7aad8cbd493b73e7b8c00c9bf519fc4bf0cffeac6116d0bc934b638183d95ebf

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cs16_fkuffixgod.exe
Size

183.3MB
MD5

d74e96c7c85f3371e5ab2cf158567708
SHA1

861e84b66466b96f1398ecedf0631d009375f5dd
SHA256

7aad8cbd493b73e7b8c00c9bf519fc4bf0cffeac6116d0bc934b638183d95ebf
SHA512

dd5404aff43ecde4724a71fae6f1235b64c3535b711df23b8a8446e41f211f2bb1e362e177891d9363fc2b62a94fe20e2e92fbaa35e8701109000f944dc3416f
SSDEEP

3145728:Sxf6x4JWv79BK1XIZ+Xz5MqBKDQ5FzQmQhKxnwlMIcwuJ3MF4a79YWhKt87+c:a6mJu9SXIZ2MqEc5VQPswuJcFr793Kyt

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Executes dropped EXE 7 IoCs

Processes:

cs16_fkuffixgod.tmphl.exehl.exehl.exehl.exehl.exehl.exe

pid process

2572 cs16_fkuffixgod.tmp
772 hl.exe
1532 hl.exe
580 hl.exe
1820 hl.exe
2556 hl.exe
2272 hl.exe

pid	process
2572	cs16_fkuffixgod.tmp
772	hl.exe
1532	hl.exe
580	hl.exe
1820	hl.exe
2556	hl.exe
2272	hl.exe

Loads dropped DLL 64 IoCs

Processes:

cs16_fkuffixgod.execs16_fkuffixgod.tmphl.exeWerFault.exehl.exeWerFault.exehl.exeWerFault.exehl.exeWerFault.exehl.exeWerFault.exehl.exeWerFault.exe

pid	process
1940	cs16_fkuffixgod.exe
2572	cs16_fkuffixgod.tmp
2572	cs16_fkuffixgod.tmp
2572	cs16_fkuffixgod.tmp
2572	cs16_fkuffixgod.tmp
2572	cs16_fkuffixgod.tmp
2572	cs16_fkuffixgod.tmp
2572	cs16_fkuffixgod.tmp
772	hl.exe
772	hl.exe
772	hl.exe
772	hl.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
1532	hl.exe
1532	hl.exe
1532	hl.exe
1532	hl.exe
2340	WerFault.exe
2340	WerFault.exe
2340	WerFault.exe
2340	WerFault.exe
2340	WerFault.exe
2340	WerFault.exe
2340	WerFault.exe
580	hl.exe
580	hl.exe
1404	WerFault.exe
1404	WerFault.exe
1404	WerFault.exe
1404	WerFault.exe
1404	WerFault.exe
1404	WerFault.exe
1404	WerFault.exe
1820	hl.exe
1820	hl.exe
832	WerFault.exe
832	WerFault.exe
832	WerFault.exe
832	WerFault.exe
832	WerFault.exe
832	WerFault.exe
832	WerFault.exe
2556	hl.exe
2556	hl.exe
2340	WerFault.exe
2340	WerFault.exe
2340	WerFault.exe
2340	WerFault.exe
2340	WerFault.exe
2340	WerFault.exe
2340	WerFault.exe
2272	hl.exe
2272	hl.exe
696	WerFault.exe
696	WerFault.exe
696	WerFault.exe
696	WerFault.exe
696	WerFault.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

hl.exehl.exe

description ioc process

File opened for modification \??\PhysicalDrive0 hl.exe
File opened for modification \??\PhysicalDrive0 hl.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\PhysicalDrive0	hl.exe
File opened for modification	\??\PhysicalDrive0	hl.exe

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3052	772	WerFault.exe	hl.exe
2340	1532	WerFault.exe	hl.exe
1404	580	WerFault.exe	hl.exe
832	1820	WerFault.exe	hl.exe
2340	2556	WerFault.exe	hl.exe
696	2272	WerFault.exe	hl.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

cs16_fkuffixgod.tmp

pid process

2572 cs16_fkuffixgod.tmp
2572 cs16_fkuffixgod.tmp
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

msdt.exemsdt.exe

pid process

2752 msdt.exe
1248 msdt.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

cs16_fkuffixgod.tmpmsdt.exemsdt.exemsdt.exe

pid process

2572 cs16_fkuffixgod.tmp
2752 msdt.exe
1008 msdt.exe
1248 msdt.exe

pid	process
2572	cs16_fkuffixgod.tmp
2572	cs16_fkuffixgod.tmp

pid	process
2752	msdt.exe
1248	msdt.exe

pid	process
2572	cs16_fkuffixgod.tmp
2752	msdt.exe
1008	msdt.exe
1248	msdt.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cs16_fkuffixgod.execs16_fkuffixgod.tmphl.exehl.exepcwrun.exesdiagnhost.execsc.execsc.execsc.exemsdt.exetaskeng.exehl.exe

description	pid	process	target process
PID 1940 wrote to memory of 2572	1940	cs16_fkuffixgod.exe	cs16_fkuffixgod.tmp
PID 1940 wrote to memory of 2572	1940	cs16_fkuffixgod.exe	cs16_fkuffixgod.tmp
PID 1940 wrote to memory of 2572	1940	cs16_fkuffixgod.exe	cs16_fkuffixgod.tmp
PID 1940 wrote to memory of 2572	1940	cs16_fkuffixgod.exe	cs16_fkuffixgod.tmp
PID 1940 wrote to memory of 2572	1940	cs16_fkuffixgod.exe	cs16_fkuffixgod.tmp
PID 1940 wrote to memory of 2572	1940	cs16_fkuffixgod.exe	cs16_fkuffixgod.tmp
PID 1940 wrote to memory of 2572	1940	cs16_fkuffixgod.exe	cs16_fkuffixgod.tmp
PID 2572 wrote to memory of 772	2572	cs16_fkuffixgod.tmp	hl.exe
PID 2572 wrote to memory of 772	2572	cs16_fkuffixgod.tmp	hl.exe
PID 2572 wrote to memory of 772	2572	cs16_fkuffixgod.tmp	hl.exe
PID 2572 wrote to memory of 772	2572	cs16_fkuffixgod.tmp	hl.exe
PID 772 wrote to memory of 3052	772	hl.exe	WerFault.exe
PID 772 wrote to memory of 3052	772	hl.exe	WerFault.exe
PID 772 wrote to memory of 3052	772	hl.exe	WerFault.exe
PID 772 wrote to memory of 3052	772	hl.exe	WerFault.exe
PID 1532 wrote to memory of 2340	1532	hl.exe	WerFault.exe
PID 1532 wrote to memory of 2340	1532	hl.exe	WerFault.exe
PID 1532 wrote to memory of 2340	1532	hl.exe	WerFault.exe
PID 1532 wrote to memory of 2340	1532	hl.exe	WerFault.exe
PID 2692 wrote to memory of 2752	2692	pcwrun.exe	msdt.exe
PID 2692 wrote to memory of 2752	2692	pcwrun.exe	msdt.exe
PID 2692 wrote to memory of 2752	2692	pcwrun.exe	msdt.exe
PID 240 wrote to memory of 1600	240	sdiagnhost.exe	csc.exe
PID 240 wrote to memory of 1600	240	sdiagnhost.exe	csc.exe
PID 240 wrote to memory of 1600	240	sdiagnhost.exe	csc.exe
PID 1600 wrote to memory of 2880	1600	csc.exe	cvtres.exe
PID 1600 wrote to memory of 2880	1600	csc.exe	cvtres.exe
PID 1600 wrote to memory of 2880	1600	csc.exe	cvtres.exe
PID 240 wrote to memory of 1128	240	sdiagnhost.exe	csc.exe
PID 240 wrote to memory of 1128	240	sdiagnhost.exe	csc.exe
PID 240 wrote to memory of 1128	240	sdiagnhost.exe	csc.exe
PID 1128 wrote to memory of 2656	1128	csc.exe	cvtres.exe
PID 1128 wrote to memory of 2656	1128	csc.exe	cvtres.exe
PID 1128 wrote to memory of 2656	1128	csc.exe	cvtres.exe
PID 240 wrote to memory of 2140	240	sdiagnhost.exe	csc.exe
PID 240 wrote to memory of 2140	240	sdiagnhost.exe	csc.exe
PID 240 wrote to memory of 2140	240	sdiagnhost.exe	csc.exe
PID 2140 wrote to memory of 1964	2140	csc.exe	cvtres.exe
PID 2140 wrote to memory of 1964	2140	csc.exe	cvtres.exe
PID 2140 wrote to memory of 1964	2140	csc.exe	cvtres.exe
PID 2752 wrote to memory of 2848	2752	msdt.exe	rundll32.exe
PID 2752 wrote to memory of 2848	2752	msdt.exe	rundll32.exe
PID 2752 wrote to memory of 2848	2752	msdt.exe	rundll32.exe
PID 1020 wrote to memory of 580	1020	taskeng.exe	hl.exe
PID 1020 wrote to memory of 580	1020	taskeng.exe	hl.exe
PID 1020 wrote to memory of 580	1020	taskeng.exe	hl.exe
PID 1020 wrote to memory of 580	1020	taskeng.exe	hl.exe
PID 1020 wrote to memory of 580	1020	taskeng.exe	hl.exe
PID 1020 wrote to memory of 580	1020	taskeng.exe	hl.exe
PID 1020 wrote to memory of 580	1020	taskeng.exe	hl.exe
PID 580 wrote to memory of 1404	580	hl.exe	WerFault.exe
PID 580 wrote to memory of 1404	580	hl.exe	WerFault.exe
PID 580 wrote to memory of 1404	580	hl.exe	WerFault.exe
PID 580 wrote to memory of 1404	580	hl.exe	WerFault.exe
PID 580 wrote to memory of 1404	580	hl.exe	WerFault.exe
PID 580 wrote to memory of 1404	580	hl.exe	WerFault.exe
PID 580 wrote to memory of 1404	580	hl.exe	WerFault.exe
PID 2752 wrote to memory of 2396	2752	msdt.exe	rundll32.exe
PID 2752 wrote to memory of 2396	2752	msdt.exe	rundll32.exe
PID 2752 wrote to memory of 2396	2752	msdt.exe	rundll32.exe
PID 1020 wrote to memory of 1820	1020	taskeng.exe	hl.exe
PID 1020 wrote to memory of 1820	1020	taskeng.exe	hl.exe
PID 1020 wrote to memory of 1820	1020	taskeng.exe	hl.exe
PID 1020 wrote to memory of 1820	1020	taskeng.exe	hl.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cs16_fkuffixgod.exe
"C:\Users\Admin\AppData\Local\Temp\cs16_fkuffixgod.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940

C:\Users\Admin\AppData\Local\Temp\is-5N68R.tmp\cs16_fkuffixgod.tmp
"C:\Users\Admin\AppData\Local\Temp\is-5N68R.tmp\cs16_fkuffixgod.tmp" /SL5="$4010A,191116524,780800,C:\Users\Admin\AppData\Local\Temp\cs16_fkuffixgod.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2572

C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\hl.exe
"C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\hl.exe" -game cstrike -steam -nojoy -noforcemparms -noforcemaccel -noforcemspd
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 160
4⤵
- Loads dropped DLL
- Program crash
PID:3052

C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\hl.exe
"C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\hl.exe" -game cstrike -steam -nojoy -noforcemparms -noforcemaccel -noforcemspd -stretchaspect -vsync 0
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 160
2⤵
- Loads dropped DLL
- Program crash
PID:2340

C:\Windows\system32\pcwrun.exe
C:\Windows\system32\pcwrun.exe "C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\hl.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2692

C:\Windows\System32\msdt.exe
C:\Windows\System32\msdt.exe -path C:\Windows\diagnostics\index\PCWDiagnostic.xml -af C:\Users\Admin\AppData\Local\Temp\PCW9C1.xml /skip TRUE
2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2752

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\system32\pcwutl.dll,CreateAndRunTask -path "C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\hl.exe"
3⤵
PID:2848

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\system32\pcwutl.dll,CreateAndRunTask -path "C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\hl.exe"
3⤵
PID:2396

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:240

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vbnscupq.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBE4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBE3.tmp"
3⤵
PID:2880

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\_p_ase4l.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC22.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC21.tmp"
3⤵
PID:2656

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5hkcqrf7.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:2140

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCCE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCCD.tmp"
3⤵
PID:1964

C:\Windows\system32\taskeng.exe
taskeng.exe {F4F7D6A5-35D9-4DE5-A41A-0014CAEC07BB} S-1-5-21-2248906074-2862704502-246302768-1000:GHPZRGFC\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1020

C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\hl.exe
"C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\hl.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 308
3⤵
- Loads dropped DLL
- Program crash
PID:1404

C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\hl.exe
"C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\hl.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 308
3⤵
- Loads dropped DLL
- Program crash
PID:832

C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\hl.exe
"C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\hl.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 308
3⤵
- Loads dropped DLL
- Program crash
PID:2340

C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\hl.exe
"C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\hl.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 308
3⤵
- Loads dropped DLL
- Program crash
PID:696

C:\Windows\system32\pcwrun.exe
C:\Windows\system32\pcwrun.exe "C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\hl.exe"
1⤵
PID:940

C:\Windows\System32\msdt.exe
C:\Windows\System32\msdt.exe -path C:\Windows\diagnostics\index\PCWDiagnostic.xml -af C:\Users\Admin\AppData\Local\Temp\PCW81FC.xml /skip TRUE
2⤵
- Suspicious use of FindShellTrayWindow
PID:1008

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
PID:1316

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pgz6bb2c.cmdline"
2⤵
PID:1832

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8325.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8324.tmp"
3⤵
PID:2720

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ebs0bqtj.cmdline"
2⤵
PID:2296

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8354.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8353.tmp"
3⤵
PID:2856

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nqcapeyb.cmdline"
2⤵
PID:1448

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES83A2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC83A1.tmp"
3⤵
PID:2688

C:\Windows\system32\pcwrun.exe
C:\Windows\system32\pcwrun.exe "C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\hl.exe"
1⤵
PID:2168

C:\Windows\System32\msdt.exe
C:\Windows\System32\msdt.exe -path C:\Windows\diagnostics\index\PCWDiagnostic.xml -af C:\Users\Admin\AppData\Local\Temp\PCW9DA6.xml /skip TRUE
2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1248

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\system32\pcwutl.dll,CreateAndRunTask -path "C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\hl.exe"
3⤵
PID:1968

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\system32\pcwutl.dll,CreateAndRunTask -path "C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\hl.exe"
3⤵
PID:2116

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
PID:1288

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\maciwifh.cmdline"
2⤵
PID:1568

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9EB0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9EAF.tmp"
3⤵
PID:1700

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\abr7g56x.cmdline"
2⤵
PID:680

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9ED0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9ECF.tmp"
3⤵
PID:2604

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2qtgwja_.cmdline"
2⤵
PID:924

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9F5C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9F5B.tmp"
3⤵
PID:2896

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\events\is-DU8AB.tmp
Filesize
9B

MD5
d14f11b47b92d829b6ec4912ca7349e8

SHA1
86b8dd77a055a3d1d154022492ed7d7e4ca371a5

SHA256
89a0f0c5f04ea6da99b4a48fb642b968d32350aa3e6697da24d2736b7bb195d0

SHA512
f19f860c86297921b972338dd0ee73241b3b822d1b9d977cee39e45891f1d57bf144cd676eb2e7e35985969613dff0896473dd8e89ad07c66e79ac94510fb5d7

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\events\is-HCFVH.tmp
Filesize
11B

MD5
e41aa21f57500b1b71802b76fcaaecd1

SHA1
554eaebf267f8aaceb4e9b18e28dfa5131168a09

SHA256
2092e6c9862b42fe817a552f0ecf05a58a2609b2424402404a796c325bdf2098

SHA512
4c2b2e183bb68c16b383532aa03d5dbaebebde35b843ff442b84f6c9dba655868e7e7ba76b5b92d003db1ac73ebdd2aed5933595b35d073c702b1e841d94269d

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\gfx\env\is-9JMQN.tmp
Filesize
192KB

MD5
9eda1bf021904ceaf1a8c50a76741eb5

SHA1
38f004101eb47ed0dffff757488263d9a2523bbf

SHA256
cdf4b2c96b5d1366fecdfa2aa764fcfc8d084bc5a682e2a10c41a03ed3ed3661

SHA512
aead546626ef7dc5a75348760b26f8e187a61b62c7a0a49bda16cf68b280749dfbc87974d05201dcefe6b4fd89401c3537b4f179f3ac5bda161066ae3ca0efbf

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\gfx\env\is-AVEMJ.tmp
Filesize
192KB

MD5
c38bb0b54ce5eea3e245025cd7b9ff0b

SHA1
4b2ff441f230f2cbea155439f78480d4911c9112

SHA256
44f4eba9530f325af32620ece28ebb4bf09939a0c7c521b12a6b303f00f0e980

SHA512
fd4a16643b8449c363e8bcc958029617ef3c2cb4a4b986eb16df97085e9aa186fac3e07d5a3a4cd900f965fa797995e10bd51685e79aa3578b2c41b612f0e2d1

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\gfx\env\is-N9R8C.tmp
Filesize
192KB

MD5
82159b1b20dd8db7bd6fffe8d64710b1

SHA1
0023227edcf08a4f70d2ecd9f33984a1a5bae8ba

SHA256
028d4eaa5f9c25e91379164b0aac23aec76096c98c9160d0e0259e9af4f420eb

SHA512
e60b3b86c6a93572184b66dfba3fe25f27acadfddcc6fc24bd0e167cf42e499d2a5ac545d327e8d2274e8f98d9e8eda4210275147d3bd396d4704ad8f8d69aa6

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\gfx\env\is-R2H2I.tmp
Filesize
192KB

MD5
16e28b462b8b30cc3df772122f041261

SHA1
48a47b2e2f77e85a73af50d3fb8e66ad657c6cf3

SHA256
f58a6c09b89e0603db514f2140130b69a4446a146eeb47b95777911c0b363311

SHA512
e38e48bae08a1db65e6bc40db4334d42f0395f5f5ee6c669d602db4cf279a7b422da061e880ea91f31c4bfb68b6e4b2f192cb862d8be26321188553b5bf4d3fc

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\gfx\env\is-SD5ML.tmp
Filesize
192KB

MD5
9abdaf730e8be5adfa3d88afd445b44e

SHA1
14272ef2db2ab8e400ba43b1628194bd85c45e6a

SHA256
649fd576106a89d3c8ed9ca93908bb653fb1d507660f759e7043516e69ae1a97

SHA512
a4080d52c7c981bfa4de0305f21eecb9542207331c514df2528577f68a76fce5908d4b5b16a0c390032ead272ad3ce81de54aac2178c1870ca2b5f0486272aff

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\gfx\env\is-SON9H.tmp
Filesize
192KB

MD5
ae02fbddf356215d83786620ef118346

SHA1
d0e55848f9ddf3dc763c1fcc02615220f5656dd4

SHA256
d3f3652958d139621d34e9bf50939deae4f684f4b3488a5a5231756f86d9a174

SHA512
80aa90ac19d88f8da80dfec9209651fa0b9d711c4688d6e0a45a9661726a2299430c8f76c68ed08b49dbdb2a62805a676f6d071cac082dced2e999fa5ea430c6

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\gfx\env\is-SS1B1.tmp
Filesize
192KB

MD5
5c1160ce07e09bf91965a2fba2f9d6fa

SHA1
982c035bcf50ac36f92361f2b2e9b9103c922b65

SHA256
f955db986f03d0106c72d3ae6677c6b55ab4ff21f3126aacac66cbe0a60dff90

SHA512
b1e561c9259646ecb8d9993f9ec0e9ecdae5d46009b213e4da749cd5fb57012a362189eac29f616fe7590bd3a39fb5a870b53480a615ab5f92bd245bc8078ff2

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\gfx\vgui\is-1NOFL.tmp
Filesize
128KB

MD5
13b3a5cf4af8f97cd8a8328ef9952b7f

SHA1
253105b008a8ce333a64f5a66e4b2da0e3a3cb52

SHA256
9d8e087dd823e63f7009907ff1761e620dc5ee64db6a527e2d0ec830d4152437

SHA512
77f76cb9bb4edadecce9bfcd05031e1def1f4b967b58d8078bb9e6c3b03e3db9917bd2a77314553fb8ee233981683e9b0bad5af30c094344350ad2a1dd034667

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\gfx\vgui\is-69F2T.tmp
Filesize
128KB

MD5
8c3ff438e747a73255ddb8c3ccbebbc2

SHA1
e81ddb67229feefece8cc5ff4d1b12c4b75cc103

SHA256
4a2460747b60d4b5843bf22a459f6c17f16a9664305b4b4bda182041a0fdebfa

SHA512
869270e4c6adbe4e914c07bc459a7858c50988ede0e75a02ce51a18080f9ba4bc4c483c4ee646e22fed948dafe388e7b908f58b09528b93eb1a87ef57a278b62

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\gfx\vgui\is-8H3HR.tmp
Filesize
128KB

MD5
1f10813901e2bd255a5ae21026de8b48

SHA1
03a1f78e07952f1876dd431ba4406b534435b920

SHA256
348584b23c63388045342dc0b79bdd37a8cff904a84215c386492e33273ab725

SHA512
b3fa7d1c675c4ae53ebc506d39234e166392bf6a0f6fa651b4c1a19240915f2423c9b150ccbe429159cebc0fa92135a9940cbfc8c79fa9fa3b353580f93342be

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\models\player\arctic\is-LV553.tmp
Filesize
1.1MB

MD5
3a115b7d2743109386037cfabb97a5a4

SHA1
64926d995fed7af71211119ece7382d1d671e198

SHA256
3641ece57a5c0d2237cdbf753db6912009938619100ef03a56cb4b61186daaca

SHA512
d2f3d22b6321aa5efc70603c6e042033afd134c783c39ba243c0e6e1ef5482688496dd4b2655c79ce449a9d4bddace888b6872e7594ce1e758222ede8e2b9cfc

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\models\player\gign\is-6IDGF.tmp
Filesize
1.1MB

MD5
0a1cf6972910632d127d8072804d8a89

SHA1
53bcafbb14c2f2da859add99b702ef989090d56c

SHA256
efcb7bcaa824155b07ee916e0dfdc85cb25975d9c43c9b229566caa048273c52

SHA512
60cadd3e041549cdc21f6b07e62c546ead9f50c6316a2996d1aef90fd78a93df9e9cc438264e3e6efb2c3f91541526191e2341692f0c09d4ae6d1ad004a65ffd

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\sound\weapons\csgo\glock\is-3PQ5V.tmp
Filesize
42KB

MD5
b63bd5d76405edb06844d8927d5d7012

SHA1
0619ceee3171db971bcd860890e82ca3da5d0e70

SHA256
1c275ebae5b11433df78cbbaedf5c4b274bb0a66be4261395317b2ec67c6ab0a

SHA512
6b8190dd3882a65408e1cc2f34a5b87f4db4bb5bf4500dee8264088f2e9bed564d2f4bb8626bf737675ec46f5fce87d07eec03bf3faaaa2a7c950a8780c4441e

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\sound\weapons\csgo\m4a1\is-03QFO.tmp
Filesize
17KB

MD5
a27875e420ae080821d7f05258de2dab

SHA1
94c1b16e5c7f34a3f380bffa6ff7a3cfde98c483

SHA256
ddde319a412d22adde606d59f0af3d836a723f88944f81b02ef5a7fd6d8cc293

SHA512
03d675234fcce2ec087f30b0607650ae70c6ea7bb5788e247b86cbc753d84bd63e97c5044aa22eaea229dada0359a90055c64973abe78855e4e2b5cfb1c75089

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\sound\weapons\csgo\m4a1\is-1V9ID.tmp
Filesize
44KB

MD5
c7fe57d235c454f45d4df5cc0a75f2d5

SHA1
704e4cb371f1abd53066969282c9b0b236acba67

SHA256
9b44213c38d5f2a452743d6a2c4096e634b54c4b25c0b54b2981b09ba14db166

SHA512
2aa1673d386c3a0d9bff27c8402e4014076f76a373903a70cab676840c1339e1e2a63254570f1c22d302c2d5ae46e8b112061027f3aec1648af1de3620e4afd5

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\sound\weapons\csgo\m4a1\is-4Q9A0.tmp
Filesize
16KB

MD5
3650a420a6bc816394b3ba37cce5db56

SHA1
5ad87617e2fdc8ebe2a538674bc4e49506044ea4

SHA256
e9d7c3286e459e99b4d3a3a962882d7eb0434b1cb2459dd1692f5bb491f979ea

SHA512
8ada186a6ee57a129e54569e982422ec81d6feffa7b280096affca2356ba667df75f56a7d8abcc2f33456de56ad60173197befa5091f58679c4fea282a5f3dc2

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\sound\weapons\csgo\m4a1\is-ADA9O.tmp
Filesize
16KB

MD5
dd3ad55e11a9731793969ee9891b6e46

SHA1
3f038952b62f932e08ab6e046ac1e3d3be1ce772

SHA256
18caf9c9a450cf4af1ef826718eb4a2fcfa8b569f09aa3f3fdacd1b69d20c4c5

SHA512
609ccd031bfd9ed755256dff694f4504097b8653cac023ff8cabff9e1b360263c5e46c3857d3a523a4a90ba097171676c61ac8c860539281d998c2cdc32f4352

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\sound\weapons\csgo\m4a1\is-JOBI0.tmp
Filesize
16KB

MD5
7c9c148a4fbf39098fc777b8cd161061

SHA1
15ee822e7ace7f1981dc23f0b4abeaaedd10fc09

SHA256
08c2bd3b1c835cb7026a684351e23c023218351461244a38fa044b32d96a3551

SHA512
3b294cb41d311ac073b221b21b908c9cca3053ae47229e1dc8c9acdcef30b590fb722dfc042d1d10fe3eec71da07398b26f3a0636e8b75c60961254c9cffaa6a

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\sound\weapons\csgo\nova\is-H4VRB.tmp
Filesize
31KB

MD5
d4481ee7745a7f7de59a1453fa5a6c5b

SHA1
344df601f8e7f6fb389db26e51ead3fc2bbee266

SHA256
578696d3c2892998fec0ef5bff30e217b9f333ba6a718a3090293ca21c3be03a

SHA512
b977d1a7ead53054ed6b63a64712993c5af2a3f3acf381dc080e2c20fa732b9fac43dbb74afea8c139e69b00a8e2d42e948305ca9e074edd23d839a9f6d3d05a

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\sound\weapons\is-KEQIJ.tmp
Filesize
10KB

MD5
7e7c4656f8ef80a72ef0d1e41317f511

SHA1
775a6ec4f092b3e8bcb59c21787ef33e9237ae48

SHA256
ffdaf0a862ce1f47615dc1ac59af868010796eeef50de895414c40a04da3680e

SHA512
a257ce57532a8497f8df5860ae08729c78f90477f0b96264f2f98dc31ee034ec2679ace4ddf1ed4ad14ba08170354fa00e984e2dae4a17491fb5f8b7e009391b

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\sound\weapons\is-NP9M3.tmp
Filesize
14KB

MD5
2876bbba2adae9cf3456ea95a2c0b546

SHA1
737a3eff26b380e189ada33a028f63d75b8f0e8a

SHA256
2ebbea31183105b5d305027e960bb89dc2e2582b81ba712b01b1851501b6092d

SHA512
5423d77697905521a1718b2209a7e29fc34c94f481bf093f2ea45c3c43eb9dfce38fc8c87802c221a1813c582b626fd84446540178cba918d8e021d1b4b5dcfb

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\sound\weapons\is-QR7F4.tmp
Filesize
7KB

MD5
3d352efef15d6f7019168991cff7cf32

SHA1
10030aa93a41d80b35d39e59dda86e4c164f1a5f

SHA256
616e07c58c0d3d332c3c7fe65c1b7e6ef49d5c26d09d8132d1e7c36c3899ea46

SHA512
bc51565450631d2954c0736c7899aa7111aa1584b0cd20ad239a765662d5935aec7fc7b33f3fcb2d43e5a69b1a9c9728a63a5a82134ee4dce7740cfa22e9480f

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\cstrike\sprites\is-UUBPJ.tmp
Filesize
361KB

MD5
324aa00f639ff5f9cef8797a1f862ceb

SHA1
38d8564d31e700625ef0ce35cb681f5a6a34e070

SHA256
aae249f31605fdf3773d0753764dd4865873dca48a58108579923af755122fe5

SHA512
d37195b2033c064cf1396e02f9e01f63399196c4de290b0630cb252bc54f9685be98431d0df3ab3c8239b9a585373ae21c224d04d713e20e2b4d21b1720ef34b

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\is-3QEO3.tmp
Filesize
84KB

MD5
2098ccf443433129b556c2849fe99e26

SHA1
074ddbaff48c88b3b5c8f881c35d2be2bb19a249

SHA256
4a899986a879ffd4b7e2d819c49b47cb362d849e86917da1f1931ef476b414af

SHA512
fb4dcfd5371c89af775367d9f2ba72bfd42f8b483ba31b0e839b66f065e5e7a1ec34bf4504aaad17e38502be6917f0b3e415add81dc84fc6942996c0a8f95a10

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\platform\Friends\is-ONBR0.tmp
Filesize
1KB

MD5
08091f474e938ea73aac90c9773a6013

SHA1
c4ff881bf1c3f0f0db3bd58f47d666df6a0ff885

SHA256
50443605d94d7bedbb03c2200d7cb7e98b0eaa91e3489cd7d77f69a407b73e0a

SHA512
7f569511d12a36fdcf6193aa52a2845b53f6d2a2e075426708f542f0012360a48cdc520ec6b26b0d1dd9f86c0ba41c8205483d340963aa0acfbaaca03a7ee0f5

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\platform\Steam\games\is-QGN5F.tmp
Filesize
1KB

MD5
200380f4259d09ec3f433e421cd5a55f

SHA1
9afc9cf71fd5949198b77bf7ec396a89058d6dee

SHA256
e136089e82c2d98a7283b55dcd93c5332a332149e7119d015bb7c353435ea9c6

SHA512
c77a433055077420eae1fcae302fc0738f592b8081ba2bdcae2015a3296672f1df2518934821d424e3a8c9535bf1891cbe7394c16ac68520099a3d7dfb4c50cf

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\valve\events\is-76SSA.tmp
Filesize
1KB

MD5
8cfcc0a84d0b6b51995ce17bc9f194f2

SHA1
f86d5edad7e5a3e2d994517da5ebd7d748a8c666

SHA256
2c7d43b8dc6ea01a32acddb7798b9dabf0ec44c7a6dcf75160539a7fe53e029d

SHA512
5f75243ff3e13b557859d89593432f5e29f014f2bc527bee363be3369e884feccb15ee593094c7eb0f8e4786b6a352cdf9fc6039636782cd23712cadc114ee1b

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\valve\gfx\vgui\fonts\is-7T09I.tmp
Filesize
40KB

MD5
910e7f920f59348e20f787d9240fe2a7

SHA1
9f85998b0a73efbf34b2e732942a0caada57925d

SHA256
93eba9e5ba94654d73d76944cb9860e4fe8db92a6c734fcbc57864cb766caf1d

SHA512
a19fad5b08875df9f16993d48562cc2cb4bf5d918b5f102b0439c6d6d6fdb862783762d586393b0e0b6c324de3c38c27fbf09d4b48c55affd44aad2c1ee9726d

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\valve\gfx\vgui\fonts\is-G038E.tmp
Filesize
24KB

MD5
07306c3fa68e4b5bb4fd4da515adfdc1

SHA1
ae0203c50a3ef107992d61f4b135efd6fdc809ba

SHA256
fad8e72511e03ea0b215e491da1ada731d7474a03d43c26a2f858c8fcee9beac

SHA512
d6d1b8f13d9263932f8757fed790dcbcdca681ca51a7581ca552631409b8c65de212436f8e161c60463edf8589067118d15537789e8aead85eeb156af5c29a7a

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\valve\gfx\vgui\fonts\is-IGV54.tmp
Filesize
44KB

MD5
ec8766ea06b999dab276c2ed85397067

SHA1
d043859519210810ab69bc4172406511b0391728

SHA256
dff807e488eee92c3f841de1f330bac00b42c36e34320e6335ed6e5d926243a8

SHA512
5b69d36450816306ba280d2690c65f7478b84a4b1d8eba37b8a4baf8631d767859599e1b20bcabb930dbb7ebbfd07d89bb3336c9999809c50e20fc0661cfb77c

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\valve\gfx\vgui\fonts\is-JPJGL.tmp
Filesize
27KB

MD5
8148e0f0a6679ced3ca04fd6c258d478

SHA1
9afc1daad5e004bb9481147ec5fac15693897f2c

SHA256
60946960e36a56fe17b02ab7c618e3ca0d61b7412acbb9967271ff309a76b5e0

SHA512
918c03891b46c645ff9b1a497a77bfee752befdbc2e82b882ca3d665dea21d3de1b112848ebb9b996b201c14bc14a70231838eece3df04a431becd0852417bed

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\valve\gfx\vgui\fonts\is-KAMHB.tmp
Filesize
34KB

MD5
46f3cc3d5ca0f0e80d30ec38a3ed9702

SHA1
2b7902e73522c60bb4e5a6d7905f91967ec54b46

SHA256
824ad8824e4d05319556d9c08dd0d4c90fecd6150a0dbcae8c946740cb4e2c56

SHA512
9f85b11a9479af47963155fc823a9390794b3db05fb50011efaa87e1adcf772d18fdc1bd57f3ca556ded84d5fc5671236ee0705043771c83663612cd2b0f16d3

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\valve\gfx\vgui\fonts\is-LGUMT.tmp
Filesize
24KB

MD5
ebc1b6a271bf99cdadc78dae5e9a29c4

SHA1
afddb10163d0cacf30f7a2e9f9e4f534c8425586

SHA256
3988ddbea3e6fd927933a698d28d66572d51e59938ea16624f644afe2021818d

SHA512
ccbc9f59f59c46187954d5e8a70513542471a40e8653f59c8d58279777c9c378f2e1891c4949d8d5b104117410e991f756d768932fd5353dfcbdca3c37d6ac1a

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\valve\gfx\vgui\fonts\is-SODUM.tmp
Filesize
45KB

MD5
d3d6c70dd23590745a0f691c28f88848

SHA1
b46b4a8427c59e590f8adace2ab659da2f4f4e9d

SHA256
f472485bdddb0f7acdce7ba6dfb1520dfdab6b2e870b37f77f61714533c5fe79

SHA512
06a400b5462c9a307bb281cf725358a8bc64a27e34b5f6b95748d3006703e66c4a756ad86fc5e2de9c2a2eba534921234fc2ec422b6107ef7264f7344a258a92

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\valve\gfx\vgui\fonts\is-TI50V.tmp
Filesize
33KB

MD5
bca82506d597eed9b5507ff7ba16567b

SHA1
55ad94cc92b95ce8e2adf62df94a6a8244980e8f

SHA256
4eb392f4136f1a4b255ab26772947e62b80615ca8b1ccea93563c3f33539a8bd

SHA512
e817036968d39d3f86c2f6f241c6f80756bf139a700adf018feb870542331b230cad6369652eb2a26b26e94b14c3e27dc0112d3ccd1c512f73e8b056ddeb12fc

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\valve\gfx\vgui\is-6ASAS.tmp
Filesize
1KB

MD5
1926ecbcf1b403f0c4a30426ea74276c

SHA1
24d8e0d5f3477f85e76985a0fc579e392482c402

SHA256
99986396ea8ebd9ab4eb1221b52db2a8a024e67c748e0b8080d8dad24e4e9cd2

SHA512
8e944a0304620fb7428acbe883049167c0bc1596d8f294b1ebcb383899e6881c5e54221ea5a60fa7c14210e5cfd91831a8481020608c22747f43c2f9d7e45060

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\valve\gfx\vgui\is-JI04M.tmp
Filesize
2KB

MD5
6deae390d10e5faef07cb793138a4ea2

SHA1
0e1b89e5e5e61f5e8959d3d6e17fc874f3d14a8e

SHA256
1efacc8931f4e6558fc9f854527e25e004d8c3fd90f1f5209273236924a9241b

SHA512
70c1ab592e46440f759ffdaa2ba1bbb9206212670762fbdbeb04f85da2304120e0a052ea4164fc0e0326e82c013924d0db0ea27fc21041489fc6d6d69b69d93a

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\valve\is-7MGG8.tmp
Filesize
4KB

MD5
f02c1d45a1a86f5d60ce9e310e24d144

SHA1
d991f95d96e1c76d2acb944bb09447628cd96caa

SHA256
01491c012c29f4706f0cc8f1117eb0f882b54f720bfbf320a3271ffac6c929dc

SHA512
88dafe4039264818c4193f563376db890ecea2f8f67df7902dd76aacd08be4cb47197257d02217eeec1a81295615b30b89e91d097837193a8fb64e72d03d7334

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\valve\models\is-E3FOE.tmp
Filesize
3KB

MD5
ab9f1bf1f7d14ca0032df954e1dd5212

SHA1
d51ab73cb33e1737b86ea0bf6db28aa895bb86ab

SHA256
748e6fb4465843238519d56774643c2d4fb3f77131ba49ee9ca2d700c42acb70

SHA512
c5dcb61363551755beaa4732a21ec870c9b077a44eb0e810029f056a7c89b7be4d6e2d4e48b860a4eedc707d057ba55b2b45c238cf4a99ec167a1c07686710bb

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\valve\models\is-Q28PS.tmp
Filesize
22KB

MD5
5f394d005ec12f63949d0c6a62c1b7b3

SHA1
957d1d0598c7bd0079db345db2006d8e4b755096

SHA256
47b5e88f5cc25627e8dc76b85eb6ad64d8613b00838d0cca6a85f118af81c7b0

SHA512
c51142a1e7902d720154378a7b8e01808fb4683e5a12c77516fa474b4eb05c0d2cc37aaf1b3b0a33757aecdc9ff8008333df66ed0e254b01cb5640b8646e6fb7

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\valve\sound\plats\is-8TVSQ.tmp
Filesize
1KB

MD5
811989e09124f54cb27fe6154b0f1018

SHA1
90c22fc3b248588e2d9759e6ef395303a86b7b60

SHA256
5271b9aa2961809f47fadecb693be2eebde2dbed62fbc4f5f4889fcd8c4a65f8

SHA512
560d26fdbec34ab687e40b8be6144b0f586449bd3a0eaf286ab972ad60b1eb1fe002649daacad36039a298ad24aae96e3531404ac2d0d7b0b47e194b8169e18b

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\valve\sound\vox\is-GR4QV.tmp
Filesize
2KB

MD5
299c3e28a49757ecab2e84ca9b220e62

SHA1
850cbc182e7000b6caa8b6af9986161a2554dbce

SHA256
0ffbcdb3466691fbc1043c69abe50434df646f997c52856a509de43cae501eee

SHA512
2caa0f84686df85905b355107ce2d50c1b8b6debadc50d49327330855e3ed2cea05768c1394cec746ddf90f7087a08ff98eda51272f89d7450923a5e41a13bf8

Download Submit
C:\Games\Counter-Strike 1.6 от FKUFFIXGOD\valve\sprites\is-HARLS.tmp
Filesize
4KB

MD5
30c0c19f5c5226225ac3959dfe1f1428

SHA1
5c7be5173586da26dd730a790a151b8a16611106

SHA256
5603d52c5f089950f372e2b00845738746abebaa2796b0b3e2f6d8d2f4111760

SHA512
c71799d84798c2e2a82dbde7ffa5a2c8698eaac615e77d337de7dafc9239c4b59bc2794b2ccd5740d3e19957549257bcd468660d0696f09fdca37485150c233b

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\733862231\2024052519.000\PCW.0.debugreport.xml
Filesize
3KB

MD5
6c2aec080469087f61e374457a4471cf

SHA1
61bcb292d22e02cd5fd97e78aed603b467491032

SHA256
00b9e8936fc284f07264130dcd98ff87735e610e2e10547b023d5715a18ee926

SHA512
59dd7f7d5807157de2ccd284a35436a25cd229bab24977241bc61a7ebb256695a6d5498a248979e0bbc65a75dd98c3da142e64b9fea000bc7dd04a1e06f2e748

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\733862231\2024052519.001\PCW.0.debugreport.xml
Filesize
3KB

MD5
f6586db8c2d120a688eb3fd3c4ce71fd

SHA1
9f4cc43a9b5ebdf96279cf16fede2161c76a0281

SHA256
b8fd5ff630e3e7b326753026623ea7bb489346473f9fbfa372efc0343881516d

SHA512
98441d15ab9b6426703a09ed955d46ef1fcc1739e8f55d63d5aa0485cc1f5ddc8f1afea8fc49a435a8aaf0ccf0f5e24a8d222cba970a4b311ccd7a0e3af0d1ae

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\733862231\2024052519.002\PCW.0.debugreport.xml
Filesize
3KB

MD5
7cfacf3b7f4268ed7358e1a17ee745fb

SHA1
c519edd8797c3a8a77db81b0d7b91daba68fbdaa

SHA256
c08068a9694c0d5d247a06262da3cc8c18aa288bfdf0f9a7b915e1c6d5ced43a

SHA512
0e5b98e07a12858d4060b42bb42d26d57f67966421bf0d2bc5726422e16b451c75f5364231f236987adbb55fadcc0e0538c025db0e4d7d1df2af47cc5c02cdc5

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\733862231\2024052519.002\results.xml
Filesize
573B

MD5
e8e86a4292c53c0513e9743b61b016dd

SHA1
330da8f78956fc00e2cdc2ba173eaa3baf3df0bd

SHA256
8b565e123eb1567177661245a00b242073108f096edcd0f0aadab76e6cb058e8

SHA512
0b119fdac8952dfed0bfc2824be029b211a5b7b98c1d483954177929ab95c9558014fa3f987999aba231cd0c8145191d195d02adb7271135f3b726d3c603c7dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\5hkcqrf7.dll
Filesize
6KB

MD5
de0db2f58bba6d6193654dd3796049e0

SHA1
1a6ab5e139a794dc227d75fbf284afc554b4b80b

SHA256
15eee8d161ee02cdb8f59068f0f22c47551524d7de8da096f98bc4b5192b8743

SHA512
13c4e6e853f639d86648a477f792eeb397829a94542748ec4d8a1ce7d917d2ab9240e4df361c9c28c8b6f31fbe7622077d5858bf4bf010d3f99a6b68f0d529e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\5hkcqrf7.pdb
Filesize
15KB

MD5
0f4729426cd2aaa12a70161f4fb865fa

SHA1
377bdd9a08da0e55d9a2aef64bd2780128792f51

SHA256
c5721e387b3e6f21a5fe1ab24b451b48fcf795573676d61a4044a7790ff61086

SHA512
7f4a64d050a06bffa26f98b2b931f336d5d4333f3bedeecf02cde7eebad9da2ed02176b9d231de009185258ab25da27060ece2b5d933d0f3cab2c75d3fd71bc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\PCW9C1.xml
Filesize
736B

MD5
0e471b895396f6c48d5c82f932f57a03

SHA1
ae0565e2ba79938a1df9deff3db092c9f1f147c7

SHA256
d4144a193b973081d2dafe1f960b64db54a0d10c73cfac3080da228ee6e6edc4

SHA512
57fa7dab8e721c83a1a8dd56d11a83e0582d79eef8326a2439b3d2671e9c262ba0ee8f3dba2abf7183def25a8a9e3e62fe9b2d4a9303c30140fecef9ad8d1099

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBE4.tmp
Filesize
1KB

MD5
b720d498d784c5f0b9cdd9ed9e2be071

SHA1
70c2323f9fbb59bb28036ddf998aa1046043c453

SHA256
41450a2861adf4bf7ef2d1017c77c3d8cfa9ac47b82d12165d046d67befc4ff9

SHA512
1221d2bfff54c73ca60cab317e69cfc39abd5880a4cb2bcde86a21bd5637435739c47d4dc03b3fb899425030ed77ae792ad9e37318b6745b4ded5acc43fc40c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC22.tmp
Filesize
1KB

MD5
f4010a8df591091a3999a5b17c01f003

SHA1
d39bea2a6b15466c54338ef87c041cc77d9f6567

SHA256
9f5801012f346faacb6362fc7d32929cd26b14ca26f6483c5f240a9a4fe1d367

SHA512
3e20767b9ddb48a680b0bf9a96eb7c9bb59d60fd583f251e25743805609526e83b9bf58c78ed12c2b4853d4533d2dd5f151ebade96b6e3b6cf55fe56c4db7204

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESCCE.tmp
Filesize
1KB

MD5
0cf27679753cda0436c09e59f0e3ad46

SHA1
12371b4f1f6764a65c151d1032d350635b2f5219

SHA256
e38c64a1fc9c00638e46cdfe898a4d1d4a5dcfd198ea0979c00b210d1614e346

SHA512
bc5a1a0ff5846508aa67371e9cd7efdb6579d1935700844149252783d04d83ad1be2faec665c526319b98f1ea9d412d8f9c9f2f595d779250c4655b5c3a3c77e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_p_ase4l.dll
Filesize
4KB

MD5
c49487c2fca7fc8456fd94df06480af1

SHA1
eddd196851244cb05a7869a011ac0d138e66d9b7

SHA256
ced0d468aaae20a6ebf9d1fcbc7387c2eb14ff2d3fb037d87990185fa2fbdb33

SHA512
e7bb4fe0d7736d075417dca015ee64fa95fa7cba3b23376027f6882418e3a9d4fc0b8f9df1c13ddf8d1ec112f29b9c3bebba833d1b2278ea5ba5a860bd14ca63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_p_ase4l.pdb
Filesize
11KB

MD5
e8c19a268af46c3ff04b89b13081f81f

SHA1
612f6ba9e01ac8702bf25d470d639e39ab899ee5

SHA256
fe43568b9a2563f39183c180f08017befca059928d89f6b3922a0d1154040cae

SHA512
259b33da7218c0165c93877d931af413a95a5a038c8b76e079b2de2d1fd1f350e36d65bc32dde195a254221ab6705eee74036e9b7c76a536dfafe018fae07e94

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbnscupq.dll
Filesize
4KB

MD5
873c40aa8131f8e7551bd94267ae042d

SHA1
a00dd8c141a152fb4b5b1d155c1a5babf9a0313e

SHA256
50d315e0474871bee7566762d7a6e864a05f1429a7a435b7857f0d552abfbbb8

SHA512
5f0dc48e5f3a4da7bba496784c99d740503d559c314d8a38092a492115388e6a798884dc0e1b5fa2a2c571e4621cb61033373acec001f204c23ffd932da8f6fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbnscupq.pdb
Filesize
11KB

MD5
ac52520ca0bd16932afa07844251a435

SHA1
6c625ffe71a827a98bc7fdeb419f3cb82e57ef71

SHA256
8d1bb1f9746dfd54e4602912be29c02f96787701ba626d0cf5d8023378539a53

SHA512
21d6413e947d6735dc15b5e19e004b7ec2d6f2e962a6e02eac5c2f66acb88c9de540096ffa4762302c82056b5f6c5dfca9689f593e0e90b48021c770a3a50afa

Download Submit
C:\Windows\TEMP\SDIAG_0d5e5d8c-c847-4b2d-996a-069ecbbeaf34\RS_ProgramCompatibilityWizard.ps1
Filesize
37KB

MD5
367fe5f4c6db87e1600f46687e5aac54

SHA1
9807dc03ea1ecf6ab12f36feec43e2a635ebe145

SHA256
177625ac9b07bbffcbbb47101c2d1121f47b03b42226861bfd7974b9cebc0c98

SHA512
694e1a2c2c508aa6105872d867981431ef895834703ab498c2483630a97a46cbc1ecff9a62857fbebeb85cf2ef9c4dc51e4b6f20cf74c65c1b67f68acabfa303

Download Submit
C:\Windows\TEMP\SDIAG_0d5e5d8c-c847-4b2d-996a-069ecbbeaf34\TS_ProgramCompatibilityWizard.ps1
Filesize
9KB

MD5
46e22c2582b54be56d80d7a79fec9bb5

SHA1
604fac637a35f60f5c89d1367c695feb68255ccd

SHA256
459af2960b08e848573d45a7350223657adb2115f24a3c37e69ffe61dea647f9

SHA512
a9a24df3fb391738405d2ea32cd3ef8657d8d00d7366858a39c624dc9ebbf0b64d2817355d41eed6ad3cc7703d264d2921c8a2590ff95601d89f3cca72ba786f

Download Submit
C:\Windows\TEMP\SDIAG_0d5e5d8c-c847-4b2d-996a-069ecbbeaf34\en-US\CL_LocalizationData.psd1
Filesize
6KB

MD5
5e03d8afb0fae97904a14d6b2d1cac9a

SHA1
78f401b1944ed92965d7a48dba036413688f949a

SHA256
538a5f22a12b0be59a7a83e0381c6ff661932f07643a87c2d3a542eade741671

SHA512
884c0494728dd9f1a4fc8092152b2253350304b745d6fc1e4b02c9cd2366bc8c92a169c549cd77bcd67e5e2e515d89d46c1d11de5eeb500d531d87839365cd19

Download Submit
C:\Windows\Temp\SDIAG_0d5e5d8c-c847-4b2d-996a-069ecbbeaf34\DiagPackage.dll
Filesize
64KB

MD5
e382ec1c184e7d7d6da1e0b3eacfa84b

SHA1
9a0d95eb339774874f4f0da35d10fd326438b56c

SHA256
786d95dc0d59089e14055385cce8765888f55236b5220fdfd28cf2d9b07e63ee

SHA512
019bcb4f41b5bc5853db2fa528ef126e839c5b0d0dc096dd441ba02d8c71e7913efd16b74aed93952ad2cc5422b151c12d3017fc22a65ae5ce2e7e1fc72a396c

Download Submit
C:\Windows\Temp\SDIAG_0d5e5d8c-c847-4b2d-996a-069ecbbeaf34\en-US\DiagPackage.dll.mui
Filesize
8KB

MD5
526bcf713fe4662e9f8a245a3a57048f

SHA1
cf0593c3a973495c395bbce779aef8764719abf7

SHA256
c8190f45d62c5c03013ffc66b3f9bf60f52a32464fa271d2fad5fd10432da606

SHA512
df7e93617461c2fd25b5b684311126e66b7cf9f1ecfbf4c8a944f65fb2c904194ec635a9c7b962d4583ea77b0312435c7dc1b5ecbcb1fb3a5a74fc1eb2c21d04

Download Submit
C:\Windows\Temp\SDIAG_335af1ff-d975-414b-8a18-57e5a17bc173\DiagPackage.diagpkg
Filesize
22KB

MD5
18a906a43c1c3e27064db30c81505234

SHA1
fb1c8e3a4e05eab079c6c4e64de989826242b798

SHA256
041430d1f0ae14300c46bdcd917c882f4850da3d6010e3fbf692023655bc406e

SHA512
8f821c0110f26e9a418157ead1d0e4afece6765cd41de9f73adec73bf818cfa5b5fb35895d5c572c855439358519df2b5dc64bf943bf7cb9f3fa6e0a37139b5d

Download Submit
C:\Windows\Temp\SDIAG_335af1ff-d975-414b-8a18-57e5a17bc173\result\results.xsl
Filesize
47KB

MD5
310e1da2344ba6ca96666fb639840ea9

SHA1
e8694edf9ee68782aa1de05470b884cc1a0e1ded

SHA256
67401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c

SHA512
62ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5hkcqrf7.0.cs
Filesize
5KB

MD5
252f38959fe104203e386334ad7affc2

SHA1
2c8d8a8f2952d79afbb9f1c39407aed139a6ca60

SHA256
32d6b5a428a39416d88b77bcb7569c68ece04d78805ee8200275ba37b4648216

SHA512
7a7cb397908f0b68255f44d13b56f24b98566445f48f609c04093e9f319b3b1e06df22a5a0783faa59c12e221d3597a8a950d1c10f5a3502ddb091ebdd362421

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5hkcqrf7.cmdline
Filesize
309B

MD5
8ad27e0ffec47cbbe356d2e87a0c047e

SHA1
7674ef622bbb76ac468cf23d78a4e89276d70d8c

SHA256
714535e12684ae0187d113b680961d6d19261e548e6a965f7017d606d907939a

SHA512
3d14a03fbf1821d3e41fa96c5969a20178240b3ecd46e03311aa0da3698abfd71732bc0dd418f9e62729a06e17f796cfad5c41f4e17a3443e88d525233249c15

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCBE3.tmp
Filesize
652B

MD5
f8d9e8877f0c8df3558c50e9449ab7d8

SHA1
56bf6995e2bc10347b0dc4306fac6fc1be8cd9fc

SHA256
eba58fb1acff828df74ba8441b36d7e83151456c72d886a4c6f103083e526c9f

SHA512
35e3dbf0c16303eb6f53f30da4d6f9572d25e60436fdbabb1dcce911983a818d1ec9a631c02376dcaf625d6a525ede87c746a621ad5cfddcb56a85552948b140

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCC21.tmp
Filesize
652B

MD5
2a009e559a43f36800db06c2adf4e587

SHA1
42647d5838b27e68f78b973504371cf4ae208ea8

SHA256
07889cce7f8f28e14f4b08497e4f73df9de76557115e12082cbe41743883022d

SHA512
d746668934992164003967b0663200cc5926a263b95dfa0b812b60da05b026858985580cfb194a502a7dea39d0e9effd7988ec3e5e81c438a743d828bac19b0c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCCCD.tmp
Filesize
652B

MD5
b8eec5e709ed6246fee1300dee360587

SHA1
f83d26206d319cc3e6d6ce0412aedaa211f00888

SHA256
2bb498f17e07c7e9727e584fec73e92cea12ecc128491577e6a5b47d0c18d9e1

SHA512
ce2ee305cab5c41b0742f4346c23f8bdf18bd7b472fc8fcb9eba2f629c266a889d86266713d917ca0590cfcb652fcbd5d04bcef95b1d3e803ab55f365ff23571

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\_p_ase4l.0.cs
Filesize
791B

MD5
3880de647b10555a534f34d5071fe461

SHA1
38b108ee6ea0f177b5dd52343e2ed74ca6134ca1

SHA256
f73390c091cd7e45dac07c22b26bf667054eacda31119513505390529744e15e

SHA512
2bf0a33982ade10ad49b368d313866677bca13074cd988e193b54ab0e1f507116d8218603b62b4e0561f481e8e7e72bdcda31259894552f1e3677627c12a9969

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\_p_ase4l.cmdline
Filesize
309B

MD5
888d9ab4630469ca693575735813a877

SHA1
69d0dcd3a5801ba2d81b0b3f2819d512fdc7273c

SHA256
61f91217d3973171a9506545f531f675cf4053b228e63b4fafee3e0ed8294d87

SHA512
bb850dd98feb6a777593f88bd77a6744599edf7541f51d19c4ba15dcdb217de0e18a9a4f20e064706e057f7b6e9cc62bdaedb3852e4eb3ef4cbb51315f64e447

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vbnscupq.0.cs
Filesize
965B

MD5
b0dc59b099ca7c12fb8ad72d3c50c82c

SHA1
f19e28849921cf51e322824c5a8ae8bc00014cd1

SHA256
e75eaaa3d7908fb05000c0a957048d20091a0d2575e87d091d11cdb3a5b562e5

SHA512
852c937d36afe3b6df5826b9f1877d511259e2a0ffcdf229c8c655ced7346b36e526928537386121e3ecbc8b1285144dabe3b760db1873cb3baaf70a0f21c364

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vbnscupq.cmdline
Filesize
309B

MD5
ff68f6796a18161d0a08979aea19f1cc

SHA1
894fc272413a441f537352d6b6516cb5a7b358bb

SHA256
71f0fe192860ac301be7139ae773f68fc0bd1a00d73b228f84b625e9c9e2f79c

SHA512
c8d31260a8c5c10f51dea6ca8772a504883d04293c1a5b0b4caa443007b7d350e0a5dd19c7ffb305e32a12f38bef096b7ee4be66e45a32f6cb8fbf81b4785a37

Download Submit
\Games\Counter-Strike 1.6 от FKUFFIXGOD\00.dll
Filesize
40KB

MD5
e1cd35bbc28f73b7481e8835ee0f0b13

SHA1
ef40d489c61b178b54f8116548662ee876e0133f

SHA256
6ecef9ef0f62491d595b2f32c69b53c53a1b3a8a7c9dea39d56c6861f5b93bdf

SHA512
baf6f9063f95e6d699088ec4c0611825e030382ff913084feb7f913cc8f011d079b6c7143359391d8e30a5e26ac5a5358882b20e3ac31c5afdbe8867ff6f62a3

Download Submit
\Games\Counter-Strike 1.6 от FKUFFIXGOD\FileSystem_Steam.dll
Filesize
120KB

MD5
18d55998df6a48193499f859f8bfebd9

SHA1
1ee59996d6ca8eec43caa7488bcec58c7d4ba5f3

SHA256
dc9bfd575a29abbe1d542ce41143f388cd56b2280f25af64c1699b43a04c1125

SHA512
b3818e7fea8d2042466774ecd9c8f2bee6444ecfb0f7f56e73e9c9854c5360969de39501e5439bc50dc894aafe5113ea1001d67280e267b024c6ccfc567261c0

Download Submit
\Games\Counter-Strike 1.6 от FKUFFIXGOD\Steam.dll
Filesize
322KB

MD5
6dff7c2a6859119f21f4377a9eaabbf2

SHA1
bae8ee28f0402aae039fb5b86a7992f3109d1985

SHA256
a75c2d50e3cdde61ea91b3b69bdca444511a562fe0b341b18aa8548ece1ac81d

SHA512
e8e2b5bd4e51fdef62f78784ce3ae4208c831d0892a6d2102b7a78f33eb62ff6b018ab5061e8f45c8186673bcc5e1c47a7edf7f943df24657019495f8074e1fb

Download Submit
\Games\Counter-Strike 1.6 от FKUFFIXGOD\Steam_api.dll
Filesize
65KB

MD5
994f375d4079a22991cfdfa616a787dd

SHA1
201d16e91aaa51c8d55e601f86a28d3fd17ab6d2

SHA256
876bf154fdb3a4e898698cf516e457dd30dec5dc048f9ca44243c92f33576b43

SHA512
6801857ce8e1440328e7e9cdd0681efc6f9aef208d09b77b8d776d5dcd4a9ea424b12b79c707ca4f0b601dfabbdbf5515f7ccd04a0ad3f78f779febed98eab9b

Download Submit
\Games\Counter-Strike 1.6 от FKUFFIXGOD\steamclient.dll
Filesize
383KB

MD5
ab3d3c7bc52a08ca365792d385d33577

SHA1
3ff1182fa8d4275a79d0dc189582ae4eac4b17bc

SHA256
56058c77c14a25e31c79eb68aef1bc3d8ad95d461b659b161d667fe8f2f96f37

SHA512
c88871146467e8eec6d4acf84d332e8dd7ef1faaad0584a89929a242fea78e81db767f4eb420e2cf8f7c79ac901834217bb26f74fbf1b23bb137c13352df3602

Download Submit
\Games\Counter-Strike 1.6 от FKUFFIXGOD\valve\cl_dlls\GameUI.dll
Filesize
825KB

MD5
39c8eaf35244db941ed6ad1ff05cd82f

SHA1
32cd0568d6a34d59d0323bef4696e336e8626ff2

SHA256
03030fd2e1a470ae28eee4db1120a74c4b9f00c97113ef260aebc3a67e570f9f

SHA512
543802d27f16128f90166107e1933df4788f5743951e0dbef9bd8cfa292224c63bbeab8604d79f0aec14a35dd9655d57bac178421a073e76d2431b951b0cd798

Download Submit
\Users\Admin\AppData\Local\Temp\is-5N68R.tmp\cs16_fkuffixgod.tmp
Filesize
3.0MB

MD5
017563c29d4ac7ff9b61d735cf805e06

SHA1
2e18130252d4703c47633b9110b798c8f83e6249

SHA256
fa9f45aca6aedf2ad519fd6ef655f72c6e4837f42554a4dd60dcfd4941b4e064

SHA512
1942d6ed9a2a3b9603507dcd068653389617db35ca513519d37ac6650e2dd9d3ee91f9f5299301278fb4893ad9798328762d2f64da58ea8fc5776c4dc61ace2e

Download Submit
memory/240-11358-0x000000001B300000-0x000000001B308000-memory.dmp

Filesize
32KB

Download
memory/240-11342-0x000000001B0F0000-0x000000001B0F8000-memory.dmp

Filesize
32KB

Download
memory/240-11375-0x000000001B320000-0x000000001B328000-memory.dmp

Filesize
32KB

Download
memory/772-11194-0x0000000000230000-0x0000000000245000-memory.dmp

Filesize
84KB

Download
memory/1288-11706-0x000000001B1E0000-0x000000001B1E8000-memory.dmp

Filesize
32KB

Download
memory/1288-11696-0x0000000002970000-0x0000000002978000-memory.dmp

Filesize
32KB

Download
memory/1288-11716-0x000000001B2A0000-0x000000001B2A8000-memory.dmp

Filesize
32KB

Download
memory/1316-11528-0x00000000023B0000-0x00000000023B8000-memory.dmp

Filesize
32KB

Download
memory/1316-11538-0x00000000023C0000-0x00000000023C8000-memory.dmp

Filesize
32KB

Download
memory/1316-11548-0x00000000023E0000-0x00000000023E8000-memory.dmp

Filesize
32KB

Download
memory/1940-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/1940-0-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1940-496-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1940-11204-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2572-11175-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2572-8-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2572-6656-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2572-11203-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2572-497-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/2572-5839-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads