Overview

overview

10

Static

static

3

2025-02-06...er.exe

windows7-x64

10

2025-02-06...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    96s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-02-2025 01:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-02-06_1b2cb2ec4b1c1ad891257c1943447a30_hawkeye_luca-stealer_magniber.exe

  • Size

    9.5MB

  • MD5

    1b2cb2ec4b1c1ad891257c1943447a30

  • SHA1

    4ce1ef3c337925e97aa6964e691d70c87aee11cb

  • SHA256

    250f6a4dd40a9ad48e66f006c9ab24aa165322180b94a954ccfa55e02d4b8266

  • SHA512

    0ba75b54cfa0623cc6d225c2490a3254f169c8d27a2a64866ff3e201298826ac9466c77ee2c7b1c89fb660c2696a1911a22079390a62fb7ddbdd6e9583365e0b

  • SSDEEP

    196608:V78cEXTRiA3JjtvqiAxhv9sg1tKCTpYAQEWrqufezvGWUJ/h:VocYRiIt07vJYZEW2uGz+WUJ/h

Score
10/10
salitybackdoordefense_evasiondiscoveryspywarestealertrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
    defense_evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Sality family
    sality
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    defense_evasiontrojan
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 7 IoCs
    defense_evasiontrojan
  • Blocklisted process makes network request 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 19 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 17 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:768
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:772
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:384
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2508
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2544
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:2708
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3484
                  • C:\Users\Admin\AppData\Local\Temp\2025-02-06_1b2cb2ec4b1c1ad891257c1943447a30_hawkeye_luca-stealer_magniber.exe
                    "C:\Users\Admin\AppData\Local\Temp\2025-02-06_1b2cb2ec4b1c1ad891257c1943447a30_hawkeye_luca-stealer_magniber.exe"
                    2⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Enumerates connected drives
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Modifies system certificate store
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:4120
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                    PID:3628
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    1⤵
                      PID:3824
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3916
                      • C:\Windows\System32\RuntimeBroker.exe
                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                        1⤵
                          PID:3980
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4060
                          • C:\Windows\System32\RuntimeBroker.exe
                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                            1⤵
                              PID:3012
                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                              1⤵
                                PID:1740
                              • C:\Windows\System32\RuntimeBroker.exe
                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                1⤵
                                  PID:3552
                                • C:\Windows\system32\msiexec.exe
                                  C:\Windows\system32\msiexec.exe /V
                                  1⤵
                                  • Blocklisted process makes network request
                                  • Enumerates connected drives
                                  • Drops file in Windows directory
                                  • Modifies data under HKEY_USERS
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:2188
                                  • C:\Windows\syswow64\MsiExec.exe
                                    C:\Windows\syswow64\MsiExec.exe -Embedding FD263DEE725F5BADE6AEF3CC4A8E2570
                                    2⤵
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:5032
                                    • C:\Users\Admin\AppData\Local\Temp\56E024B3-164B-466C-8EEF-56366A142272\lite_installer.exe
                                      "C:\Users\Admin\AppData\Local\Temp\56E024B3-164B-466C-8EEF-56366A142272\lite_installer.exe" --use-user-default-locale --silent --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/
                                      3⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4020
                                  • C:\Windows\syswow64\MsiExec.exe
                                    C:\Windows\syswow64\MsiExec.exe -Embedding 20AC6DB603618ED005083ADB41A9EB8F E Global\MSI0000
                                    2⤵
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:716
                                    • C:\Users\Admin\AppData\Local\Temp\889A37AE-1146-47A2-98F5-1F7F005573F8\seederexe.exe
                                      "C:\Users\Admin\AppData\Local\Temp\889A37AE-1146-47A2-98F5-1F7F005573F8\seederexe.exe" "--yqs=" "--yhp=" "--ilight=" "--locale=us" "--browser=" "--browser_default=" "--yabm=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\B562E39C-EF87-462F-AEBA-3D6C10E9E5BD\sender.exe" "--is_elevated=yes" "--ui_level=5"
                                      3⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Modifies Internet Explorer settings
                                      • Modifies data under HKEY_USERS
                                      • Suspicious use of WriteProcessMemory
                                      PID:3276
                                      • C:\Users\Admin\AppData\Local\Temp\B562E39C-EF87-462F-AEBA-3D6C10E9E5BD\sender.exe
                                        C:\Users\Admin\AppData\Local\Temp\B562E39C-EF87-462F-AEBA-3D6C10E9E5BD\sender.exe --send "/status.xml?clid=2255393&uuid=9dd8a1a8-e430-47b5-9297-89c96c678b58&vnt=Windows 10x64&file-no=8%0A15%0A25%0A38%0A45%0A57%0A59%0A102%0A106%0A108%0A111%0A125%0A129%0A"
                                        4⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:17180

                                Network

                                MITRE ATT&CK Enterprise v15

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Persistence

                                Create or Modify System Process

                                1
                                T1543

                                Windows Service

                                1
                                T1543.003

                                Privilege Escalation

                                Abuse Elevation Control Mechanism

                                1
                                T1548

                                Bypass User Account Control

                                1
                                T1548.002

                                Create or Modify System Process

                                1
                                T1543

                                Windows Service

                                1
                                T1543.003

                                Defense Evasion

                                Abuse Elevation Control Mechanism

                                1
                                T1548

                                Bypass User Account Control

                                1
                                T1548.002

                                Impair Defenses

                                4
                                T1562

                                Disable or Modify System Firewall

                                1
                                T1562.004

                                Disable or Modify Tools

                                3
                                T1562.001

                                Modify Registry

                                7
                                T1112

                                Subvert Trust Controls

                                1
                                T1553

                                Install Root Certificate

                                1
                                T1553.004

                                Credential Access

                                Credentials from Password Stores

                                1
                                T1555

                                Credentials from Web Browsers

                                1
                                T1555.003

                                Unsecured Credentials

                                1
                                T1552

                                Credentials In Files

                                1
                                T1552.001

                                Discovery

                                Browser Information Discovery

                                1
                                T1217

                                Peripheral Device Discovery

                                1
                                T1120

                                Query Registry

                                2
                                T1012

                                System Information Discovery

                                3
                                T1082

                                System Location Discovery

                                1
                                T1614

                                System Language Discovery

                                1
                                T1614.001

                                Lateral Movement

                                Collection

                                Data from Local System

                                1
                                T1005

                                Command and Control

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Config.Msi\e57a5b7.rbs
                                  Filesize

                                  591B

                                  MD5

                                  1502f49e3454c3b959de850f87c9df06

                                  SHA1

                                  1b2d8076eeaf305dc782ba2027d3ee2a7943631e

                                  SHA256

                                  175a460a2410a576e1653a44de6eb18cc739585e165a41f35d0f51af5001e9dd

                                  SHA512

                                  d8ab494e0a78ce50e273e296b567f478cb4e9e97bf8b9666b00b23a85a74ab03dc32c38058ff0bed25a6e6823007f0f769753215199da84a57c1e1708106b636

                                  Download Submit

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A026C9CD7BA14377D055F4A2325D4501
                                  Filesize

                                  1KB

                                  MD5

                                  b5c77f589f8a2e34b8198cd40deafeba

                                  SHA1

                                  178bd02ee96a2e846a9eb4091f36b36415e61c33

                                  SHA256

                                  bb5e2ed52f7fcf25088e153cf4c00f56ccd23353c6e4d865a5fe7f4442b5fe02

                                  SHA512

                                  e6bfd2b99b8cfae9113939eef5537afd05bf975d5d159ad12e6b76a5844bd82058edd059e77be5731bae0e65d42417300ab2e400928f8b1aa90bba801c01fcba

                                  Download Submit

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\769F85394FB15C375FF89A7488274D5B_22252D7CC6CD0EA80FCE3FF30A53AFB2
                                  Filesize

                                  5B

                                  MD5

                                  5bfa51f3a417b98e7443eca90fc94703

                                  SHA1

                                  8c015d80b8a23f780bdd215dc842b0f5551f63bd

                                  SHA256

                                  bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

                                  SHA512

                                  4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

                                  Download Submit

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8E55FEB142F566DFBD0ED964FAB94545
                                  Filesize

                                  8KB

                                  MD5

                                  ef742b46ba1e5b67c2c1bc9c60de08a0

                                  SHA1

                                  259f87376b46365c3488ed1d29b7856e650598a1

                                  SHA256

                                  0f2cd52a46c8d23d17680c5cf6d088c4d9d3b9650177a6acef042447109b49a9

                                  SHA512

                                  b053c8076d75de5e7a37fab4c33167eaec9278c37cce6ee2536f818a18ca341c90fa8ea88590a05b112b1dda2f5d81874c1a7c65e52c9c563e743f2b4834988f

                                  Download Submit

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_4BB72A60CF9C652B353353202101C0E4
                                  Filesize

                                  1KB

                                  MD5

                                  2175c892a15a84d8d494874f9a2ef590

                                  SHA1

                                  781625f5011b039d335780c84e095cd0556b73a5

                                  SHA256

                                  99dc9ed272c99e919c54786173a4cf7f96613ed06b5b6800e67bec1cd4eb83c6

                                  SHA512

                                  22c143c01858c88bb7bc38682a70cdb244607d72a64cd79e2f80792440d1b00bb861012e5d5c871bb10b177a22d9f8e5d724f74c18047cf3a649c9d51713e131

                                  Download Submit

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B0B1E3C3B1330A269DBEE4BA6313E7B4
                                  Filesize

                                  1KB

                                  MD5

                                  2ffbdb98df2a2b022a48adeb94a3af50

                                  SHA1

                                  6c86923b5c5832bb102f041cb7d38db397074f12

                                  SHA256

                                  dd12c5733bc4b682e1da6353c8c27650f53d11a8ada8fd8a2d06f23cecae5ebd

                                  SHA512

                                  a5f29661ac78ea205dd945fcc53e015152277426af4bcce688231ca1a564dc49144b2953409651737733fec72e9042468c780917543c007d7de74ed44058dbfb

                                  Download Submit

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A026C9CD7BA14377D055F4A2325D4501
                                  Filesize

                                  508B

                                  MD5

                                  1ba4d933798bfe0c83bdd85f8ca496dc

                                  SHA1

                                  fc194f7f4c57a670da19738bce566bfe037d0eab

                                  SHA256

                                  82c686d0e4bcdce1c04db3d00094b7a712012861dc04d5062abd03e0c740b0d6

                                  SHA512

                                  8f6fb2d29f62b95e2b2c5868bab4fad848462fe2aed9c49308ad15560e2feb6c770b91d0d958f8fa00ee08262d1f775460eb31569a38104dfedfa4f569c6aefd

                                  Download Submit

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\769F85394FB15C375FF89A7488274D5B_22252D7CC6CD0EA80FCE3FF30A53AFB2
                                  Filesize

                                  436B

                                  MD5

                                  cf1bd8e47619485c59fa2f2a38f48d2f

                                  SHA1

                                  4ee49b197be2aba74fc5711191de74f743019f88

                                  SHA256

                                  b4c4384c3961dbda6e93958e179620be0baded9d5373f5436adeaa189bf22b80

                                  SHA512

                                  a127a47432e248275839bd5d956dfbbbaebcc671e75604f0a16b53c855b0e3ec0dfb800fac4804e1ddc3cd23713826005973707dfd3c6941a5abfab7f593402b

                                  Download Submit

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8E55FEB142F566DFBD0ED964FAB94545
                                  Filesize

                                  210B

                                  MD5

                                  003c9a0a277a97e648efb4a4f13de7c9

                                  SHA1

                                  f9d9566a3bb863fb0ab95abb8ef534f6feb1289a

                                  SHA256

                                  c270135e6e8d62abc8225594f2a037fdf3cfcadd5276ae66efe922667e0ff595

                                  SHA512

                                  d9642460f4efcf6897b04d3894725edd81fd8f26ec1c7a70d07e207dcdac4a46c317a0d2330b1c245e99a7a4c6593c0fd340c6a30bbc44b18aaf5e841cf7f23c

                                  Download Submit

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_4BB72A60CF9C652B353353202101C0E4
                                  Filesize

                                  502B

                                  MD5

                                  8d58d7a24ab348ebfaa6f0427038a6db

                                  SHA1

                                  fa63ce4e5b66da075087fb28b3a44bcda18ddc80

                                  SHA256

                                  2f20c38f364c41440617d9e1ab34f94c5af25b002004b5f2dc43056ef6611afa

                                  SHA512

                                  972498f31fee0ab078fa576f96c20746e8dbaa2870588567f0233c1dc8699e4c83407721956ba09311629234043f7b9ac0ed377cec335ae3c116ac0657df0541

                                  Download Submit

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B0B1E3C3B1330A269DBEE4BA6313E7B4
                                  Filesize

                                  208B

                                  MD5

                                  35efc2661ab93b89a538bd6c87931a35

                                  SHA1

                                  170f25df60832e527e019161ed03f040ec5b4d02

                                  SHA256

                                  e35906450e2dc014e9a5a8916b020ac913ebbae1565bdedc29165d37b3dbe7c3

                                  SHA512

                                  4816a1d6203ba6fb19783e27ce9aa853b924afee584652a0cca31814cf82e78c495a430c3b2b612bc1e09f9a06d445cffbb55237806c6e39ed481861ec1dbbfb

                                  Download Submit

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDA81A73291E20E6ACF6CACA76D5C942_4EA93225B46C4B45501FF0DDE9E306D0
                                  Filesize

                                  440B

                                  MD5

                                  353c02b618df024dfc68f57c3e00f862

                                  SHA1

                                  83901a172d1c0be5cb719a277f04b184d24edb61

                                  SHA256

                                  049d6c8986d0d4ea6961340c1ef6f04c274521cd4a3fdca6ba3b853cd0271528

                                  SHA512

                                  982a37fb768753b40ba5c6a957ccbdc22c9ed2a5d868eaa5abad969427d46625a758a26fc9c3d079bd3545dc472fecc57d06e9597ac627d2b5f22e2503718e76

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\56E024B3-164B-466C-8EEF-56366A142272\lite_installer.exe
                                  Filesize

                                  415KB

                                  MD5

                                  4958fe818ee0910209de2482bceed571

                                  SHA1

                                  c687e280b374c25b17a7f70e8c78f0ab331857bc

                                  SHA256

                                  3317ab61f7fbd98199f961ff8b3b68e310c12b6a76312819daed873d172054d4

                                  SHA512

                                  b54d4727200d9c473b3b2fde613a7ace8220aaa7ac52e0e29ae39aa22bd05c15fabb47b119b2085f81bbc864100fd78bfe2d74a1c122a80d143be17c6eb25cd8

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\889A37AE-1146-47A2-98F5-1F7F005573F8\seederexe.exe
                                  Filesize

                                  7.4MB

                                  MD5

                                  f4a72fa8bd9c0583bfa4e1e5a9b2780e

                                  SHA1

                                  00ef9ebc448f345a26598ea68ff4b5737d0d9fbb

                                  SHA256

                                  b4a72919d83b22ad06aca95fc8603e3b00f5804f5cc3f53dbd1c6e16ff2b8bf9

                                  SHA512

                                  9a27b6a0245987496ae17ebb3610d231245594db4a1c4fdf19ec004cf7bfe5a67246946c6d8d441824609bb2d6fee1287688ec21c6177d4394e8f7c9d82f5034

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\B562E39C-EF87-462F-AEBA-3D6C10E9E5BD\sender.exe
                                  Filesize

                                  264KB

                                  MD5

                                  eb796e1048dd306d7ef2d09189b98bc2

                                  SHA1

                                  c2a6ee261e26619bea43e53a51407ccc6a9e0778

                                  SHA256

                                  b8dbc06ff7b0e10451a773e054337854b957be6650d5839b27f92706c8f75aa3

                                  SHA512

                                  26375f5e039e51db7f990f6e7183aabf9cfea48c6f5e25bea588f26ea9a5e7a704485584eaab9f465111158952a07b9a87943be7986e0c0abca26e850909d2eb

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
                                  Filesize

                                  35KB

                                  MD5

                                  f3565827485e05bc92a5042e0a07841e

                                  SHA1

                                  7be3f19692e3024b83b707e0b9e9a9dbef22fc6b

                                  SHA256

                                  de82f174564b4e3d1567c71888812e4adc04025b052c17eacb2ab56e5eb407f9

                                  SHA512

                                  adf3eb118493d95a044971ab2789cf994770f974dc225d1a1101a460149fae91ea6df3b65c1f2b6e7cf49d13dfa2f0fe1c5024a4446ab3986bb6b8da2286c4e3

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\c354a424-68e9-4ce0-9073-95fb93adf43a\sovetnik-at-metabar.json
                                  Filesize

                                  1KB

                                  MD5

                                  5a40649cf7f6923e1e00e67a8e5fc6c8

                                  SHA1

                                  fc849b64b31f2b3d955f0cb205db6921eacc1b53

                                  SHA256

                                  6d432ba7096090837f9533a33a686c846ad67aed8ecc43af7ce8af42649cd51a

                                  SHA512

                                  0fc42a2cc61528b14478f4b9ae098ea90e6b05ddbe10f3a6cdd6326d0d8e6185b49d2b8143b76a9f329bdc277cf02b54d98f374edd65df68a1ffc41e1c817786

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\c354a424-68e9-4ce0-9073-95fb93adf43a\sovetnik-at-metabar.xpi
                                  Filesize

                                  688KB

                                  MD5

                                  ab6d42f949df8d7e6a48c07e9b0d86e0

                                  SHA1

                                  1830399574b1973e2272e5dcc368c4c10dbbe06b

                                  SHA256

                                  205ebf52c47b42fa0ad1a734a1d882d96b567e15a32b19bdb907562db8ea09e2

                                  SHA512

                                  6c4f9bb726384c87b6523e08339f7821ad4ec8717b26db902ca51df74eb89b46e4ded1504a131683b07b2bba3e6e911a549a8a83b2aad3971047c0fe315a1ad5

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\c354a424-68e9-4ce0-9073-95fb93adf43a\vb-at-yandex.ru.json
                                  Filesize

                                  5KB

                                  MD5

                                  856242624386f56874a3f3e71d7993f4

                                  SHA1

                                  96d3199c5eebb0d48c944050fbc753535ee09801

                                  SHA256

                                  d86ed80d2a9e4e1af843a991a6553a2fefd5433b2144be0cfb63a2f18deb86be

                                  SHA512

                                  76d440fe2ed535677a1d249b289463bfedfc5d2afc0e269e4593bb113393f165856c07117735cf3e5a230b5d04a61c7126df24a466594d8c27b47b2047834a09

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\c354a424-68e9-4ce0-9073-95fb93adf43a\vb-at-yandex.ru.xpi
                                  Filesize

                                  1.7MB

                                  MD5

                                  e68cea8c6d4b16641f30dd930a952ebb

                                  SHA1

                                  7e8c4b51e6e56f35a2983ab6cb121341aeda565c

                                  SHA256

                                  a7f3f788323a12158d66f341c4711d71fc2244a2b07a68fb8df4baec0ff76f35

                                  SHA512

                                  96351e36a4c5020ed464b96b72bb3063db819981440bde7c6c3a50f7fe470e1d70f0350ec7c4bcd4808fcabe2ddfbdebfc7039ae2248c1455e2245f53ce44ec0

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml
                                  Filesize

                                  560B

                                  MD5

                                  bb86a574d808f235e346aa71aba2ef2f

                                  SHA1

                                  37171e01f066fcd21ceb0b4a3961c55a8491dc55

                                  SHA256

                                  b5a25aa7d1f28ad3fe60d91ef0e3dd4b4352dcacd0215e2d8e6ba45394e27750

                                  SHA512

                                  40112649f82243cc6bee9a276229c868ce8e09881ae9698fda2a35cbf946d7db90ee3c05585907183052821a5e774e90f85a41381f6da4b980230e84826fc3bc

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\omnija-20250506.zip
                                  Filesize

                                  42.1MB

                                  MD5

                                  bf952b53408934f1d48596008f252b8d

                                  SHA1

                                  758d76532fdb48c4aaf09a24922333c4e1de0d01

                                  SHA256

                                  2183a97932f51d5b247646985b4e667d8be45f18731c418479bbd7743c825686

                                  SHA512

                                  a510a96e17090ada1a107e0f6d4819787652ab3d38cd17237f255c736817c7cfcb3fd5cf25f56d5693f4923375b2ab9548e9215070e252aae25c3528b2186d99

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
                                  Filesize

                                  597B

                                  MD5

                                  b4b89b203968f4fb1b7850fd05a94094

                                  SHA1

                                  91aec65c34241053d2e49431739929c038d7d881

                                  SHA256

                                  cc6c2d3f348e5b0b548b3d2e8ad2db90700962b8a8dc4851feb94fe339d07e44

                                  SHA512

                                  570976aed5e0bde0e535e464d0c649d14815cb5c9f8cf12fead489e6faa041efc5f1e7c9f5b03889f3d6b9c8a0069f7c744e0c8fef46b2b858889d527a379148

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
                                  Filesize

                                  9.1MB

                                  MD5

                                  91eb14f38b109168410a2413c8e8ec02

                                  SHA1

                                  716f778fb0ee3da11c215e3278afd071411cc7d8

                                  SHA256

                                  52d09e30ad5a0c2bf880fe5dde2da9efc237fa55ced7feed2baf3e91b322ef8d

                                  SHA512

                                  183b691bb6c59e284a88412bb5408d6d67724d1a4afff0fe1eb7d3c07132d3d3d06225f16ce085721687ff7209429aad3871f907077d3c33231161226d39b521

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\43mkyhds.Admin\places.sqlite-20250206010541.134303.backup
                                  Filesize

                                  68KB

                                  MD5

                                  58b4f36e4874cbc6a0a930e91ffb2c89

                                  SHA1

                                  207138ddac715a55c24babb609fb1a480658f3f6

                                  SHA256

                                  69d959aa7616101ea0d194cbb3afa08047ea7a9d169ca72a9d375f7e96125e48

                                  SHA512

                                  cd6b989135fa8d7951606e1ff1285fe3f2ac2859414a4c88b3b7c71e02c765988775ce60d4e382183528d55cffdfd9fb08be1e9b96f692ad50ba473a9f84edee

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks-20250206010541.228060.backup
                                  Filesize

                                  1KB

                                  MD5

                                  3adec702d4472e3252ca8b58af62247c

                                  SHA1

                                  35d1d2f90b80dca80ad398f411c93fe8aef07435

                                  SHA256

                                  2b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335

                                  SHA512

                                  7562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences-20250206010541.228060.backup
                                  Filesize

                                  313B

                                  MD5

                                  af006f1bcc57b11c3478be8babc036a8

                                  SHA1

                                  c3bb4fa8c905565ca6a1f218e39fe7494910891e

                                  SHA256

                                  ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c

                                  SHA512

                                  3d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Yandex\ui
                                  Filesize

                                  38B

                                  MD5

                                  c1fcf69c518a284901c8a59334c72299

                                  SHA1

                                  318ea9f1849ce3ecb1caedece571064275826c9c

                                  SHA256

                                  96fb10f560bb8cbc66d33e523cc3158ab33649ceb773faf8803693107d21e12a

                                  SHA512

                                  e2b6dab0496eb269645f6e7932e14b92b2d23d38133677f1e1636937d783a228f01d8affa92830a5c42e9fed53271d848eaa170e64ac8fb2da838b9e6259c382

                                  Download Submit

                                • C:\Windows\Installer\MSIA8F2.tmp
                                  Filesize

                                  171KB

                                  MD5

                                  cb48b56d733e4e923d368674b02b4459

                                  SHA1

                                  92362e400cc53c2729d3d97a753c2ef24cacf614

                                  SHA256

                                  3e3bcad00d145302e91c37c763144a37e694430b430527a440cc46c700c33f21

                                  SHA512

                                  aa89d1e61a318751f10a88802ad4713c7b708e8074acc0a2b80c4e763f53bcfbf712b27049ccf53c2f94a18be9ded082ef8206804b63195aac1e97c44cf97489

                                  Download Submit

                                • C:\Windows\Installer\MSIA941.tmp
                                  Filesize

                                  190KB

                                  MD5

                                  351e5c03e84f43ef17ecac2b77b8f7e1

                                  SHA1

                                  4d71bcb5cc3ff04add17245f9e2846398fecceb7

                                  SHA256

                                  5a1e53a4295f93005f2188d1bba6d61710193102cb5bd144e487c018988bb1bc

                                  SHA512

                                  eabcea3966fa320055e320b271b68dcb32df5af934cf43ca2dec76b2f255ffb781816739a92470a125b802a4e9cc7e907f581a5268b3745e84e3bf29a385dbd6

                                  Download Submit

                                • C:\Windows\Installer\MSIAAD0.tmp
                                  Filesize

                                  202KB

                                  MD5

                                  d773d9bd091e712df7560f576da53de8

                                  SHA1

                                  165cfbdce1811883360112441f7237b287cf0691

                                  SHA256

                                  e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7

                                  SHA512

                                  15a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd

                                  Download Submit

                                • memory/4120-15-0x0000000001300000-0x0000000001302000-memory.dmp

                                  Filesize

                                  8KB

                                  Download

                                • memory/4120-27-0x0000000002BC0000-0x0000000003C4E000-memory.dmp

                                  Filesize

                                  16.6MB

                                  Download

                                • memory/4120-26-0x0000000002BC0000-0x0000000003C4E000-memory.dmp

                                  Filesize

                                  16.6MB

                                  Download

                                • memory/4120-0-0x0000000002BC0000-0x0000000003C4E000-memory.dmp

                                  Filesize

                                  16.6MB

                                  Download

                                • memory/4120-25-0x0000000002BC0000-0x0000000003C4E000-memory.dmp

                                  Filesize

                                  16.6MB

                                  Download

                                • memory/4120-11-0x0000000001300000-0x0000000001302000-memory.dmp

                                  Filesize

                                  8KB

                                  Download

                                • memory/4120-12-0x00000000046A0000-0x00000000046A1000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/4120-230-0x0000000002BC0000-0x0000000003C4E000-memory.dmp

                                  Filesize

                                  16.6MB

                                  Download

                                • memory/4120-220-0x0000000002BC0000-0x0000000003C4E000-memory.dmp

                                  Filesize

                                  16.6MB

                                  Download

                                • memory/4120-62-0x0000000002BC0000-0x0000000003C4E000-memory.dmp

                                  Filesize

                                  16.6MB

                                  Download

                                • memory/4120-4777-0x0000000002BC0000-0x0000000003C4E000-memory.dmp

                                  Filesize

                                  16.6MB

                                  Download

                                • memory/4120-1-0x0000000000400000-0x0000000000D7D000-memory.dmp

                                  Filesize

                                  9.5MB

                                  Download

                                • memory/4120-7-0x0000000002BC0000-0x0000000003C4E000-memory.dmp

                                  Filesize

                                  16.6MB

                                  Download

                                • memory/4120-102-0x0000000002BC0000-0x0000000003C4E000-memory.dmp

                                  Filesize

                                  16.6MB

                                  Download

                                • memory/4120-9-0x0000000002BC0000-0x0000000003C4E000-memory.dmp

                                  Filesize

                                  16.6MB

                                  Download

                                • memory/4120-13-0x0000000002BC0000-0x0000000003C4E000-memory.dmp

                                  Filesize

                                  16.6MB

                                  Download

                                • memory/4120-16-0x0000000001300000-0x0000000001302000-memory.dmp

                                  Filesize

                                  8KB

                                  Download

                                • memory/4120-14-0x0000000002BC0000-0x0000000003C4E000-memory.dmp

                                  Filesize

                                  16.6MB

                                  Download

                                • memory/4120-8-0x0000000002BC0000-0x0000000003C4E000-memory.dmp

                                  Filesize

                                  16.6MB

                                  Download

                                • memory/4120-8837-0x0000000002BC0000-0x0000000003C4E000-memory.dmp

                                  Filesize

                                  16.6MB

                                  Download

                                • memory/4120-61-0x0000000002BC0000-0x0000000003C4E000-memory.dmp

                                  Filesize

                                  16.6MB

                                  Download

                                • memory/4120-3-0x0000000002BC0000-0x0000000003C4E000-memory.dmp

                                  Filesize

                                  16.6MB

                                  Download

                                • memory/4120-8856-0x0000000002BC0000-0x0000000003C4E000-memory.dmp

                                  Filesize

                                  16.6MB

                                  Download

                                • memory/4120-8868-0x0000000001300000-0x0000000001302000-memory.dmp

                                  Filesize

                                  8KB

                                  Download

                                • memory/4120-8859-0x0000000002BC0000-0x0000000003C4E000-memory.dmp

                                  Filesize

                                  16.6MB

                                  Download

                                • memory/4120-8875-0x0000000000400000-0x0000000000D7D000-memory.dmp

                                  Filesize

                                  9.5MB

                                  Download