400d369932fb22d062fec4558547b2b36459b90ebf418522b5bd79ec726b04bd

Analysis

max time kernel
144s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2025 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

F-M-E_v2/F-M-Е_v2.exe
Size

1.2MB
MD5

9e1ea15e3c048ed96c22a8e50bf83b8b
SHA1

071a3420cf14fcb1ff96e33daa64f60ee92ac1e6
SHA256

699050ce6a9803d066b0d5206dc946c1c54ae8ebc6e9bc7fa18836e9dc8ce46e
SHA512

2c397b0f2d677e7d63ca607a72f85c5368dfbf8bb2036eec4ce53e597e8598972700ccd267de0696b40d0da5a99579ac3e7db5873c146b10cd22e75d0cc70afd
SSDEEP

24576:acVkKSRXajM/0IV5diCURXnWvxxMiGh5Sq7Ttz8J:acBYXa+0kYCkn4giGhZvtz8J

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	F-M-Е_v2.exe

Executes dropped EXE 5 IoCs

pid	Process
2976	u0Y4ZfNbjZ4PNDNB5.exe
1980	AutoHotkey.exe
2204	fkfkkffkfkfkkf
2972	file.exe
3556	file.exe

Loads dropped DLL 2 IoCs

pid	Process
2204	fkfkkffkfkfkkf
2204	fkfkkffkfkfkkf

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
15	raw.githubusercontent.com
16	raw.githubusercontent.com
19	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	ip-api.com

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2652	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F-M-Е_v2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	u0Y4ZfNbjZ4PNDNB5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3748	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\fkfkkffkfkfkkf = "1"	fkfkkffkfkfkkf
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	fkfkkffkfkfkkf
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\fkfkkffkfkfkkf = "11000"	fkfkkffkfkfkkf
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	fkfkkffkfkfkkf
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\fkfkkffkfkfkkf = "0"	fkfkkffkfkfkkf
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	fkfkkffkfkfkkf
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	fkfkkffkfkfkkf
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	fkfkkffkfkfkkf
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\GPU	fkfkkffkfkfkkf
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	fkfkkffkfkfkkf
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\IESettingSync	fkfkkffkfkfkkf
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	fkfkkffkfkfkkf

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1980	AutoHotkey.exe
1980	AutoHotkey.exe
1980	AutoHotkey.exe
1980	AutoHotkey.exe
1980	AutoHotkey.exe
1980	AutoHotkey.exe
1980	AutoHotkey.exe
1980	AutoHotkey.exe
1980	AutoHotkey.exe
1980	AutoHotkey.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2204	fkfkkffkfkfkkf

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeDebugPrivilege	2652	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1636	WMIC.exe
Token: SeSecurityPrivilege	1636	WMIC.exe
Token: SeTakeOwnershipPrivilege	1636	WMIC.exe
Token: SeLoadDriverPrivilege	1636	WMIC.exe
Token: SeSystemProfilePrivilege	1636	WMIC.exe
Token: SeSystemtimePrivilege	1636	WMIC.exe
Token: SeProfSingleProcessPrivilege	1636	WMIC.exe
Token: SeIncBasePriorityPrivilege	1636	WMIC.exe
Token: SeCreatePagefilePrivilege	1636	WMIC.exe
Token: SeBackupPrivilege	1636	WMIC.exe
Token: SeRestorePrivilege	1636	WMIC.exe
Token: SeShutdownPrivilege	1636	WMIC.exe
Token: SeDebugPrivilege	1636	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1636	WMIC.exe
Token: SeRemoteShutdownPrivilege	1636	WMIC.exe
Token: SeUndockPrivilege	1636	WMIC.exe
Token: SeManageVolumePrivilege	1636	WMIC.exe
Token: 33	1636	WMIC.exe
Token: 34	1636	WMIC.exe
Token: 35	1636	WMIC.exe
Token: 36	1636	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1636	WMIC.exe
Token: SeSecurityPrivilege	1636	WMIC.exe
Token: SeTakeOwnershipPrivilege	1636	WMIC.exe
Token: SeLoadDriverPrivilege	1636	WMIC.exe
Token: SeSystemProfilePrivilege	1636	WMIC.exe
Token: SeSystemtimePrivilege	1636	WMIC.exe
Token: SeProfSingleProcessPrivilege	1636	WMIC.exe
Token: SeIncBasePriorityPrivilege	1636	WMIC.exe
Token: SeCreatePagefilePrivilege	1636	WMIC.exe
Token: SeBackupPrivilege	1636	WMIC.exe
Token: SeRestorePrivilege	1636	WMIC.exe
Token: SeShutdownPrivilege	1636	WMIC.exe
Token: SeDebugPrivilege	1636	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1636	WMIC.exe
Token: SeRemoteShutdownPrivilege	1636	WMIC.exe
Token: SeUndockPrivilege	1636	WMIC.exe
Token: SeManageVolumePrivilege	1636	WMIC.exe
Token: 33	1636	WMIC.exe
Token: 34	1636	WMIC.exe
Token: 35	1636	WMIC.exe
Token: 36	1636	WMIC.exe
Token: SeDebugPrivilege	3748	taskkill.exe
Token: SeRestorePrivilege	2976	u0Y4ZfNbjZ4PNDNB5.exe
Token: 35	2976	u0Y4ZfNbjZ4PNDNB5.exe
Token: SeSecurityPrivilege	2976	u0Y4ZfNbjZ4PNDNB5.exe
Token: SeSecurityPrivilege	2976	u0Y4ZfNbjZ4PNDNB5.exe
Token: SeRestorePrivilege	2972	file.exe
Token: 35	2972	file.exe
Token: SeSecurityPrivilege	2972	file.exe
Token: SeSecurityPrivilege	2972	file.exe
Token: SeRestorePrivilege	3556	file.exe
Token: 35	3556	file.exe
Token: SeSecurityPrivilege	3556	file.exe
Token: SeSecurityPrivilege	3556	file.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2204	fkfkkffkfkfkkf
2204	fkfkkffkfkfkkf
2204	fkfkkffkfkfkkf

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2204	fkfkkffkfkfkkf
2204	fkfkkffkfkfkkf
2204	fkfkkffkfkfkkf

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	fkfkkffkfkfkkf
2204	fkfkkffkfkfkkf
2204	fkfkkffkfkfkkf
2204	fkfkkffkfkfkkf
2204	fkfkkffkfkfkkf
2204	fkfkkffkfkfkkf

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 3632	4376	F-M-Е_v2.exe	82
PID 4376 wrote to memory of 3632	4376	F-M-Е_v2.exe	82
PID 4376 wrote to memory of 3632	4376	F-M-Е_v2.exe	82
PID 3632 wrote to memory of 3564	3632	cmd.exe	85
PID 3632 wrote to memory of 3564	3632	cmd.exe	85
PID 3632 wrote to memory of 3564	3632	cmd.exe	85
PID 3632 wrote to memory of 2652	3632	cmd.exe	86
PID 3632 wrote to memory of 2652	3632	cmd.exe	86
PID 3632 wrote to memory of 2652	3632	cmd.exe	86
PID 3632 wrote to memory of 4212	3632	cmd.exe	87
PID 3632 wrote to memory of 4212	3632	cmd.exe	87
PID 3632 wrote to memory of 4212	3632	cmd.exe	87
PID 3632 wrote to memory of 1036	3632	cmd.exe	89
PID 3632 wrote to memory of 1036	3632	cmd.exe	89
PID 3632 wrote to memory of 1036	3632	cmd.exe	89
PID 1036 wrote to memory of 1636	1036	cmd.exe	90
PID 1036 wrote to memory of 1636	1036	cmd.exe	90
PID 1036 wrote to memory of 1636	1036	cmd.exe	90
PID 3632 wrote to memory of 3748	3632	cmd.exe	91
PID 3632 wrote to memory of 3748	3632	cmd.exe	91
PID 3632 wrote to memory of 3748	3632	cmd.exe	91
PID 3632 wrote to memory of 1876	3632	cmd.exe	92
PID 3632 wrote to memory of 1876	3632	cmd.exe	92
PID 3632 wrote to memory of 1876	3632	cmd.exe	92
PID 3632 wrote to memory of 2976	3632	cmd.exe	93
PID 3632 wrote to memory of 2976	3632	cmd.exe	93
PID 3632 wrote to memory of 2976	3632	cmd.exe	93
PID 3632 wrote to memory of 1980	3632	cmd.exe	94
PID 3632 wrote to memory of 1980	3632	cmd.exe	94
PID 1980 wrote to memory of 2204	1980	AutoHotkey.exe	95
PID 1980 wrote to memory of 2204	1980	AutoHotkey.exe	95
PID 2204 wrote to memory of 2972	2204	fkfkkffkfkfkkf	97
PID 2204 wrote to memory of 2972	2204	fkfkkffkfkfkkf	97
PID 2204 wrote to memory of 2972	2204	fkfkkffkfkfkkf	97
PID 2204 wrote to memory of 3556	2204	fkfkkffkfkfkkf	102
PID 2204 wrote to memory of 3556	2204	fkfkkffkfkfkkf	102
PID 2204 wrote to memory of 3556	2204	fkfkkffkfkfkkf	102

C:\Users\Admin\AppData\Local\Temp\F-M-E_v2\F-M-Е_v2.exe
"C:\Users\Admin\AppData\Local\Temp\F-M-E_v2\F-M-Е_v2.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zS811C97B7\run.bat" x -pZhd2kZSak8js u0Y4ZfNbjZ4PNDNB5 -o. -y AsDxzcDAzSDzdD fkkfk@fkfk@fkkf@@kf fk@fk@fkfk@fkkf@fkf FME bN4Aynk"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\SysWOW64\mode.com
    mode con: cols=40 lines=3
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3564
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq EasyAntiCheat_EOS.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2652
- - C:\Windows\SysWOW64\find.exe
    find /I /N "EasyAntiCheat_EOS.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic process where "name='cmd.exe' and commandline like '%run.bat%'" get processid
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic process where "name='cmd.exe' and commandline like '%run.bat%'" get processid
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /IM autohotkey.exe /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3748
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy *.* ..\ /Y
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:1876
- - C:\Users\Admin\AppData\Local\Temp\u0Y4ZfNbjZ4PNDNB5.exe
    u0Y4ZfNbjZ4PNDNB5.exe x -pZhd2kZSak8js u0Y4ZfNbjZ4PNDNB5 -o. -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2976
- - C:\Users\Admin\AppData\Local\Temp\AutoHotkey.exe
    AutoHotkey.exe AsDxzcDAzSDzdD
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\fkfkkffkfkfkkf
      "C:\Users\Admin\AppData\Local\Temp/fkfkkffkfkfkkf" /f "\\.\pipe\AHKGEMEFDOB"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies Internet Explorer settings
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\new\file.exe
        
        "C:\Users\Admin\AppData\Local\Temp\new\file.exe" -pPp56GWUsZso835u03 x "C:\Users\Admin\AppData\Local\Temp\new\file" -o"C:\Users\Admin\AppData\Local\Temp\new" -y
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\new\file.exe
        
        "C:\Users\Admin\AppData\Local\Temp\new\file.exe" -pPp56GWUsZso835u03 x "C:\Users\Admin\AppData\Local\Temp\new\file" -o"C:\Users\Admin\AppData\Local\Temp\new" -y
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
471B

MD5
af60930ca766a633f85878d43f541fae

SHA1
925e89f5108e57d40bd4abc4a10eaca0401b0ac3

SHA256
d9d4ae14bfcd328b8b69ee1ef5c713e2a97ab55065ecfe3d35a6ce6cff58772a

SHA512
9e5bb65a515bd1c7701c81ba77b7fcabd9416a000d6cb4cb5de22f030111328e9ffd3712ffbc2070d82e836c921b78afae6b69ccd8ae7f3cdd1b8f2277d8610a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
412B

MD5
b91f328447faf7df12c8e804e6756a27

SHA1
a6a4fb18e0e903b0671310b6e2b1e42317344e9b

SHA256
2606d6b3974c73be5cebf447ebf14cb96fd1c083235764425df04fc1f3d03380

SHA512
c65490a43d027c5ef6b6036d78ef70b32f0e4b1a6b768ceea0ae1e16eedf207e519ea06bd268ef1fb900356e21fc84fbda086819e864b757ea1835db74cc3d02

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS811C97B7\run.bat

Filesize
1KB

MD5
49988db45356b19de8b6b9a8b342f226

SHA1
a45098fa0d04746d70f4cfc487191d57370c04b7

SHA256
ea656535bee58c6f7290ea92845b5ae7638a669986d89a71522fd8d481990ef0

SHA512
d78c270d4220d9a078b4015730d6516e3546b5aee19d78102a7d0a8ba8f64dd280444d06e6ea65487f5f5b0b26ffad93af81cfc151328002a3f860746c503166

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS811C97B7\u0Y4ZfNbjZ4PNDNB5

Filesize
653KB

MD5
6fb711b079128744d54acbd31f0d3d8b

SHA1
ce4f579056c910c30aa776dce5d985f9a02e6c50

SHA256
627c67d508c3d465787f46f9faeb32dcc32ec07ad101ee0ad60ee90bf80c17dc

SHA512
22d8895deddca24f3baac1014960a24f94e0b1d15f325dc910c250394f39f9c6a0aba137105c5984cd1dea01627c33e7699a8bb8210d3818b48d2e3972e0a75a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AsDxzcDAzSDzdD

Filesize
44.1MB

MD5
f5dd25c4673f35f8cc6ef3adabb72e76

SHA1
f249aa530c2e209aec45ea82473338aea66ffa5c

SHA256
2a4656fc1e88c4b8458f394afc15f5f2c897dabd27d8d5a6a2de3b81f32c55c1

SHA512
a55ce7eef6b3b97771b947ddc62e21930d764f5adcf0e41a949a871765f3df7bcb7d54169339870b8f8946334172fe86d9c2e3eb08f4e49e688bce0b99de362d

Download Submit
C:\Users\Admin\AppData\Local\Temp\AutoHotkey.exe

Filesize
1.3MB

MD5
2d0600fe2b1b3bdc45d833ca32a37fdb

SHA1
e9a7411bfef54050de3b485833556f84cabd6e41

SHA256
effdea83c6b7a1dc2ce9e9d40e91dfd59bed9fcbd580903423648b7ca97d9696

SHA512
9891cd6d2140c3a5c20d5c2d6600f3655df437b99b09ae0f9daf1983190dc73385cc87f02508997bb696ac921eee43fccdf1dc210cc602938807bdb062ce1703

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\1\1

Filesize
3KB

MD5
512cd906c4f2ee99a5ffe6dae90ea71a

SHA1
d0dd01a0a28f6b515063644180ed9ac2426e514f

SHA256
4a52af492d61c65b58116bcbf71059dd53c61d07d01b5e0f09573f4ecfd8bc46

SHA512
b5f44fbe59947c44d418b38e78c8c3650c9d39d73b92748dd757c1e9aeb9d7afbe3bf031541c1223e8a2b6d91994d37eb6b3c3ebf2ed363c3726bb0c6888ccf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\1\data.txt

Filesize
5B

MD5
525c961845ee370f826593c47595ab11

SHA1
4373be5e4fa368ff8c9511b0180f99663ae4b76f

SHA256
ae4ea086f68f3ee8f83f8eb118d1d989caed142732c9e325fd00372cbea451dc

SHA512
e07fe1c4a915d41680a42f106fd6f45effb5c96b469649093096c85ce28fd573941761b867a6e8783b98892f4125f2283f7dadb9e512471f6a180a4e047f7bf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\ChangeLog.json

Filesize
105KB

MD5
2768f972829828d0111a3f62656ac8bc

SHA1
b552e9c890cb49050b3df24b322a2099c6c091ea

SHA256
5f15aa1037798bb4263f5ca7f61532c5ddd6167ae378e79cd7fbf202fcb33c63

SHA512
eeae68b6db491668cdfcc87fc182fb4adff2ffd90ca8c182df8b107de8829ced1fb646e783a4ee4237d845663f03f875ca4a228eb43dbf63d429fdbe4124744e

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\Config — копия.json

Filesize
6KB

MD5
9c13e1287cf02c04671f07cb3130d2b7

SHA1
b8a6c9dbc68265ef58099d25855311ad3acb9681

SHA256
b6862210b9e6dabb85f5b1d4728496f02a02c8c3974d8b724d122c9bb1589b49

SHA512
f40f801f92d24fb53d8657772f3295e113897d388178984bd177ccab539cb2b79dcf7b330e48a3b7602734f337141c931386d35e294f446ae25cca2603ddc870

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\CrossHair.png

Filesize
234B

MD5
5708840c1c245bad73dd6ff689bf74e5

SHA1
cedeeca6fa4c2757dfeeda022d2ba33dce752c6f

SHA256
175c1745cec830354ba7b883e1a6fce77e188d402fbdd45060eb6a045b7b4b33

SHA512
ec25e8d371cfd0f1d890bec7447533ae1b7dddbc83afcdb4cb023ffa2432742e8160920a645726d45d639c847602da25637c30239363ed3b3bd59765122bdd58

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\Default.json

Filesize
9KB

MD5
4c2022e456d624d1d5911e9f672c1c00

SHA1
2af920d4ed5557a0736c63f0947569f9b93f3392

SHA256
c7c0a4a3750a15086ff38b9943454dd753799bb15e8da56185ca6d2260f03e56

SHA512
7062d71d8aedecd1ce2fbfc546b278e9b6d0a41303bc67e1f4b53a9f0b9c6e227af7e2cd8f60dc467a554b1a6e329811b540a80f17015f00ccf8eb38680fecff

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\Language.json

Filesize
111KB

MD5
cef87b92d28c6b42d2fce77eb112503d

SHA1
20d351803e9c2e67c9387de2bee5795757a2060b

SHA256
b7e0fd7177863a427a0723f1db2ae2de67a338701921e83b9a2c1c13890583c4

SHA512
5cda40a25c019898184bbe33ac6a493d7a018a231aefb93527920a5fc2aea3a105e381e6d7ab8d6972569d46ad3a19b709e7668531706e46781efc50bf24e056

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\Pro.svg

Filesize
4KB

MD5
528c7edb05d700bc65ab59105e12938b

SHA1
95090c8e4a1e145079ad3a96a6d25f26a1a6165d

SHA256
b2496b7628759b1f61fee470393cb0922e4650a1147818b1fd99c0b5cf9fdb6a

SHA512
839eb0d257bc0bfea35536677a5c4b1d21379b9ac18e46229d7b2730800e495786918152e9adfd47391576d19da97291b0a7d2b5ed5080cbf1cd448108927038

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\background.jpg

Filesize
66KB

MD5
1c7cf59d6ae3124698f7c9554a0a3248

SHA1
fd5439030eae7f3eb67d930f3d823b91415ba66e

SHA256
dbff18c6769f0d2db675178a603b95080f267761c9fa572a32aeaf482a42ba2d

SHA512
d38bd4d76e7285719c5394781618d30c71a7ac90e7d362cfc1a966a9be894e2a238d3d44c9a22a0923c3984f0ee37c9de4fb5d5bc3db1386b4ac3983faae6eb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\file

Filesize
767KB

MD5
b7d6b3f81e476c6bd45b9fd82d374028

SHA1
863ff0f7b98d127d86ffbd76dff962161ad7e0fa

SHA256
12df511bf5c34adee4d8d2233c0928739671b7d7ce4d87dc910f8293738cf1da

SHA512
366fe8e2533edf9c9a6472801bf8ca43b4daa20cce305f47043cad89f0f8d5b2f5b04d058de7886b222847d3a7be2db9e6d1e76a970c9ae00386a294116557cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\gs.dll

Filesize
121KB

MD5
74c8c5dae54f226ddfd463d5142178e2

SHA1
728a4d28ecb8c81d25677d7415ee1204afe185e2

SHA256
1a064562544e2b975bd5f4bf9f894798b2dd1f77b7864d9ed52d93bf42174340

SHA512
0c92b23b20a01d1f2a57c90a0598683d5a8c3a52489e41527e56bae246904b289481d500f7b4b656bc727eb7d3ce77a8e8dac8b46608f4244f2f4b76d6a4c535

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\gui.html

Filesize
467KB

MD5
7aacc76b6ac2387ac18b65b35eb81885

SHA1
57c77efe7f1d7cd32f805e339e7597c0444b75f7

SHA256
323b26bd92c46e26b3bccc787422c21102779fff6fe85032d506d6dea706197e

SHA512
06d9e4a492c9c149f57fbcde024658a0f92b393e33b80b3e3adec909d2a54f8347f6caa35b0e24fed616fac368deae0d1c1a3dc7ea07ab4853f5e3893c5e76ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\icon.ico

Filesize
139KB

MD5
38c0279563abc2c70f9f288b616c9770

SHA1
eeeab2f77e4aad904186e3dfe2ec65207ef92604

SHA256
e4a941a51c9fd340ad1612b1bd4040d53e6924d5cbe1224b1e09ce8a7d4b8c19

SHA512
1d0fdb93a143dacfb8a4d1f8b56c6da6f353d3061ae79777d78f5be9b0b8670f089186f66491a0ce10f6ccf489ea4ed531f41879756c700e170ff82807fff564

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\jquery.min.js

Filesize
87KB

MD5
b61aa6e2d68d21b3546b5b418bf0e9c3

SHA1
9c1398f0de4c869dacb1c9ab1a8cc327f5421ff7

SHA256
f36844906ad2309877aae3121b87fb15b9e09803cb4c333adc7e1e35ac92e14b

SHA512
5882735d9a0239c5c63c5c87b81618e3c8dc09d7d743c3444c535b9547b9b65defa509d7804552c581cb84b61dd1225e2add5dca6b120868ec201fa979504f4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\script.js

Filesize
16KB

MD5
f6a3fc75323b7161d145255fde08ad6e

SHA1
a33593a645176ad15da44aed6c05c35ac90611c2

SHA256
fb530686589193f313159bbe1f89e2477f7d96763e264711f0c6dddb47cff34c

SHA512
a15aa2c011d3582e4bb9975f071cbdd3110c0a75dc374591a35a6287846540d9192253f2ca01b7f6ef2437e552c8d35ca31319b4edbe5f823f19bca6bc8853f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\style.css

Filesize
16KB

MD5
1261a774b4ec34a92439bd3b509c470d

SHA1
ff7cf9d6a21bd79fa24b461a9c04d3d24607fbe6

SHA256
a16846c4021e8c4fbf2a7ee97dc54ead4bad02ad07c8780ca3a3be38bdd16d28

SHA512
5767b44035653d5cb77635d0ca363c1d3023257569252ba459fd05898e88331b80d89c15440e66cd1350cf0e8c144c7135ef24a809ca8ee81d7eedb1262c27c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\swap

Filesize
1.1MB

MD5
3bf06f64e178d8dcf06e25131c0e6d10

SHA1
f6798bbb82581707cef54c2c2aa1fdf6b9578b36

SHA256
7037f6cf83d9164b86c5d614728aea7410ad90971a8aff392d6c62763b0a4d6c

SHA512
7edb72ec103a9f172cb9e35751a126ac3611b17483aade086ff4f25d642c978065cbe947c226b30caac7447bca5295e6233c2ffaed21eb6f8b2c8bcf37e7d56e

Download Submit
C:\Users\Admin\AppData\Local\Temp\u0Y4ZfNbjZ4PNDNB5.exe

Filesize
577KB

MD5
c31c4b04558396c6fabab64dcf366534

SHA1
fa836d92edc577d6a17ded47641ba1938589b09a

SHA256
9d182f421381429fd77598feb609fefb54dcaef722ddbf5aa611b68a706c10d3

SHA512
814dcbc1d43bc037dadc2f3f67856dd790b15fc1b0c50fa74a169c8cc02cdc79d44f1f10e200ef662eee20cd6b5ca646ec4e77673e3fe3cb7dfb7649243f6e99

Download Submit
C:\Users\Admin\AppData\Roaming\test.txt

Filesize
2B

MD5
23b58def11b45727d3351702515f86af

SHA1
099600a10a944114aac406d136b625fb416dd779

SHA256
6c179f21e6f62b629055d8ab40f454ed02e48b68563913473b857d3638e23b28

SHA512
16b7aa7f7e549ba129c776bb91ce1e692da103271242d44a9bc145cf338450c90132496ead2530f527b1bd7f50544f37e7d27a2d2bbb58099890aa320f40aca9

Download Submit
memory/1980-41-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/2204-198-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/2204-202-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/2204-197-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/2204-195-0x0000000013E30000-0x0000000013F30000-memory.dmp

Filesize
1024KB

Download
memory/2204-199-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/2204-200-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/2204-201-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/2204-196-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/2204-203-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/2204-204-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/2204-205-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/2204-206-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/2204-207-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/2204-208-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/2204-209-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download