Analysis

  • max time kernel
    54s
  • max time network
    57s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-01-2025 01:01

General

  • Target

    FarmBot Premium [v0.1.1] (infected).7z

  • Size

    9.2MB

  • MD5

    5d913ab61c638631308da3bf82ac0cfe

  • SHA1

    b1db27d57e5fd4b3b2068683b5ca2cd4200d8c4e

  • SHA256

    65a8ab01e1bfab4662803c2635464cbd63355a25aab09fc2cc4846bc8af533ab

  • SHA512

    19f4a3b219ea5004299fba2314bed7b91290711f21bdb6a9f18669558c9120daa62b117b4dda1a1322e16a67f9bb03daadbd96e79b1eb045631b2e8e30fc4559

  • SSDEEP

    196608:2ZzPDY5Y4/3aWz2cEM7GL/qhj9hyGLX8mOMduBWz8:2t7Bm3aWAIrh7HLX8MHz8

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\FarmBot Premium [v0.1.1] (infected).7z"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1640
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2296
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\start all servers.bat" "
      1⤵
        PID:404
      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\RakLaunch Lite.exe
        "C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\RakLaunch Lite.exe"
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2036
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\WebInto\nSozJ1dyBj8wiNXEk.vbe"
          2⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2356
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\WebInto\qRb4p1pB7PbnXpdQ.bat" "
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5088
            • C:\WebInto\serverMonitor.exe
              "C:\WebInto\serverMonitor.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:3612
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\WebInto\file.vbs"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3648
      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\RakSAMP Lite.exe
        "C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\RakSAMP Lite.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2404
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c color 0
          2⤵
          • System Location Discovery: System Language Discovery
          PID:696
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c color 0
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2964

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\RakLaunch Lite.exe

        Filesize

        2.8MB

        MD5

        dccac8ad9d669af1e2010c4fc3117987

        SHA1

        60abbe80a65eae70681d56968890e99d961c9a56

        SHA256

        667d56e9383d71602c4424914cbf6a058ba54aaadf3f4bdca96b9f0b3f98472a

        SHA512

        3955087f29d372af583609e692882c192b7dd04395f439d588d662b2ab6f5a08079983617d1809dd93d978670eb9de57462a22ef6103cb5edd9454d376058f32

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\RakSAMP Lite.exe

        Filesize

        885KB

        MD5

        475ff79d39b77beaa7fcdebe57e69141

        SHA1

        bec6d6794cfde5eb4283e232b851932ddf68d18d

        SHA256

        5e87cc4daf65654ccde0ec6436717efa3e3f71b878fc3fd7e04ed0e0ec33a2bc

        SHA512

        658f5101825e44bfe4b65bc5ac0ec686cd58f4dc6bb55408a11797f718c1c88878cb9f44bb23fca86a7e7270f9d92996e4d3a96d64e620a0fc8bd3a8862dc917

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\lua51.dll

        Filesize

        592KB

        MD5

        3dff7448b43fcfb4dc65e0040b0ffb88

        SHA1

        583cdab08519d99f49234965ffd07688ccf52c56

        SHA256

        ff976f6e965e3793e278fa9bf5e80b9b226a0b3932b9da764bffc8e41e6cdb60

        SHA512

        cdcbe0ec9ddd6b605161e3c30ce3de721f1333fce85985e88928086b1578435dc67373c3dc3492ed8eae0d63987cac633aa4099b205989dcbb91cbbfc8f6a394

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\!rak_protect (5).lua

        Filesize

        58KB

        MD5

        f3013979c86d10e646578a6d0f6b69c7

        SHA1

        2a63e0ef98fc047cbe450741402fb4726978e581

        SHA256

        e61bb750825a99040b5959157fe8773d584ab21f88ae4815f7ee2a0eaeb791e9

        SHA512

        9c43423a0835a6e7984e8c0a83227ab57547b600a0243e515b8f09b2d8999c1694b4dac18e287f95a2c6f86a959ac2893e80a26f7af96cdc1c057402ddc3e538

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\anims_fix.lua

        Filesize

        51KB

        MD5

        65900a9535833409b01ecdbee69eedcc

        SHA1

        2e528b0de27a6539fad8f4924374f3066a83225a

        SHA256

        6ee366249d604cb020fbd1b2caf29d8d1106f731ae1e54186c60a98d4cc5c6d2

        SHA512

        cc63d427085de76836f6ac9e39ebf3208760a30e2cd10735dab93468fd9c3a942702bceb4d52b5afa63e565ae7588272fd934e77105aebaf8be6e8fcd5ce028e

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\antibugalt.lua

        Filesize

        9KB

        MD5

        addbec976a833c4622b80d3e42763d3a

        SHA1

        1e02bb435d9ce133410363d7aee25693a773faa6

        SHA256

        0524088a7b7490e797cf6f2a4e66fec5f595cbe78f3b0638dce2167b4e301652

        SHA512

        18834de2c71433e6585e1a0f98220a7a4263d539b68b7f987cb14a9a572f4694fd876b8c824c12508ab186a0dade42ebbb7104748df783805c9cd38577705267

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\damn (1).lua

        Filesize

        1KB

        MD5

        e5e290cc4550de00ad53d58f25bec33f

        SHA1

        377e5438c92b57bea7de5835d70266ef5574e3b8

        SHA256

        4e78d615d75b14892afe912a08e2d411bbd3ef80e6a0f86a8e0388a67245e195

        SHA512

        25a07264bb533f3c228b8e0fc8d24c12158cc5f5ab8e41d956db0c548cbf6deab0f37fcbbe7ba7886f43dde47913882f5f56c674843c0382554232a6ee775615

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\Tasking.lua

        Filesize

        1KB

        MD5

        b39668f3ad04073f759ec59a244c419b

        SHA1

        8032d45bf99ea3b95fc5f30d1e0aee9104cf9f67

        SHA256

        d556603f68aa2b395895110077dc5f502e4c9c50ae2ffdeaebcb090801e9d010

        SHA512

        9633ba3a2c9a2f981ca71003fc2d186b9c87fb34d877ab15b4e3d4b29e78edfc1f362e694dcd1dbccfbc648c919ef4f8f2e0d93f3f4c47978348ca11de07426f

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\addon.lua

        Filesize

        3KB

        MD5

        0a08857b250d7a30646c46bc5d26f910

        SHA1

        018d6a1955bc8ae0a5442f0095e8891870f4287a

        SHA256

        22297cf758e7fa6c93e663da2eac22da0d3746987f27bbd5fb86296c4bb3db15

        SHA512

        7d8a27c83c5a53ef30ebdd29b7ab5f98f4238f60f08f35432ecac72444bbe6cbe558f10d45a076d0ad975244d4ccd36b06decedb2559bcdac2d084965a0ca91e

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\cjson.dll

        Filesize

        120KB

        MD5

        a8eec61368ee2351305e60885c548b61

        SHA1

        823ccd739de5cf1694377ad9ae656fe497ba6574

        SHA256

        9fa1f6c66644a3e14a7d0e8d2937512963773fd047fa6826482caa304ecf964c

        SHA512

        724304d73221af04aa534ddea9d5fc6044218827e96f711aa535714b590c172888bb413c2084f8925674d4946d17abe14052e3fd78840b590bdd0e51ace00885

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\inicfg.lua

        Filesize

        3KB

        MD5

        6054a05e0333cb21a6e61d1b2fcb19a1

        SHA1

        6aca01c1a8dc607e1ec7c98bc120d1728e259333

        SHA256

        3a987d210dc07d86f89c13df9c845ca17360d97ef6685c73d784eab3a5b7e044

        SHA512

        4c6d1319d8a2c48cde2a0625d020b8372c82bdf26d3d536955012943b2c09c4f2039b844ceb9a6258d4678f6a57c3ab25d6099b9d3f82fb9e2c25e4ce41dae5f

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\json.lua

        Filesize

        9KB

        MD5

        de4359b70c4bec50ecc71426085c72e7

        SHA1

        916956dc5311deadd022022697362979f2b853c2

        SHA256

        0eaccda57fabc0330736de25f45cf589821a42b5e0fe02e4e3125f7dc0bf2b7e

        SHA512

        93500b4ac78ab0ba6f483d6463055f640434023ebded7b8222058e21aef2ca459459d9c679563ddce686f7df20e790756dd276a80ee4c61b6e094f2dfe818774

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\lockbox.lua

        Filesize

        31B

        MD5

        dfcb0a5d980aa6b136e540eeebcbe3d7

        SHA1

        a63a421fb7ccf5d744b1e741f21b13b7ea10a2e9

        SHA256

        0efa8f85cf3c8c4d87f16bcc12b624242b2501d94cd74196e85550e3c1cc4439

        SHA512

        cfd07958a280b3cbaf81ed5fee9fc1bd35c64115297646bc86d9095d8f609aaa598e04bb0b54db5fa82c60ac260f16c652e1251c32a3be80f5e4e33c6c986053

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\lockbox\cipher\aes256.lua

        Filesize

        18KB

        MD5

        8141cc3a65a3f47ade0241b9775c1062

        SHA1

        0b49e79c91bae391a4e0b845ad6625b4ed18761e

        SHA256

        1270f51ba8c6243a3d28460e1695422f063a5cf3a2c6fc4392dc879a8f138e1a

        SHA512

        98d9205cfdf58e64985002c17b579b0b2a775246fd7240817e0677b406620f98b345727db6c2382aae89eb2a8db679460cf517e9c4e053ef5827d86d87e651a1

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\lockbox\cipher\mode\cbc.lua

        Filesize

        3KB

        MD5

        cc065ebee02120ac56fccd9da157b8ce

        SHA1

        0290a6074a5a3c1e5efbf35ac427ceaf7bc0ba08

        SHA256

        7e867179c96ceee49d772fa4886b19bd6bcfdaa8936fa424ed08277374e3e61c

        SHA512

        7fb0e614b8cc79691c7392f580c521795c5212e6fa419e50e87d27bb19540975d8e4952bf3e5b4baa60b419c1837549f52e469baf863c3736dc8359322664e6d

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\lockbox\digest\sha2_256.lua

        Filesize

        6KB

        MD5

        eb8e718d399abe6e89951a0a7ac48089

        SHA1

        098223e759eda0d146431b1ce01997fb255b56e5

        SHA256

        eb71e45c9bdf0b96a96f0d249afbc14205e07c9eea42091064a353511f63222e

        SHA512

        a1e8ba6f217232b732b7c839e3c497ccd12c461b0a5bf4d95f4f3553ab839d61c270046f9e01823bd4686f28f512c7d5235a7be383610c9ad8fe734d75651f71

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\lockbox\init.lua

        Filesize

        641B

        MD5

        3e40414969c813025730d4fc2798b02c

        SHA1

        ec120d2c6ddee6328b6518c1850940e774b6612c

        SHA256

        f2f9a4f38839cbe3ce021ed7f6316c00f716160e64d97fc8ae8a5312386af72d

        SHA512

        dc13d72990cf1d13b84b7f754b801f25dbee997a9d9773e3b8e69c4b4a83f58323c9ad9496563074712fb6537305b26e8b3da2d8d360a15eecbf6f05152a40cd

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\lockbox\mac\hmac.lua

        Filesize

        1KB

        MD5

        6744ed25d6cace834c357578fda305e8

        SHA1

        6e93d1eccd1680b4d203304a1e1815fb0c875bea

        SHA256

        29267ae322dbcd2082e4a036c05967dbeedd97cfdb1644a587640d404173fe9b

        SHA512

        6559527ff4292a11032889da2eef20687a3dbf8d6bf0f5e5e058225381036aa475db645a63085b9c1206a00a70ae41c63cb8ff7159fb6720dcf04fa60bb933c5

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\lockbox\padding\zero.lua

        Filesize

        387B

        MD5

        4b14f0991ac4f38d451cf75b8046c2ee

        SHA1

        42e7392cdd2976bde36e5bfb04617d73398d9963

        SHA256

        b892e27b6927a9dd2c2cc26d5f4e608d682dd9d56b3aad86fe5f3fe71f984ed6

        SHA512

        c3abcf8ffd42ee2828891fecdd9597f397c541ba8b1862d1202b47a6760c5e7e76d0e784b21ee49f4bc5b9721965308ebb9afc89e6611b0c00af013e0f930a31

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\lockbox\util\array.lua

        Filesize

        3KB

        MD5

        e618139cc45910731bf0926709285b39

        SHA1

        599d2759253a94ee07e751370d01604b0ad04f1a

        SHA256

        a7981e63858ba5ed8744cd3e63bd28bc86f47abce1ca20a30d37e376642dd61c

        SHA512

        0966108c87e1596678332c8bb44f3a70b2b8852de56621ee3f4f92d6c83d93016657370f9f142242e2e4f8fb829a6ba0657b26d3f01ffdcff8bbb02e58b81b39

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\lockbox\util\base64.lua

        Filesize

        2KB

        MD5

        12e25723c4f64642606b81310a063450

        SHA1

        0a7a116aee53117d972f1e4b2f5dcf7ad4f3f47b

        SHA256

        9aa5b929347ca666f4297db76a87ec8ddc04e421047230fd02f8e616f29771fc

        SHA512

        86ddcc3090a8ee2812467f22bcb7fb084d3aece382e3e8d5b071fdbae4bfa76d25762d5ddbe8d7ba2160e4ac8bb0b2e117f2c4d6a6dc9413f20b744305d7667e

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\lockbox\util\bit.lua

        Filesize

        993B

        MD5

        86bbfa306f0b4573feecbfbdcabc704c

        SHA1

        cfe98c81b3edb2d467bfb25ad51ff5068374d170

        SHA256

        05a9d168c31f339b471eb9c4cab9da2c2bab87062cc331a9dc7769f2c88d9199

        SHA512

        be44c02145e576a1caac55a6b7e729782a68e966d5345b5600c90fbc9413a56dfbb23c7096950cddea8c75bf37bdf36ee1d7aabac7d50771bf8b369d29aacb44

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\lockbox\util\queue.lua

        Filesize

        787B

        MD5

        667d69d5b4a6a882ca69e4266885da92

        SHA1

        47459fa0fa5f5a4ba6984ba36558756da1777f1a

        SHA256

        d8e33d1e1d408df057c5bf40857862dd3f9e05539e94e5144fb3ea3c7808a26d

        SHA512

        82bd9c146c319f34231cad79c5e39abec954bf24b8ee3d8bd7469aadfe72c00f33f3e66d550e052aef5449439aa7cf2ed15dfb9196be18eb0610bc1cd5b0ace8

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\lockbox\util\stream.lua

        Filesize

        1KB

        MD5

        6b32e8a3c2ad360da4b0cd1ead924219

        SHA1

        c60bb2a5e632490e0cc44887662e36206b7362cc

        SHA256

        df73343173b0f1bbab91837ab2324900781b36162225f3e520e853d59016d7c0

        SHA512

        cdf75b7dc5ffe17702d2bad3af4b662c5d04c830771c9b4b1f0ad6a1af3e33f67c8b870b3b09777fe5a37c1386370a7b2e434358b666588c6f19384e7b2c1da1

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\ltn12.lua

        Filesize

        8KB

        MD5

        edef8753511326398c641481d200fc44

        SHA1

        93d89e5636bb460975767d38e299b5204277ae67

        SHA256

        3bf0000f86d25da94089d47de3bbb204fd5be491edbe275730e73f68c710ea42

        SHA512

        4588d454f9dcbcf061563eeaa7567fef4b0ff973b4693df3e7233e29fe4a6ecd26f38c0b7ceae66c5443657fe2b8967385bb9d91af01eb4342927033f45e7f92

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\md5.lua

        Filesize

        11KB

        MD5

        8f2a2091a9572c27621710df3e886310

        SHA1

        aecb40b89112c061253532356d12fdfb8e74fbb9

        SHA256

        64b90c45d7ef364356fa5f3655c37e5acd3ccd78a808d58a960efaf33b74965b

        SHA512

        2593be630e7ab252d08aa49bafbfa802c89865ec7cae75b34e1d182a7d7a77bccee4fdad8b107647750abbf13a38dd2e2bcbff3624a8acf87215c1c79f9ad481

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\mime.lua

        Filesize

        2KB

        MD5

        2e001d487613c4ae82f79ac23b8c978f

        SHA1

        7a9fb11e9194607f9bae98efac4514210a3f6593

        SHA256

        a548fc214ac1e935afa683df9bdbeded0ca60cf353dfcc16f6db0187b9fc512d

        SHA512

        cac3ed65bb1bb3f27248a62980f92f694665eeb280802649db29107dc198f6f2824a876bb41246cbf8626dd69d438b1659ed150dcf2931eedce328e70c85f736

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\mime\core.dll

        Filesize

        76KB

        MD5

        c6b6a7053915bae6c90586cc5c1e7c4f

        SHA1

        3e4b4ab4d12e0110a844876a084ac87e0a7af6c2

        SHA256

        e845e535e70086ab72f18d53d00cf80d15300089ab78db3eff383b5854e8667f

        SHA512

        5f5b39729bdd083f8d1b5fe70ea7d813027b433649e42c00add63595b648d3814edf494344f1a435d2b105b7b587161147d5fe0f4f32877bf782302868793c54

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\randompass.lua

        Filesize

        4KB

        MD5

        1f3cd19cd86ab67e08a1241fa57f6cb8

        SHA1

        0f68162c9dfbb535b4b5dcb428eb81fecf4f254e

        SHA256

        2864c0fc8746d2c7158c0d3f76ce1b7d190ee4f7452b019fbeafb3f495ee1344

        SHA512

        f14eb19f6588f61974c9eaeadff478bb296a83df2aec3e2b5141afed12b958215c9e7d4e2f03e0c809bca9bb74b81170613dd5433dc6d4c714ff2b2e0df6ea4d

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\router.lua

        Filesize

        7KB

        MD5

        de84c82cee80fc9d551835c3b640057e

        SHA1

        c4124f3b27b8baeeb7b18aac9442f1f3999cc2bc

        SHA256

        82df7a7149b37f709d33eb0e2c2f51afa0be830731bee67ea7fc6d57ddb9ca99

        SHA512

        0c7a38facad94354567ecf1b8f81eed12674ab0f7de65374b698247c4a9c1ef4485ac7aef72946d7e3c140f2f7f5bbb48b7e452de961e15f38be6bb1db584e42

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\samp\events.lua

        Filesize

        26KB

        MD5

        89f74f4e4cf6224e7b42d28a8ca32c6c

        SHA1

        651bfbb74a1335835e6c35a983baff6b83c34fba

        SHA256

        af575f181035ffec76424b3feb2554662e81289c85e9a305637aba9445b7d440

        SHA512

        ac27b0ec733a60c79d15278ed097335bc2f295b18e4293b512ec8c950a9e4372fe4e35b3e6c93cf750669ff7133d86bb70b8b381878f467f2a41380b8894eb5a

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\samp\events\bitstream_io.lua

        Filesize

        5KB

        MD5

        06b6476d1971f366958eb3cb31111be5

        SHA1

        d91f77e80505e68ba80660e211128bc7b9d2d5d8

        SHA256

        1b6c2b9cd8c24d548e6d261972e64fb12325a16efc373465036140a81aa1b70f

        SHA512

        53deedaee1d658c472d9e29da109331909bfbb7bf82846bcc473818201be369cde6ab29f14d4c45ee8c098bfd7a5a0f5a46c9c7e4195bc23ffded2cc15fa4ab0

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\samp\events\core.lua

        Filesize

        3KB

        MD5

        c9d4b4dd5e1b4de89fad1bfffb21a3d5

        SHA1

        bf101c4bb144c50ebb3f1fb2d8df7c521644f361

        SHA256

        e74796c990f08dd06e03a5e6cf08f5ddac64c673b24d279508bbe1f9d132b37b

        SHA512

        06d51489ed2cd96671192619a9d23599e049cd6bbeae5fc8125396fb92bfea0d196af7dbc4b8532327290b2ae840ed166c23903ac80718e44a24df7589baf050

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\samp\events\extra_types.lua

        Filesize

        1KB

        MD5

        7fb8c15a3f872bc8178d3b2297b956a3

        SHA1

        fae84a32abe9044ecb47efeeb999600db94bba15

        SHA256

        e9148e2d881ebda5078cf39b05e68e394d6198f9a6989c192ea70441cccb6f91

        SHA512

        ca065a5478f1e44fc6b7b4bc502eeb404630bee988349112147b1dbb4b2c524c6243f1944297bd09dd1502768e90f35512d484897f54f8b942ebf3c4689724fa

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\samp\events\handlers.lua

        Filesize

        16KB

        MD5

        51a2e6eeee49dc7aeab769b3c6df97ab

        SHA1

        7ce87145b421cb06b74de49b74495b2065a36e7b

        SHA256

        60fd2aea7cf1e6df1288c71add8854340654e814913b9122f6b3cf6038be4da2

        SHA512

        222242d86f3a45c7b713ed4b73dae2d6eaaf9c089d588f48f2b2273368c7732e0776bb367603900c32cdf91e8d36a33d48471c72f9421e262d32a9183712faef

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\samp\events\utils.lua

        Filesize

        1KB

        MD5

        17341a7677a9555598d87270ef0eed8d

        SHA1

        d9890226bc39919b857b345a5f10c4aae2836a06

        SHA256

        0bdf44a94c48d102d9eb21c2cfedf88111a3d4e0550a3df5fb01aeb07bc1f26d

        SHA512

        4eb96e57f987e01c42d315143480c05174fc8db2372c8b1fd041b2b0722529a262215a841a7d601e56f41ef8c3fc0f7c0bd71df7ae7cd687a4a30db008f0fbb0

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\samp\raknet.lua

        Filesize

        11KB

        MD5

        a1e7443596c29213aee8992036fbaa5d

        SHA1

        c34634d27068b2c10424b960ea5afdcb0ca18779

        SHA256

        d0c47eefefe87387d00e806274d69a0dd2a22e885aa934fe08ec82b89cd1a3a1

        SHA512

        8542499c539380f1f373189ff79b45394d5c763c41fb115a7b437f4391118add87412cb4f6db29ecad0867f9eaa5ebe6ffa1d391f3d4cd0235ab8361f5843217

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\sampfuncs.lua

        Filesize

        14KB

        MD5

        55a2363d1e22a64b908f940b076d374e

        SHA1

        6697e26fca4866066683b0aa822b92dae0ae1566

        SHA256

        7c2528ec287d4ffdcb381f3a96a6678361075828cc727e9ff2e9cb91d4ad0cd3

        SHA512

        c27bb32838987ff3255e3d97b8c2dd0f2831c8b24ee530c7067097d88c808f5830293772673508b73886d207ec815cf96c845413b9a9a3c2b84867294cf277e2

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\socket.lua

        Filesize

        4KB

        MD5

        818a1f6f53d7a295d78a4c22730cd556

        SHA1

        bcb78b3cbc19e1a8f53d13641f856d8e0ae0af6a

        SHA256

        332871e3beeaccf8bff18cde1509e81c2bd16beb511b1fe586c12862dc7667b2

        SHA512

        e87680ec19cc5d9c3492202d101dd431a8540ef8cefe0107837668113ff984f7c32bc561f63d2c3dfe562cd8273abb12605a482a7d6e98cbe0504a55ebd59b4c

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\socket\core.dll

        Filesize

        139KB

        MD5

        33ada8768e1ac61a70639d698e80ec75

        SHA1

        7d84895dc6a4e30ff20095524cc6992043412f12

        SHA256

        c7e65c06df09addf05fd807e964e87f4ea56476e15e19ea5e47a321419ace50e

        SHA512

        616a3dc26865809b9441488bd86266140e4d35ea493fdd1d946ee6c20599fe6fa8f33e8517f1d4a368ff98dee5ce2ac75f6790f255fbed1cfa589a62bbb45409

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\socket\headers.lua

        Filesize

        3KB

        MD5

        61a437d6aeb2885e15540a01e32f85fe

        SHA1

        77c3b50cb5a730326920e539b85eff824a33cc1a

        SHA256

        aecff8c2d99d77a6473269367d5b085ad0db189d9699c2f47dcb97ae5ad348df

        SHA512

        d161d729c7ca1aa3b991a0bf1c280dbf3a265d413737a3019f32c81ce4452946a72570b8ccec5da4ad8cf73a72dd9cb883785c3bb318fff55aefdb541320e0a9

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\socket\http.lua

        Filesize

        14KB

        MD5

        3e009b9b056c1f95d558124e6df392ca

        SHA1

        3d3a5316a5169fff0e114dc80cad098d94a06107

        SHA256

        b980f604220ab23c0c7d6f59b80a66f6176d7cfae0263e6543cfdc8be4622464

        SHA512

        b5bcdbed5babf0119ff8fd5864af429818a80bee5208d13ced5d97e1117f9e3998ca1ba61e8ae93f38edcd560018cf7b70c13fec4eff579997808357a98dc776

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\socket\url.lua

        Filesize

        10KB

        MD5

        626cbfd7a0f77abdf1e46e2052286259

        SHA1

        b8fcdbcbbfaf784acbfdd788dfb6c8980dfc193c

        SHA256

        7290952cba25a671e0434a01b5693855cb5d19ba777adb302779b050d8b0d3c7

        SHA512

        ebb873b8fda6b6311269c75fcd8a870e6a0a6298dd310f9d922789e4a25a8e533ad5cdc1a971e201a27210e17e93fba58254ee1c3f0b466182f78b79666fbc2a

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\ssl.dll

        Filesize

        1.6MB

        MD5

        9476d2ba9ba1d07d73d2d000f1cd97e8

        SHA1

        1d4fb2c5fd489e2fd62bc8109c82f2b4b9c00623

        SHA256

        7ae579c19b20e618cd30d661bb22f3e9736428d1b62b1e758d87da32c00409c5

        SHA512

        f17aa3543b7943ea31b2ceeddff9223f941136d15aef91639539bf9b381c653120ecef3bb458363e8c0ec6717a781493d63c6c9da4a854a090dbcd9d19bc0202

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\ssl.lua

        Filesize

        4KB

        MD5

        7ef2d633b8af13e7e79e3bb79d51942f

        SHA1

        e8d7c60d37bd3742bff9e1612fc79f3634d46638

        SHA256

        1926c6fc79396cb573f40b8e3fd4810f2b48b9b76e62d2e190041eab1d4a4d16

        SHA512

        af9e71bda1265a0ee476a21c875f70294d1f017a87e36e84ee7d7e15feb3e59784e19bba7f7f3bf69cb9aecaaf0cb04b2a9f57cdc379a40911c6c2e97a8729b3

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\ssl\https.lua

        Filesize

        4KB

        MD5

        bbd346d4ae3557c7b57952eab612e3b2

        SHA1

        db7ea329fe50f304dfc84ace0df88c9f0a6ef5b9

        SHA256

        4a4d95bf6b4b3e8a0af84e1e53eb799e96c23a1527b424748927f5a62aa1318b

        SHA512

        d526d3802d89760d1e2014815cb17cf1d5b9dba67e389048d67dca459dda17b9cc9a367c26a5b8d5bf8f98b47090fcc5bc985179c0da4d8fe610d0c0e3310b76

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\libs\vector3d.lua

        Filesize

        1KB

        MD5

        a465fda6fe920325f46ef4a3c9055975

        SHA1

        39b19408b235c6681f6d91ac350e83b8354ccd71

        SHA256

        53ef9eedad5994e05320dcb5c14b504dd6c09e6a70111d76eb60a52d6c4a68af

        SHA512

        612e9a6f0db89f254c65ac9b0aee0dd14f870cca35e37b6bc9da0c466bbb4cf0264fdd0cd6d95e2dad5188f96fb9dcee77743ed0d3e71b8a6e643d0ceab4f0e8

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\scripts\main.lua

        Filesize

        811KB

        MD5

        f66b1a5169526bd17bffb7613395ef37

        SHA1

        cac14678a1ff40696eac7fb282f5aa750af22e8b

        SHA256

        721a8f0b495e0afa087b8d9f67bc9fb208f1aa34114efd872c1762151fb0478d

        SHA512

        00206a344c5a7c8ddab9d6bb68993173d394f7d7d8fef419dd0fee70af72bec7e0d2fb4b936bf300e45e86bc50916544163ec215effe3410d200034c693792b8

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\settings\RakSAMP Lite.ini

        Filesize

        483B

        MD5

        c7986b208d0ee3be442ad37562d6e6b3

        SHA1

        f300c3b7c0107815f4c74e7079357bf43175dcb8

        SHA256

        4c97fc7af469a89507df682b2435da14ce7da30a29bb17a4b77bfa8c1a966527

        SHA512

        6dbc06d462e69b31de7f57117451266403d814a195245cbb351f8ba6802bb4ce84b75330ce28f7f04a57d8c579bdcb070209d555fb539cea3c2500191c58bafa

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\settings\farm.txt

        Filesize

        1KB

        MD5

        0f1ffb62d9158ebac82b8b5c9f0cf73f

        SHA1

        7fe88dd5d5a9b99826ac1aa3919616a70eb32d36

        SHA256

        fbe0086cd146bc776efc22d60347cf15afe1375e03f9277420864d332c0d9657

        SHA512

        c03574c738e7be3c7a4776632fea49f2747b60763fd56a80eb2e94bacb5dad9530416481cd1f04122a0cf76053c65e495814b7c484abc94487758bc02416362b

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\settings\key.txt

        Filesize

        39B

        MD5

        bcd391b1da3d982cbb36b1ebd1e0e0e8

        SHA1

        9a341026bf4bcd749d625389646164aaf2175e1d

        SHA256

        cb94dcc4a60454c0c9dc3f1e6a15ef4d7847e01b93242e0dcd041fe2418c224b

        SHA512

        8298422813e9103caed2fdf70b571d86d6bed0a08116036c8e16265145d6d9d92310baa1c0d54e466e8c11e6829c7ba9f628b04b1d3a1d6b6cea1ebe000fed5b

      • C:\Users\Admin\Desktop\FarmBot Premium [v0.1.1]\start all servers.bat

        Filesize

        652B

        MD5

        ecc29cbcf497b8531edf414db677ec42

        SHA1

        5546c02e1212bc71d019f43ea18da3152f4b5028

        SHA256

        50e39146e2415f6c431882c9d436a3fa37ff6c633bf6cc624dcafd4e6502bbd3

        SHA512

        91baf911c6748cbeddfb001fc1bd5f193992de9bffe712f9378f3465e92c57809ce264111f1760ad8df9b8f4be2ac1f09fa63c730b70a169aaca79031356f66e

      • C:\WebInto\file.vbs

        Filesize

        34B

        MD5

        677cc4360477c72cb0ce00406a949c61

        SHA1

        b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

        SHA256

        f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

        SHA512

        7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

      • C:\WebInto\nSozJ1dyBj8wiNXEk.vbe

        Filesize

        200B

        MD5

        1ec76b27cb22780a9629004889a9314b

        SHA1

        a285ad4ed32e0b23e429ac556a49d2bf40d1a87e

        SHA256

        95eeb7d02cfa88ef6b823f74e94dad6cd3712e32c28aa459dd21ac3a7203e52c

        SHA512

        257f539d51aa8c71faaa049447c2f0827f7bf4c7b5bc49b06285c6f48d4b5a4caeb39704567fc8970e151eea7d5195c76f72ab223819a4db1893220b7d341470

      • C:\WebInto\qRb4p1pB7PbnXpdQ.bat

        Filesize

        30B

        MD5

        b7bd9ac985155b8d7835c88076a1079d

        SHA1

        d4cdeb6a2515ec83a4bca53b1dcdefecbd3f3a66

        SHA256

        56acac90b04931e59960f48c355cbb6d2fe905dc7840ea901f2bba3bcff2da22

        SHA512

        ad4a856dee4bfe0990d58f87cf657cb0e95c74c9046a8b8f08671088212f0cb231db72e913890a162fcf48f0931cba187335df3ffd4c7611b4dfd829a049082b

      • C:\WebInto\serverMonitor.exe

        Filesize

        2.5MB

        MD5

        9788401a75105680a18d28dd5780d3ed

        SHA1

        5d2c05e7bab595c5df1f8c8eed1e75006ac7e3ca

        SHA256

        7b99999e93a7861481f9f4532d2b391215512737d9893b1d89f46ca79fae98a6

        SHA512

        a1481f6c4d20a21f497bee65b2d5f86c3b84d3d8bb259ef68ea7499affa78cb245fb19bd2911644d95aef06fdb44047ccfa8609a86e8296c46a5329415de4f5f

      • memory/2404-1479-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1449-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1481-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1480-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1483-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1478-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1477-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1476-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1474-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1473-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1472-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1471-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1470-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1469-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1468-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1467-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1466-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1465-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1464-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1463-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1462-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1461-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1460-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1459-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1458-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1457-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1456-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1455-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1454-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1453-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1452-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1451-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1450-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1482-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1448-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1484-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1485-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1486-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1487-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1488-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1489-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1490-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1491-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1475-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1445-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1444-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1446-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1447-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1443-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1441-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1442-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1421-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1432-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1422-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1423-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1424-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1425-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1426-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1427-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1428-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1429-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1430-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1431-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/2404-1434-0x000000007FE40000-0x000000007FE50000-memory.dmp

        Filesize

        64KB

      • memory/3612-1438-0x00000000003B0000-0x000000000062C000-memory.dmp

        Filesize

        2.5MB

      • memory/3612-1439-0x000000001B230000-0x000000001B23E000-memory.dmp

        Filesize

        56KB