exe
                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                        1⤵
                          PID:3944
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4024
                          • C:\Windows\System32\RuntimeBroker.exe
                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                            1⤵
                              PID:4140
                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                              1⤵
                                PID:3024
                              • C:\Windows\System32\RuntimeBroker.exe
                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                1⤵
                                  PID:832
                                • C:\Windows\system32\backgroundTaskHost.exe
                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
                                  1⤵
                                    PID:5100
                                  • C:\Windows\system32\backgroundTaskHost.exe
                                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                    1⤵
                                      PID:3496
                                    • C:\Windows\System32\RuntimeBroker.exe
                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                      1⤵
                                        PID:1832
                                      • C:\Windows\System32\RuntimeBroker.exe
                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                        1⤵
                                          PID:2832
                                        • C:\Windows\system32\msiexec.exe
                                          C:\Windows\system32\msiexec.exe /V
                                          1⤵
                                          • Blocklisted process makes network request
                                          • Enumerates connected drives
                                          • Drops file in Windows directory
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:3996
                                          • C:\Windows\syswow64\MsiExec.exe
                                            C:\Windows\syswow64\MsiExec.exe -Embedding C0D7972A265C1C745853A5DBF89F5668
                                            2⤵
                                            • Loads dropped DLL
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:3632
                                            • C:\Users\Admin\AppData\Local\Temp\DBC84E30-3752-4491-B464-ADBF7332CB5C\lite_installer.exe
                                              "C:\Users\Admin\AppData\Local\Temp\DBC84E30-3752-4491-B464-ADBF7332CB5C\lite_installer.exe" --use-user-default-locale --silent --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/
                                              3⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4904
                                            • C:\Users\Admin\AppData\Local\Temp\C06EF108-F022-46D0-82F2-4DE217FF6F07\seederexe.exe
                                              "C:\Users\Admin\AppData\Local\Temp\C06EF108-F022-46D0-82F2-4DE217FF6F07\seederexe.exe" "--yqs=" "--yhp=" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=" "--browser_default=" "--yabm=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\0B4B51AE-61C8-4BFD-9FEB-FB5869B1ED70\sender.exe" "--is_elevated=yes" "--ui_level=5" "--good_token=x"
                                              3⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Modifies Internet Explorer settings
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of WriteProcessMemory
                                              PID:3492
                                              • C:\Users\Admin\AppData\Local\Temp\0B4B51AE-61C8-4BFD-9FEB-FB5869B1ED70\sender.exe
                                                C:\Users\Admin\AppData\Local\Temp\0B4B51AE-61C8-4BFD-9FEB-FB5869B1ED70\sender.exe --send "/status.xml?clid=2356518&uuid=75cb690b-1255-48df-b395-9aa31f3b6ee5&vnt=Windows 10x64&file-no=8%0A15%0A25%0A38%0A45%0A57%0A59%0A102%0A106%0A108%0A111%0A125%0A129%0A"
                                                4⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:17040

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Reconnaissance

                                        Resource Development

                                        Initial Access

                                        Execution

                                        Persistence

                                        Create or Modify System Process

                                        1
                                        T1543

                                        Windows Service

                                        1
                                        T1543.003

                                        Privilege Escalation

                                        Abuse Elevation Control Mechanism

                                        1
                                        T1548

                                        Bypass User Account Control

                                        1
                                        T1548.002

                                        Create or Modify System Process

                                        1
                                        T1543

                                        Windows Service

                                        1
                                        T1543.003

                                        Defense Evasion

                                        Abuse Elevation Control Mechanism

                                        1
                                        T1548

                                        Bypass User Account Control

                                        1
                                        T1548.002

                                        Impair Defenses

                                        4
                                        T1562

                                        Disable or Modify System Firewall

                                        1
                                        T1562.004

                                        Disable or Modify Tools

                                        3
                                        T1562.001

                                        Modify Registry

                                        7
                                        T1112

                                        Subvert Trust Controls

                                        1
                                        T1553

                                        Install Root Certificate

                                        1
                                        T1553.004

                                        Credential Access

                                        Credentials from Password Stores

                                        1
                                        T1555

                                        Credentials from Web Browsers

                                        1
                                        T1555.003

                                        Unsecured Credentials

                                        1
                                        T1552

                                        Credentials In Files

                                        1
                                        T1552.001

                                        Discovery

                                        Browser Information Discovery

                                        1
                                        T1217

                                        Peripheral Device Discovery

                                        1
                                        T1120

                                        Query Registry

                                        2
                                        T1012

                                        System Information Discovery

                                        3
                                        T1082

                                        System Location Discovery

                                        1
                                        T1614

                                        System Language Discovery

                                        1
                                        T1614.001

                                        Lateral Movement

                                        Collection

                                        Data from Local System

                                        1
                                        T1005

                                        Command and Control

                                        Exfiltration

                                        Impact

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Config.Msi\e57b7a8.rbs
                                          Filesize

                                          575B

                                          MD5

                                          97f309b1a539957c57f915926f7a5526

                                          SHA1

                                          3356c4da0f16dada203b5a142e6b4e2678d8524f

                                          SHA256

                                          67f59f4f258942afa81ffe0f967472f4dcf109042b9fa38a57cd4e5bc66dda7d

                                          SHA512

                                          c98875b51912fb86f5a485757d34470f202a6b6ec5c481ef9719c73718c312af1b64e306a017efaf15294f3742e546230295fc298958fd05efc133e986ddfb13

                                          Download Submit

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A026C9CD7BA14377D055F4A2325D4501
                                          Filesize

                                          1KB

                                          MD5

                                          cf2a5a3809235ebba751384bd6db2ccd

                                          SHA1

                                          bc980d4d2383d8449bbd926a4d4e6fe8d8479fe9

                                          SHA256

                                          84d32b90192f8a3f3abb091af2ce224d0f1fe8979a6c4a932ceff41394d93694

                                          SHA512

                                          2af40084aa1aae46360f4dbc90d629d8357c16e20da5c0551b8c724d5790a9eadccc917c39a1541c15ef6c915edd59943e7bfde3910afaaf01c44fd29a06d611

                                          Download Submit

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\769F85394FB15C375FF89A7488274D5B_22252D7CC6CD0EA80FCE3FF30A53AFB2
                                          Filesize

                                          5B

                                          MD5

                                          5bfa51f3a417b98e7443eca90fc94703

                                          SHA1

                                          8c015d80b8a23f780bdd215dc842b0f5551f63bd

                                          SHA256

                                          bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

                                          SHA512

                                          4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

                                          Download Submit

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8E55FEB142F566DFBD0ED964FAB94545
                                          Filesize

                                          8KB

                                          MD5

                                          ef742b46ba1e5b67c2c1bc9c60de08a0

                                          SHA1

                                          259f87376b46365c3488ed1d29b7856e650598a1

                                          SHA256

                                          0f2cd52a46c8d23d17680c5cf6d088c4d9d3b9650177a6acef042447109b49a9

                                          SHA512

                                          b053c8076d75de5e7a37fab4c33167eaec9278c37cce6ee2536f818a18ca341c90fa8ea88590a05b112b1dda2f5d81874c1a7c65e52c9c563e743f2b4834988f

                                          Download Submit

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_4BB72A60CF9C652B353353202101C0E4
                                          Filesize

                                          1KB

                                          MD5

                                          fb33c5086f0d513dccb584fe75b5d7d8

                                          SHA1

                                          22fb90c11183efd7edd774857c7ddac3689f900f

                                          SHA256

                                          7e39586a5520707d38d2b51732c1020e348ab05591bf2d13f6892f6b506b0b83

                                          SHA512

                                          eb971e8cc7e98e384afbc72db490ccc7e372c77024af8eb57e46129161c20a3c38d80f1c0300ac1db1e6d813b9fdac33bbc94dfad6ee15c6be841789eef83cd8

                                          Download Submit

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B0B1E3C3B1330A269DBEE4BA6313E7B4
                                          Filesize

                                          1KB

                                          MD5

                                          2ffbdb98df2a2b022a48adeb94a3af50

                                          SHA1

                                          6c86923b5c5832bb102f041cb7d38db397074f12

                                          SHA256

                                          dd12c5733bc4b682e1da6353c8c27650f53d11a8ada8fd8a2d06f23cecae5ebd

                                          SHA512

                                          a5f29661ac78ea205dd945fcc53e015152277426af4bcce688231ca1a564dc49144b2953409651737733fec72e9042468c780917543c007d7de74ed44058dbfb

                                          Download Submit

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A026C9CD7BA14377D055F4A2325D4501
                                          Filesize

                                          508B

                                          MD5

                                          33c3bcf288561e9841009951565a2ba8

                                          SHA1

                                          7585ab1e03e6d16d565b338e03b7f24a701887be

                                          SHA256

                                          2e9157c98af2099434fe89a34d1536bf59be4a69448315cada3b4217c593f72d

                                          SHA512

                                          95ee4d8d50983bd39f872f01c70580c2039b2bcf14b1a6b1f743b84f9e8137b0aa9fb0f4d1e88570bfb7782d407d3e35c33dc1e00eff0f6fb12f5589aaa286cb

                                          Download Submit

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\769F85394FB15C375FF89A7488274D5B_22252D7CC6CD0EA80FCE3FF30A53AFB2
                                          Filesize

                                          436B

                                          MD5

                                          9ef4bff4738454e9c520cbeee3cc56f7

                                          SHA1

                                          a2b85fafb7cc0e1524e1e8cff6349fb83a72e53c

                                          SHA256

                                          c6d492b9a77ee986544eef16538e6c56f67e154aadfdb53f68ede370ef4c36f1

                                          SHA512

                                          98d4e7c86f831014e24c502d5fb567c00a8a7ced4daa88f6f80ed06f1173ad0d3fcc0e267692e65afa834a734ef4a5965f69c2ae02ae3f3194a91fc2bdab79b3

                                          Download Submit

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8E55FEB142F566DFBD0ED964FAB94545
                                          Filesize

                                          210B

                                          MD5

                                          e348d7bc75be1c2caeb5848f4848e01d

                                          SHA1

                                          0e100882acada56cea3e2188f49d19626bd9ece9

                                          SHA256

                                          ed39330a476487bcafc983e9e2904beb4c8d7bc2107a340d45d8173e296c6fa0

                                          SHA512

                                          e4b29b5fad0e68dc940f1e45cf697f21f55bee77bc62aab4baa03b3c95d8e2b70a7e3ed74f9ed7cfdde830dd7f388a68e5b717f11d4fbf30619241438aac2729

                                          Download Submit

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_4BB72A60CF9C652B353353202101C0E4
                                          Filesize

                                          502B

                                          MD5

                                          f38c1c0b2ec7234bba3929c2f3fe3474

                                          SHA1

                                          21013023e0a1d1fc32795a0d00459a20b4fb7fb1

                                          SHA256

                                          c5dfa1c34e4c567fcdfde43ee51fb507c0fb7bf90fd1c9535e9f99ee40127f87

                                          SHA512

                                          4d805da18e6ce9d983fe12bb3779dc5a331c6e1c8297edbc0a1d9abf8e39f6abe00e98a57ccd2266c04bc137a2e8fe320b0a5feb022862dd2f7f75edc559f116

                                          Download Submit

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B0B1E3C3B1330A269DBEE4BA6313E7B4
                                          Filesize

                                          208B

                                          MD5

                                          df0eee8c2bbd630edb8b22875510b733

                                          SHA1

                                          7cda0b5020ec8db214b5b735af63635b980c65f2

                                          SHA256

                                          a8740307a8f9380183117487f4652099475f1f5387b1bb159ddbe6b757111b4d

                                          SHA512

                                          b824aa98a864ab0866f75db1ed59afc0ec92a9c32636cebc3f4a1e7fd6692fdbdf97827ce6a0a6c4fff2ecd3815843d6d9f80e672f8ee4db528051208295d21f

                                          Download Submit

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDA81A73291E20E6ACF6CACA76D5C942_4EA93225B46C4B45501FF0DDE9E306D0
                                          Filesize

                                          440B

                                          MD5

                                          e1365ca63a6c5a81bcf58e2aa55f0186

                                          SHA1

                                          fc26ef257cea187bc4800798cdb04bd775935f80

                                          SHA256

                                          dcaf011aee9163f4f997f1bbbd6df05c6d5028ebc8db10ec62b31dda2dabba26

                                          SHA512

                                          ce0af018063686f0135349b1c64a23b8071285197c86966a63dca4d60120b2212b7f3c47a47069850b6b18e0acc377da235f892b5861156921247e0c0e0d2d33

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\0B4B51AE-61C8-4BFD-9FEB-FB5869B1ED70\sender.exe
                                          Filesize

                                          264KB

                                          MD5

                                          fa6fad99d5d7ea5fcae4fe1d3a4f0038

                                          SHA1

                                          af23126f210ec5fcea7ec51db519c68be1b4d362

                                          SHA256

                                          3936b42d82e12f01d80af3c9f677772082a06211c4d6172198af31696c99b3fc

                                          SHA512

                                          2211694fe9454c7ba380435ef9cc75a3e1868e732aa174c7884cac9a18ffcfc75fbcf23aba71cc1c66252ef4ea2ba58015fed3b1829fe771d887a5fd9b6b34a5

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\175a1382-baef-4417-af51-33c3d071ef7a\sovetnik-at-metabar.json
                                          Filesize

                                          1KB

                                          MD5

                                          5a40649cf7f6923e1e00e67a8e5fc6c8

                                          SHA1

                                          fc849b64b31f2b3d955f0cb205db6921eacc1b53

                                          SHA256

                                          6d432ba7096090837f9533a33a686c846ad67aed8ecc43af7ce8af42649cd51a

                                          SHA512

                                          0fc42a2cc61528b14478f4b9ae098ea90e6b05ddbe10f3a6cdd6326d0d8e6185b49d2b8143b76a9f329bdc277cf02b54d98f374edd65df68a1ffc41e1c817786

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\175a1382-baef-4417-af51-33c3d071ef7a\sovetnik-at-metabar.xpi
                                          Filesize

                                          688KB

                                          MD5

                                          ab6d42f949df8d7e6a48c07e9b0d86e0

                                          SHA1

                                          1830399574b1973e2272e5dcc368c4c10dbbe06b

                                          SHA256

                                          205ebf52c47b42fa0ad1a734a1d882d96b567e15a32b19bdb907562db8ea09e2

                                          SHA512

                                          6c4f9bb726384c87b6523e08339f7821ad4ec8717b26db902ca51df74eb89b46e4ded1504a131683b07b2bba3e6e911a549a8a83b2aad3971047c0fe315a1ad5

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\175a1382-baef-4417-af51-33c3d071ef7a\vb-at-yandex.ru.json
                                          Filesize

                                          5KB

                                          MD5

                                          856242624386f56874a3f3e71d7993f4

                                          SHA1

                                          96d3199c5eebb0d48c944050fbc753535ee09801

                                          SHA256

                                          d86ed80d2a9e4e1af843a991a6553a2fefd5433b2144be0cfb63a2f18deb86be

                                          SHA512

                                          76d440fe2ed535677a1d249b289463bfedfc5d2afc0e269e4593bb113393f165856c07117735cf3e5a230b5d04a61c7126df24a466594d8c27b47b2047834a09

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\175a1382-baef-4417-af51-33c3d071ef7a\vb-at-yandex.ru.xpi
                                          Filesize

                                          1.7MB

                                          MD5

                                          e68cea8c6d4b16641f30dd930a952ebb

                                          SHA1

                                          7e8c4b51e6e56f35a2983ab6cb121341aeda565c

                                          SHA256

                                          a7f3f788323a12158d66f341c4711d71fc2244a2b07a68fb8df4baec0ff76f35

                                          SHA512

                                          96351e36a4c5020ed464b96b72bb3063db819981440bde7c6c3a50f7fe470e1d70f0350ec7c4bcd4808fcabe2ddfbdebfc7039ae2248c1455e2245f53ce44ec0

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\C06EF108-F022-46D0-82F2-4DE217FF6F07\seederexe.exe
                                          Filesize

                                          7.4MB

                                          MD5

                                          a7483df6aaf185af61a2d6122ae2b12b

                                          SHA1

                                          463c6b8ecc4ecd9af05f5b738651b9c99e77195a

                                          SHA256

                                          f7c56249239800c74ce1e24c042f7207c0a9fca323a7bda0125c72f1bcaf10a0

                                          SHA512

                                          6393e62b224a5ab630016f3b275f78aafbc0144798ab98f817813087a9fe3c138cb28c7fef34a40269a887415f49f2108c3fce8b1b77655e7ebd6b4670286b58

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\DBC84E30-3752-4491-B464-ADBF7332CB5C\lite_installer.exe
                                          Filesize

                                          423KB

                                          MD5

                                          0c03eb93d1ffa26e3958048d1b2bfbdf

                                          SHA1

                                          acdcf4dd3c374642f8ef7dc7399d847cf57a973a

                                          SHA256

                                          4f789f9f51cbd3195baaf81e50ea15b544ed46dfff28ba4f1b0e746248ca1422

                                          SHA512

                                          8b3cc62e7951cec605ece2835e8160cf5796074e2e5d3690920f74ab84815b106aa52b73ead708fafd583cb86e774a8bf2198693994684d00dddb265398490d2

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
                                          Filesize

                                          34KB

                                          MD5

                                          730fbbc4e3f2749cf9b493b52629bb78

                                          SHA1

                                          4eabde9fb3a1dfdcea5c4673e5c6318f8ab7df09

                                          SHA256

                                          96f7b98fe1812f06376b36fe3c3353cdc4ced375c339bec80d83af4b0fe3cb0d

                                          SHA512

                                          7fdc9b7ef8cd76c6208b2cdf9e730f5bb8f8c3ccc04afd0c826226b25e2a6028a0cba62f987015fa2b302d2a46cbbb9b32e2fe14465a45493af7ff5ed854621e

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml
                                          Filesize

                                          530B

                                          MD5

                                          f3d88b6aee939fb2f3bea9b96e7ce864

                                          SHA1

                                          c52ebab399be03b6688fd6f760f26dd097797dd8

                                          SHA256

                                          dd529a9578d15a17402564aeef13a93312c320f5c7a97ac1a94967ad05f0ca5e

                                          SHA512

                                          b701cf836c481da53fe1a60101735f730a23a4e2c1695e38ad94a96c810421b93a74770eabb80d8a69970c23aac847a80eed19c7bf54be02323177a942c6e7af

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\omnija-20252901.zip
                                          Filesize

                                          42.1MB

                                          MD5

                                          bf952b53408934f1d48596008f252b8d

                                          SHA1

                                          758d76532fdb48c4aaf09a24922333c4e1de0d01

                                          SHA256

                                          2183a97932f51d5b247646985b4e667d8be45f18731c418479bbd7743c825686

                                          SHA512

                                          a510a96e17090ada1a107e0f6d4819787652ab3d38cd17237f255c736817c7cfcb3fd5cf25f56d5693f4923375b2ab9548e9215070e252aae25c3528b2186d99

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\tmp3492aaaaaa
                                          Filesize

                                          2.5MB

                                          MD5

                                          ab8ad0598fd809f5bceaab59575e121e

                                          SHA1

                                          9c9c6898e4512c8a5f3b0a18fd6b0c1bf1d773b6

                                          SHA256

                                          482ef43ea80aa3674788ca369eaccd879f69219281bb43ef8dfabf70928721b7

                                          SHA512

                                          32254c482835133c4b55a86421bd39d2c9b2cf37c27f5bfa40313996f8f323822486f59667e9b342c6c0f3120103b47e5ff194a9f7d7171c38307d0d27b7bf98

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
                                          Filesize

                                          509B

                                          MD5

                                          8dba0e19d0eb0e616ee2ecc39b3b9b16

                                          SHA1

                                          73d354c9ed9bcc240aa1a2bfeb3e7e30d54f8052

                                          SHA256

                                          3e35e3c5c3fd2e63ef3588ee920abc3503814476e10f922d0a23d08e5c649aa2

                                          SHA512

                                          0be21be215828e805dabdc7bef5e7ef528970a83630960e0e7a7ed737f08f0b5c35a5f7d17ae562abec828ec1582ab2037153383fd02a9144d6b8a95e1f23104

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
                                          Filesize

                                          8.9MB

                                          MD5

                                          85dca9499320b4697760756af08578db

                                          SHA1

                                          16c683f0e22d186bea2b44eeb3f395554feaf5a5

                                          SHA256

                                          ea3a74162d382da92f23d922548e09a432a893a6abc4dc92580fd7f0e49f0767

                                          SHA512

                                          7979b02400a9147f547a9af0deefede034e39636345978f57302ab70753967ff62b402757aaab84967200d4aeead63d2b7440997579e90160c850c91a29e1eb2

                                          Download Submit

                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9jba1y1v.Admin\places.sqlite-20250201133002.634203.backup
                                          Filesize

                                          68KB

                                          MD5

                                          58b4f36e4874cbc6a0a930e91ffb2c89

                                          SHA1

                                          207138ddac715a55c24babb609fb1a480658f3f6

                                          SHA256

                                          69d959aa7616101ea0d194cbb3afa08047ea7a9d169ca72a9d375f7e96125e48

                                          SHA512

                                          cd6b989135fa8d7951606e1ff1285fe3f2ac2859414a4c88b3b7c71e02c765988775ce60d4e382183528d55cffdfd9fb08be1e9b96f692ad50ba473a9f84edee

                                          Download Submit

                                        • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks-20250201133002.727935.backup
                                          Filesize

                                          1KB

                                          MD5

                                          3adec702d4472e3252ca8b58af62247c

                                          SHA1

                                          35d1d2f90b80dca80ad398f411c93fe8aef07435

                                          SHA256

                                          2b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335

                                          SHA512

                                          7562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0

                                          Download Submit

                                        • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences-20250201133002.727935.backup
                                          Filesize

                                          313B

                                          MD5

                                          af006f1bcc57b11c3478be8babc036a8

                                          SHA1

                                          c3bb4fa8c905565ca6a1f218e39fe7494910891e

                                          SHA256

                                          ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c

                                          SHA512

                                          3d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af

                                          Download Submit

                                        • C:\Users\Admin\AppData\Roaming\Yandex\ui
                                          Filesize

                                          38B

                                          MD5

                                          fde3a3a8459e9d48c1a3b400b7ab3c13

                                          SHA1

                                          2e30d7ebc9d9b5d6e71207c3c5851c1ff4240905

                                          SHA256

                                          e66a94e0c6a57857c517c29187adf1c200f76d6983de07058683d8442b94cc48

                                          SHA512

                                          b82fb3ac58b271224aca79641e2e76c19b727effb7b4d2899b58da22333851ecd138671c853bfd72701e59bccf82bc2b43dcfbb6a02b5d0b7d21f7c689232ee1

                                          Download Submit

                                        • C:\Windows\Installer\MSIBDC2.tmp
                                          Filesize

                                          183KB

                                          MD5

                                          397ab476de3fa72a10b8712d4adae0fb

                                          SHA1

                                          42937a6467beb0ed70bc443e03d401ec7e4954e7

                                          SHA256

                                          fb393e8c6366d4b8b27fc5e7b708380f4949e2ff911822745cb0c1a9b8ad3add

                                          SHA512

                                          6c9fc9485c09da4316364d8135fc76a72600247966f0807f2fbed8ef4de17afdd9cd55456f31b0ccef369cf05900e9e6deeadfc8f1a8e9d38c33eed1114ed85b

                                          Download Submit

                                        • C:\Windows\Installer\MSIC0FF.tmp
                                          Filesize

                                          190KB

                                          MD5

                                          3eaa3733c0a1c79d15ff9bd0ea8ec80d

                                          SHA1

                                          7c5f9331d8c8cc4fb316e25045fafc5438db6efc

                                          SHA256

                                          42747eb3321242ef4c551f1e0f3dc2891a72b5d24aae685b199751216162962b

                                          SHA512

                                          6bee660636049122b9b729c6568d5a9997deb323808b6de5c02ae4631874f5b186ccafe31f2103a90457f9b76141f1bee31f787a2fe836c4df9e3deed3713c1b

                                          Download Submit

                                        • memory/2216-10-0x0000000001350000-0x0000000001351000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/2216-295-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-9-0x0000000001010000-0x0000000001012000-memory.dmp

                                          Filesize

                                          8KB

                                          Download

                                        • memory/2216-97-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-19-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-124-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-17-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-28-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-152-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-158-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-75-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-169-0x0000000001010000-0x0000000001012000-memory.dmp

                                          Filesize

                                          8KB

                                          Download

                                        • memory/2216-4-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-14-0x0000000001010000-0x0000000001012000-memory.dmp

                                          Filesize

                                          8KB

                                          Download

                                        • memory/2216-0-0x0000000000400000-0x0000000000D57000-memory.dmp

                                          Filesize

                                          9.3MB

                                          Download

                                        • memory/2216-18-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-15-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-16-0x0000000001010000-0x0000000001012000-memory.dmp

                                          Filesize

                                          8KB

                                          Download

                                        • memory/2216-5291-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-5746-0x0000000000400000-0x0000000000D57000-memory.dmp

                                          Filesize

                                          9.3MB

                                          Download

                                        • memory/2216-13-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-29-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-31-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-8-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-12-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-3-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-1-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-34-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download

                                        • memory/2216-35-0x0000000002C70000-0x0000000003CFE000-memory.dmp

                                          Filesize

                                          16.6MB

                                          Download