Analysis
-
max time kernel
340s -
max time network
451s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15-07-2024 08:59
Static task
static1
Behavioral task
behavioral1
Sample
yfga_game.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
yfga_game.exe
Resource
win10v2004-20240709-en
General
-
Target
yfga_game.exe
-
Size
10.9MB
-
MD5
f24b9a4537d2cf5cd04db5ef80453dd8
-
SHA1
69b201dd4b919afbb4bbe3a19e3e80097e2813bc
-
SHA256
f31ffc12e2212bd27a5e636aa3667451fe1772bea79cf411eea54b84ac31f107
-
SHA512
84936e358accff1767411b019639741ed051e7102a2ebde8bc6e74f87adc3e3f36495538ff53edd181eb9e48256a373f0e06da65ce0824680ff631fe09db90f1
-
SSDEEP
196608:Zw81jWusNrPGC0ePjqHbUjHicQskqPe1Cxcxk3ZAEUadzR8yc4ghrl:O8tWhTr0eqgDiDjqG1Fxk3mEUadzRURH
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
WbVhxCIDDK.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" WbVhxCIDDK.exe -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 31 IoCs
Processes:
description ioc process File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui File opened for modification C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui File opened for modification C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui File opened for modification C:\Windows\SysWOW64\drivers\de-DE File opened for modification C:\Windows\SysWOW64\drivers\es-ES File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui File opened for modification C:\Windows\SysWOW64\drivers\UMDF\en-US File opened for modification C:\Windows\SysWOW64\drivers\gm.dls File opened for modification C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui File opened for modification C:\Windows\SysWOW64\drivers\fr-FR File opened for modification C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui File opened for modification C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui File opened for modification C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui File opened for modification C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui File opened for modification C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui File opened for modification C:\Windows\SysWOW64\drivers\afunix.sys File opened for modification C:\Windows\SysWOW64\drivers\it-IT File opened for modification C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui File opened for modification C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui File opened for modification C:\Windows\SysWOW64\drivers\en-US File opened for modification C:\Windows\SysWOW64\drivers\ja-JP File opened for modification C:\Windows\SysWOW64\drivers\uk-UA File opened for modification C:\Windows\SysWOW64\drivers\UMDF File opened for modification C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui File opened for modification C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui File opened for modification C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui -
Manipulates Digital Signatures 2 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
Processes:
description ioc process File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll File opened for modification C:\Windows\SysWOW64\wintrust.dll -
Possible privilege escalation attempt 4 IoCs
Processes:
icacls.exetakeown.exeicacls.exetakeown.exepid process 3036 icacls.exe 4400 takeown.exe 4756 icacls.exe 2324 takeown.exe -
Processes:
resource yara_rule C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\screenscrew.exe aspack_v212_v242 C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\flasher.exe aspack_v212_v242 -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.execmd.exewin7recovery.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation win7recovery.exe -
Executes dropped EXE 10 IoCs
Processes:
screenscrew.exeflasher.exejokewarehydra.exewalliant.exewalliant.tmpwin7recovery.exeuseroverflow.exeprogramoverflow.exeWbVhxCIDDK.exepid process 4928 screenscrew.exe 3184 flasher.exe 3148 jokewarehydra.exe 1664 walliant.exe 1604 walliant.tmp 2320 win7recovery.exe 3432 useroverflow.exe 632 programoverflow.exe 1532 WbVhxCIDDK.exe 18260 -
Loads dropped DLL 34 IoCs
Processes:
win7recovery.exepid process 2320 win7recovery.exe 2320 win7recovery.exe 18260 18260 18260 18260 18260 18260 18260 18260 18260 18260 18260 18260 18260 18260 18260 18260 18260 18260 18260 18260 18260 18260 18260 18260 2320 win7recovery.exe 18260 18260 18260 18260 2320 win7recovery.exe 2320 win7recovery.exe 2320 win7recovery.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 4400 takeown.exe 4756 icacls.exe 2324 takeown.exe 3036 icacls.exe -
Processes:
resource yara_rule behavioral2/memory/2320-92-0x0000000000600000-0x0000000000678000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
walliant.tmpwin7recovery.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Walliant = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Walliant\\walliant.exe" walliant.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WbVhxCIDDK = "C:\\ProgramData\\WbVhxCIDDK.exe" win7recovery.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 8 IoCs
Processes:
description ioc process File opened for modification C:\Windows\Fonts\desktop.ini File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.19041.1_none_5476a60692fad199\desktop.ini File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.19041.423_none_7c917c97525f1487\desktop.ini File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_11.0.19041.1_none_2108f0881e5a7a03\desktop.ini File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-offlinefavorites_31bf3856ad364e35_11.0.19041.1_none_4b0e6b545bf0f4e7\desktop.ini File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini -
Drops file in System32 directory 64 IoCs
Processes:
description ioc process File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Media-Streaming-WOW64-merged-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Virtualization-RemoteFX-User-Mode-Transport-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat File opened for modification C:\Windows\System32\DriverStore\es-ES\hidvhf.inf_loc File opened for modification C:\Windows\System32\DriverStore\FileRepository\nettcpip.inf_amd64_96215b82eaa40fd5\nettcpip.inf File opened for modification C:\Windows\System32\DriverStore\it-IT\wvmic_kvpexchange.inf_loc File opened for modification C:\Windows\SysWOW64\en-US\DevicePairing.dll.mui File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-AssignedAccess-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DirectoryServices-ADAM-Snapins-Group-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat File opened for modification C:\Windows\System32\DriverStore\es-ES\wvmbushid.inf_loc File opened for modification C:\Windows\SysWOW64\ja-JP\gpprefcl.dll.mui File opened for modification C:\Windows\SysWOW64\AtBroker.exe File opened for modification C:\Windows\SysWOW64\html.iec File opened for modification C:\Windows\SysWOW64\KBDINGUJ.DLL File opened for modification C:\Windows\SysWOW64\ROUTE.EXE File opened for modification C:\Windows\SysWOW64\sdiagnhost.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-msmq-powershell-Opt-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-UpdateTargeting-ClientOS-21h2-EKB-Wrapper-Package~31bf3856ad364e35~amd64~~10.0.19041.1288.cat File opened for modification C:\Windows\SysWOW64\it-IT\at.exe.mui File opened for modification C:\Windows\SysWOW64\gb2312.uce File opened for modification C:\Windows\SysWOW64\mfnetsrc.dll File opened for modification C:\Windows\SysWOW64\Windows.Internal.Management.dll File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-NetFx3-OC-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat File opened for modification C:\Windows\SysWOW64\wbem\it File opened for modification C:\Windows\SysWOW64\SystemPropertiesPerformance.exe File opened for modification C:\Windows\SysWOW64\wldp.dll File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Portable-Devices-WOW64-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat File opened for modification C:\Windows\SysWOW64\de-DE\connect.dll.mui File opened for modification C:\Windows\SysWOW64\Keywords\{A5A7C794-3D59-41DF-915F-19ACDA526FC9}16393.bin File opened for modification C:\Windows\SysWOW64\dplayx.dll File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Multimedia-CastingCommon-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat File opened for modification C:\Windows\SysWOW64\de-DE\inseng.dll.mui File opened for modification C:\Windows\System32\DriverStore\fr-FR\netlldp.inf_loc File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PrintManagement\MSFT_PrinterNfcTag_v1.0.cdxml File opened for modification C:\Windows\SysWOW64\netprovisionsp.dll File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Embedded-DialogBlocking-Package~31bf3856ad364e35~amd64~~10.0.19041.844.cat File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-EnterpriseClientSync-Host-Opt-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_9_for_KB5005699~31bf3856ad364e35~amd64~~19041.1220.1.0.cat File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\es-ES\MSFT_ScriptResource.schema.mfl File opened for modification C:\Windows\SysWOW64\de-DE\stobject.dll.mui File opened for modification C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_5f033e913d34d111 File opened for modification C:\Windows\SysWOW64\es-ES\xwtpdui.dll.mui File opened for modification C:\Windows\SysWOW64\wbem\de-DE\regevent.mfl File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-RemoteFX-VM-Setup-Package~31bf3856ad364e35~amd64~~10.0.19041.928.cat File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmcxhv6.inf_amd64_f1a7a2fbd6554d60\VSTCNXT6.SYS File opened for modification C:\Windows\System32\DriverStore\it-IT\miradisp.inf_loc File opened for modification C:\Windows\SysWOW64\en-US\packager.dll.mui File opened for modification C:\Windows\SysWOW64\es-ES\sndvol.exe.mui File opened for modification C:\Windows\SysWOW64\ras\switch.inf File opened for modification C:\Windows\SysWOW64\es-ES\XInput1_4.dll.mui File opened for modification C:\Windows\SysWOW64\Speech\Engines\SR\es-ES\srloc.dll.mui File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\Microsoft.PowerShell.ODataUtilsHelper.ps1 File opened for modification C:\Windows\SysWOW64\es-ES\avifil32.dll.mui File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetTCPIP\NetIPConfiguration.psm1 File opened for modification C:\Windows\System32\DriverStore\en-US\megasr.inf_loc File opened for modification C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_a2dp_src.inf_amd64_0bdbb11733d87f9a File opened for modification C:\Windows\SysWOW64\es-ES\iccvid.dll.mui File opened for modification C:\Windows\SysWOW64\it-IT\TtlsAuth.dll.mui File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-msmq-dcomproxy-Opt-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-RestrictedCodecsCore-WOW64-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat File opened for modification C:\Windows\System32\DriverStore\FileRepository\hdaudss.inf_amd64_76a0499c8a4b3752\hdaudss.inf File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CoreSystem-DISM-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-NetFx4-US-OC-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat File opened for modification C:\Windows\System32\DriverStore\de-DE\unknown.inf_loc -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\Desktop\WallPaper = "C:\\Windows\\System32\\FeatureToastBulldogImg.png" reg.exe -
Drops file in Program Files directory 64 IoCs
Processes:
description ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\clrcompression.dll File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\msipc.dll.mui File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\AppxManifest.xml File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls File opened for modification C:\Program Files (x86)\Common Files\System\msadc\it-IT\msdaprsr.dll.mui File opened for modification C:\Program Files (x86)\Google\Update File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\PREVIEW.GIF File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-125_contrast-black.png File opened for modification C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-150.png File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PlaceCard File opened for modification C:\Program Files\Common Files\microsoft shared\ink\el-GR File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSOIDCLIL.DLL File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosMedTile.contrast-white_scale-100.png File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe.config File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\en-GB.pak File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetIQ.Diagram.Resources.dll File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\MedTile.scale-125.png File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets File opened for modification C:\Program Files\ModifiableWindowsApps File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notificationsUI\fabric.min.css File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-100.png File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Microsoft.VisualBasic.Forms.resources.dll File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSTYLE.DLL File opened for modification C:\Program Files\Mozilla Firefox\postSigningData File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-16.png File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll File opened for modification C:\Program Files\Java\jdk-1.8\jre\LICENSE File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-48.png File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black.png File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-sl\ui-strings.js File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Context.Tests.ps1 File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Controls File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jscripts File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\KnownGameList.bin File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchStoreLogo.scale-125_contrast-black.png File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\ui-strings.js File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\en_US.aff File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ccloud.png File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black.png File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-32_altform-lightunplated.png File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_contrast-black.png File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libstats_plugin.dll File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Date.targetsize-24_contrast-white.png File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Speech\en-GB\tokens_enGB.xml File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\clrcompression.dll -
Drops file in Windows directory 64 IoCs
Processes:
description ioc process File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\1036 File opened for modification C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\AppVStreamingUX.dll File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..nagement-dmcfgutils_31bf3856ad364e35_10.0.19041.423_none_110a0d6fdac45287\dmcfgutils.dll File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\r\winresume.efi File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.19041.1_none_78045c4b5f61a56c\DefaultSquareTileLogo1.contrast-white_scale-80.png File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-dafmcp_31bf3856ad364e35_10.0.19041.746_none_3d5e8baf52cfa7f0\f\DAFMCP.dll File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000406_31bf3856ad364e35_10.0.19041.1_none_9f6ad5b5022856a8\KBDDA.DLL File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\TileSmall.scale-125.png File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-inputservice_31bf3856ad364e35_10.0.19041.264_none_97cb7233986bbe11\f\Windows.UI.Core.TextInput.dll File opened for modification C:\Windows\INF\RemoteAccess\0411 File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\System.Messaging.resources.dll File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-IIS-WebServer-ServerCommon-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-a..sibility-experience_31bf3856ad364e35_10.0.19041.1_none_41b27ed425707c3a\ew.svg File opened for modification C:\Windows\servicing\Packages\Microsoft-UtilityVM-Containers-Shared-Package~31bf3856ad364e35~amd64~~10.0.19041.264.cat File opened for modification C:\Windows\WinSxS\amd64_dual_wdmaudio.inf_31bf3856ad364e35_10.0.19041.746_none_8cc50abfaa861487\wdmaudio.inf File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fat_31bf3856ad364e35_10.0.19041.1288_none_237ad20a0c93e4f8\fastfat.sys File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\3082\vbc7ui.dll File opened for modification C:\Windows\PolicyDefinitions\de-DE\PenTraining.adml File opened for modification C:\Windows\servicing\Packages\Microsoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_da-dk_7f2a1321ccbad7ec\r File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.KeyDistributionService.Cmdlets.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35 File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Portable-Devices-merged-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-azman_31bf3856ad364e35_10.0.19041.1_none_0c4826b95216e314\azroles.dll File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-certutil.resources_31bf3856ad364e35_10.0.19041.1_it-it_12bea38987ba4ee9\certutil.exe.mui File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..cesetupui.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c4bb1387a5c31826\Dsui.dll.mui File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-iorate.resources_31bf3856ad364e35_10.0.19041.1_es-es_a3c2ce061a29e985\iorate.sys.mui File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35 File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..dservices.resources_31bf3856ad364e35_10.0.19041.1_de-de_aec1da29c9a17c0f\dssite.msc File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_db09942beaf4fdfa\StoreLogo.png File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-hgsclient-wmi_31bf3856ad364e35_10.0.19041.1_none_abe1b9d4f9f05df2\HgsClientWmi_Uninstall.mof File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-http.resources_31bf3856ad364e35_10.0.19041.1_es-es_c8b1c32d75ca0ed3\http.sys.mui File opened for modification C:\Windows\INF\RemoteAccess\0C0A File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\pris\resources.uk-UA.pri File opened for modification C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Toolkit\Resources File opened for modification C:\Windows\WinSxS\amd64_bthprint.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_7a86bee10e280f18\bthprint.inf_loc File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-n..ontroller.resources_31bf3856ad364e35_10.0.19041.1_de-de_7f2674de5477aaa2\NotificationController.dll.mui File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\r\LaunchTM.exe.mun File opened for modification C:\Windows\WinSxS\amd64_dual_keyboard.inf_31bf3856ad364e35_10.0.19041.1_none_c2189405d8fb06a8\i8042prt.sys File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-bootux.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_cfe1fd959678053b\bootux.dll.mui File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.19041.906_tr-tr_574408f40586c01e\f\comdlg32.dll.mui File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\f\ImeBrokerps.dll File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\System.AddIn.resources.dll File opened for modification C:\Windows\WinSxS\amd64_c_smrvolume.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_13e8bb73c705447b\c_smrvolume.inf_loc File opened for modification C:\Windows\WinSxS\amd64_lsi_sss.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_0a4c2498fd308e05\lsi_sss.inf_loc File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..lestorageengine-vss_31bf3856ad364e35_10.0.19041.1_none_6e7b8e97f7444bd4\esevss.dll File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..rvice_mof.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_052bdeb3befe2607\iscsiprf.mfl File opened for modification C:\Windows\INF\hal.inf File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Pipes\v4.0_4.0.0.0__b03f5f7f11d50a3a File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Providers\App_LocalResources\manageProviders.aspx.ja.resx File opened for modification C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\pris\resources.lt-LT.pri File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\r\cmproxyd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-containers-image_31bf3856ad364e35_10.0.19041.1266_none_9f9389286978dca9\wcimage.dll File opened for modification C:\Windows\Fonts\ssef1256.fon File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089 File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-adminkitbranding_31bf3856ad364e35_11.0.19041.1081_none_2ce6664636109b66\r File opened for modification C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-black.png File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands\v4.0_10.0.0.0__31bf3856ad364e35\DefaultWindows_Audit.xml File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem.resources\v4.0_4.0.0.0_fr_b77a5c561934e089 File opened for modification C:\Windows\servicing\Packages\HyperV-Feature-VirtualMachinePlatform-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-48_altform-unplated.png File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\a0c4e776b9d01dd5fe5da7fd2edd1f6f\System.Xaml.ni.dll -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2936 2320 WerFault.exe win7recovery.exe 4812 2320 WerFault.exe win7recovery.exe 840 2320 WerFault.exe win7recovery.exe 4652 2320 WerFault.exe win7recovery.exe 2544 2320 WerFault.exe win7recovery.exe 4628 2320 WerFault.exe win7recovery.exe 844 2320 WerFault.exe win7recovery.exe 3604 1532 WerFault.exe WbVhxCIDDK.exe 2660 2320 WerFault.exe win7recovery.exe 5544 2320 WerFault.exe win7recovery.exe 5736 2320 WerFault.exe win7recovery.exe 5928 2320 WerFault.exe win7recovery.exe 6092 2320 WerFault.exe win7recovery.exe 5492 2320 WerFault.exe win7recovery.exe 5664 2320 WerFault.exe win7recovery.exe 5676 2320 WerFault.exe win7recovery.exe 9836 2320 WerFault.exe win7recovery.exe 15620 2320 WerFault.exe win7recovery.exe 14608 2320 WerFault.exe win7recovery.exe 16420 1532 WerFault.exe WbVhxCIDDK.exe 16480 2320 WerFault.exe win7recovery.exe 7540 1532 WbVhxCIDDK.exe 10116 1532 WbVhxCIDDK.exe 17472 1532 WbVhxCIDDK.exe 17644 1532 WbVhxCIDDK.exe 17748 1532 WbVhxCIDDK.exe 17900 1532 WbVhxCIDDK.exe 18008 1532 WbVhxCIDDK.exe 18164 1532 WbVhxCIDDK.exe 18324 1532 WbVhxCIDDK.exe 15036 1532 WbVhxCIDDK.exe 7896 2320 win7recovery.exe 6064 2320 win7recovery.exe 8868 2320 win7recovery.exe 3144 2320 win7recovery.exe 14328 1532 WbVhxCIDDK.exe 12504 2320 win7recovery.exe 9964 1532 WbVhxCIDDK.exe 14836 2320 win7recovery.exe 11748 2320 win7recovery.exe 12436 2320 win7recovery.exe 9548 2320 win7recovery.exe 7288 2320 win7recovery.exe 13144 2320 win7recovery.exe 1412 2320 win7recovery.exe 12332 2320 win7recovery.exe 9060 2320 win7recovery.exe 13156 2320 win7recovery.exe 7816 2320 win7recovery.exe 5100 2320 win7recovery.exe 14648 2320 win7recovery.exe 7020 2320 win7recovery.exe 11628 2320 win7recovery.exe 5972 2320 win7recovery.exe 10328 2320 win7recovery.exe 14536 2320 win7recovery.exe 13624 2320 win7recovery.exe 952 2320 win7recovery.exe 3924 2320 win7recovery.exe 17580 2320 win7recovery.exe 5080 2320 win7recovery.exe 10004 2320 win7recovery.exe 14388 2320 win7recovery.exe 14032 2320 win7recovery.exe -
Delays execution with timeout.exe 6 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 3260 timeout.exe 2316 timeout.exe 2264 timeout.exe 3096 timeout.exe 4544 timeout.exe 3952 timeout.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
xcopy.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe -
Kills process with taskkill 64 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 7056 taskkill.exe 8532 taskkill.exe 9112 taskkill.exe 15288 taskkill.exe 16368 6892 taskkill.exe 17328 taskkill.exe 17908 7100 6528 taskkill.exe 12876 taskkill.exe 5720 taskkill.exe 13108 376 11588 taskkill.exe 12692 taskkill.exe 9072 17592 4480 7096 taskkill.exe 5672 taskkill.exe 13328 taskkill.exe 15016 taskkill.exe 15792 taskkill.exe 2300 taskkill.exe 7580 taskkill.exe 4440 taskkill.exe 8796 taskkill.exe 15484 taskkill.exe 18320 7756 taskkill.exe 6624 taskkill.exe 8528 taskkill.exe 1464 taskkill.exe 5240 taskkill.exe 7780 taskkill.exe 10620 taskkill.exe 14296 taskkill.exe 5772 taskkill.exe 10568 taskkill.exe 13860 taskkill.exe 3496 taskkill.exe 5992 taskkill.exe 14568 taskkill.exe 15008 1076 taskkill.exe 6140 taskkill.exe 6484 taskkill.exe 6588 taskkill.exe 11712 taskkill.exe 5588 taskkill.exe 15376 taskkill.exe 15932 taskkill.exe 11600 8492 9016 11536 8052 taskkill.exe 1788 taskkill.exe 9408 taskkill.exe 772 taskkill.exe 15164 taskkill.exe 16208 taskkill.exe 9256 taskkill.exe -
Processes:
win7recovery.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\Download win7recovery.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no" win7recovery.exe -
Modifies registry class 3 IoCs
Processes:
cmd.execmd.exewin7recovery.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ win7recovery.exe -
Processes:
description ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a -
Runs regedit.exe 1 IoCs
Processes:
regedit.exepid process 1228 regedit.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 70 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
mspaint.exewin7recovery.exeWbVhxCIDDK.exepid process 636 mspaint.exe 636 mspaint.exe 2320 win7recovery.exe 2320 win7recovery.exe 2320 win7recovery.exe 2320 win7recovery.exe 1532 WbVhxCIDDK.exe 1532 WbVhxCIDDK.exe 2320 win7recovery.exe 2320 win7recovery.exe 1532 WbVhxCIDDK.exe 1532 WbVhxCIDDK.exe 2320 win7recovery.exe 2320 win7recovery.exe 1532 WbVhxCIDDK.exe 1532 WbVhxCIDDK.exe 2320 win7recovery.exe 2320 win7recovery.exe 1532 WbVhxCIDDK.exe 1532 WbVhxCIDDK.exe 2320 win7recovery.exe 2320 win7recovery.exe 1532 WbVhxCIDDK.exe 1532 WbVhxCIDDK.exe 2320 win7recovery.exe 2320 win7recovery.exe 1532 WbVhxCIDDK.exe 1532 WbVhxCIDDK.exe 2320 win7recovery.exe 2320 win7recovery.exe 1532 WbVhxCIDDK.exe 1532 WbVhxCIDDK.exe 2320 win7recovery.exe 2320 win7recovery.exe 1532 WbVhxCIDDK.exe 1532 WbVhxCIDDK.exe 2320 win7recovery.exe 2320 win7recovery.exe 1532 WbVhxCIDDK.exe 1532 WbVhxCIDDK.exe 2320 win7recovery.exe 2320 win7recovery.exe 1532 WbVhxCIDDK.exe 1532 WbVhxCIDDK.exe 2320 win7recovery.exe 2320 win7recovery.exe 1532 WbVhxCIDDK.exe 1532 WbVhxCIDDK.exe 2320 win7recovery.exe 2320 win7recovery.exe 1532 WbVhxCIDDK.exe 1532 WbVhxCIDDK.exe 2320 win7recovery.exe 2320 win7recovery.exe 1532 WbVhxCIDDK.exe 1532 WbVhxCIDDK.exe 2320 win7recovery.exe 2320 win7recovery.exe 1532 WbVhxCIDDK.exe 1532 WbVhxCIDDK.exe 2320 win7recovery.exe 2320 win7recovery.exe 1532 WbVhxCIDDK.exe 1532 WbVhxCIDDK.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
cmd.exewin7recovery.exepid process 1084 cmd.exe 2320 win7recovery.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 2860 taskkill.exe Token: SeDebugPrivilege 3000 taskkill.exe Token: SeDebugPrivilege 3496 taskkill.exe Token: SeDebugPrivilege 1844 taskkill.exe Token: SeDebugPrivilege 4092 taskkill.exe Token: SeDebugPrivilege 2088 taskkill.exe Token: SeDebugPrivilege 1076 taskkill.exe Token: SeDebugPrivilege 940 taskkill.exe Token: SeDebugPrivilege 4756 taskkill.exe Token: SeDebugPrivilege 3496 taskkill.exe Token: SeDebugPrivilege 820 taskkill.exe Token: SeDebugPrivilege 2848 taskkill.exe Token: SeDebugPrivilege 4652 taskkill.exe Token: SeDebugPrivilege 4628 taskkill.exe Token: SeDebugPrivilege 820 taskkill.exe Token: SeDebugPrivilege 844 taskkill.exe Token: SeDebugPrivilege 2256 taskkill.exe Token: SeDebugPrivilege 2376 taskkill.exe Token: SeDebugPrivilege 2324 taskkill.exe Token: SeDebugPrivilege 1544 taskkill.exe Token: SeDebugPrivilege 3520 taskkill.exe Token: SeDebugPrivilege 4652 taskkill.exe Token: SeDebugPrivilege 5132 taskkill.exe Token: SeDebugPrivilege 5204 taskkill.exe Token: SeDebugPrivilege 5244 taskkill.exe Token: SeDebugPrivilege 5304 taskkill.exe Token: SeDebugPrivilege 5364 taskkill.exe Token: SeDebugPrivilege 5436 taskkill.exe Token: SeDebugPrivilege 5528 taskkill.exe Token: SeDebugPrivilege 5640 taskkill.exe Token: SeDebugPrivilege 5728 taskkill.exe Token: SeDebugPrivilege 5836 taskkill.exe Token: SeDebugPrivilege 5872 taskkill.exe Token: SeDebugPrivilege 5992 taskkill.exe Token: SeDebugPrivilege 6040 taskkill.exe Token: SeDebugPrivilege 6140 taskkill.exe Token: SeDebugPrivilege 5240 taskkill.exe Token: SeDebugPrivilege 5356 taskkill.exe Token: SeDebugPrivilege 5512 taskkill.exe Token: SeDebugPrivilege 5524 taskkill.exe Token: SeDebugPrivilege 5640 taskkill.exe Token: SeDebugPrivilege 808 taskkill.exe Token: SeDebugPrivilege 5848 taskkill.exe Token: SeDebugPrivilege 5872 taskkill.exe Token: SeDebugPrivilege 6032 taskkill.exe Token: SeDebugPrivilege 1308 taskkill.exe Token: SeDebugPrivilege 5260 taskkill.exe Token: SeDebugPrivilege 5336 taskkill.exe Token: SeDebugPrivilege 5508 taskkill.exe Token: SeDebugPrivilege 2176 taskkill.exe Token: SeDebugPrivilege 4404 taskkill.exe Token: SeDebugPrivilege 5736 taskkill.exe Token: SeDebugPrivilege 5932 taskkill.exe Token: SeDebugPrivilege 6108 taskkill.exe Token: SeDebugPrivilege 5488 taskkill.exe Token: SeDebugPrivilege 2176 taskkill.exe Token: SeDebugPrivilege 5852 taskkill.exe Token: SeDebugPrivilege 6032 taskkill.exe Token: SeDebugPrivilege 5496 taskkill.exe Token: SeDebugPrivilege 5672 taskkill.exe Token: SeDebugPrivilege 3472 taskkill.exe Token: SeDebugPrivilege 2300 taskkill.exe Token: SeDebugPrivilege 6168 taskkill.exe Token: SeDebugPrivilege 6244 taskkill.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
Processes:
jokewarehydra.exewalliant.tmppid process 3148 jokewarehydra.exe 3148 jokewarehydra.exe 3148 jokewarehydra.exe 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 1604 walliant.tmp 18260 -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
pid process 18260 -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
mspaint.exewin7recovery.exepid process 636 mspaint.exe 636 mspaint.exe 636 mspaint.exe 636 mspaint.exe 2320 win7recovery.exe 2320 win7recovery.exe 2320 win7recovery.exe 18260 18260 2320 win7recovery.exe 2320 win7recovery.exe 2320 win7recovery.exe 2320 win7recovery.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
yfga_game.execmd.execmd.exewalliant.exedescription pid process target process PID 1388 wrote to memory of 2128 1388 yfga_game.exe cmd.exe PID 1388 wrote to memory of 2128 1388 yfga_game.exe cmd.exe PID 1388 wrote to memory of 2128 1388 yfga_game.exe cmd.exe PID 2128 wrote to memory of 4928 2128 cmd.exe screenscrew.exe PID 2128 wrote to memory of 4928 2128 cmd.exe screenscrew.exe PID 2128 wrote to memory of 4928 2128 cmd.exe screenscrew.exe PID 2128 wrote to memory of 3184 2128 cmd.exe flasher.exe PID 2128 wrote to memory of 3184 2128 cmd.exe flasher.exe PID 2128 wrote to memory of 3184 2128 cmd.exe flasher.exe PID 2128 wrote to memory of 2324 2128 cmd.exe takeown.exe PID 2128 wrote to memory of 2324 2128 cmd.exe takeown.exe PID 2128 wrote to memory of 2324 2128 cmd.exe takeown.exe PID 2128 wrote to memory of 3036 2128 cmd.exe icacls.exe PID 2128 wrote to memory of 3036 2128 cmd.exe icacls.exe PID 2128 wrote to memory of 3036 2128 cmd.exe icacls.exe PID 2128 wrote to memory of 2012 2128 cmd.exe cmd.exe PID 2128 wrote to memory of 2012 2128 cmd.exe cmd.exe PID 2128 wrote to memory of 2012 2128 cmd.exe cmd.exe PID 2128 wrote to memory of 4400 2128 cmd.exe takeown.exe PID 2128 wrote to memory of 4400 2128 cmd.exe takeown.exe PID 2128 wrote to memory of 4400 2128 cmd.exe takeown.exe PID 2012 wrote to memory of 3148 2012 cmd.exe jokewarehydra.exe PID 2012 wrote to memory of 3148 2012 cmd.exe jokewarehydra.exe PID 2012 wrote to memory of 3148 2012 cmd.exe jokewarehydra.exe PID 2128 wrote to memory of 1664 2128 cmd.exe walliant.exe PID 2128 wrote to memory of 1664 2128 cmd.exe walliant.exe PID 2128 wrote to memory of 1664 2128 cmd.exe walliant.exe PID 2128 wrote to memory of 4756 2128 cmd.exe icacls.exe PID 2128 wrote to memory of 4756 2128 cmd.exe icacls.exe PID 2128 wrote to memory of 4756 2128 cmd.exe icacls.exe PID 1664 wrote to memory of 1604 1664 walliant.exe walliant.tmp PID 1664 wrote to memory of 1604 1664 walliant.exe walliant.tmp PID 1664 wrote to memory of 1604 1664 walliant.exe walliant.tmp PID 2128 wrote to memory of 3968 2128 cmd.exe xcopy.exe PID 2128 wrote to memory of 3968 2128 cmd.exe xcopy.exe PID 2128 wrote to memory of 3968 2128 cmd.exe xcopy.exe PID 2012 wrote to memory of 2340 2012 cmd.exe WScript.exe PID 2012 wrote to memory of 2340 2012 cmd.exe WScript.exe PID 2012 wrote to memory of 2340 2012 cmd.exe WScript.exe PID 2128 wrote to memory of 3520 2128 cmd.exe reg.exe PID 2128 wrote to memory of 3520 2128 cmd.exe reg.exe PID 2128 wrote to memory of 3520 2128 cmd.exe reg.exe PID 2128 wrote to memory of 2860 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2860 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 2860 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 4828 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 4828 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 4828 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1596 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1596 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 1596 2128 cmd.exe taskkill.exe PID 2128 wrote to memory of 3260 2128 cmd.exe timeout.exe PID 2128 wrote to memory of 3260 2128 cmd.exe timeout.exe PID 2128 wrote to memory of 3260 2128 cmd.exe timeout.exe PID 2128 wrote to memory of 2088 2128 cmd.exe shutdown.exe PID 2128 wrote to memory of 2088 2128 cmd.exe shutdown.exe PID 2128 wrote to memory of 2088 2128 cmd.exe shutdown.exe PID 2128 wrote to memory of 1084 2128 cmd.exe cmd.exe PID 2128 wrote to memory of 1084 2128 cmd.exe cmd.exe PID 2128 wrote to memory of 1084 2128 cmd.exe cmd.exe PID 2128 wrote to memory of 2316 2128 cmd.exe timeout.exe PID 2128 wrote to memory of 2316 2128 cmd.exe timeout.exe PID 2128 wrote to memory of 2316 2128 cmd.exe timeout.exe PID 2128 wrote to memory of 4796 2128 cmd.exe shutdown.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
win7recovery.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System win7recovery.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" win7recovery.exe -
Views/modifies file attributes 1 TTPs 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\yfga_game.exe"C:\Users\Admin\AppData\Local\Temp\yfga_game.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\YFGA.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\screenscrew.exescreenscrew.exe3⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\flasher.exeflasher.exe3⤵
- Executes dropped EXE
PID:3184 -
C:\Windows\SysWOW64\takeown.exetakeown C:\Windows\System32\logonui.exe Admin3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2324 -
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\System32\logonui.exe Grant:\Admin3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K hydra.cmd3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\jokewarehydra.exejokewarehydra.exe4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:3148 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy3.vbs"4⤵PID:2340
-
C:\Windows\SysWOW64\takeown.exetakeown C:\Windows\Boot\Fonts\* Admin3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4400 -
C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\walliant.exewalliant.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\is-UPTG9.tmp\walliant.tmp"C:\Users\Admin\AppData\Local\Temp\is-UPTG9.tmp\walliant.tmp" /SL5="$601CE,4511977,830464,C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\walliant.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
PID:1604 -
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\Boot\Fonts\* Grant:\Admin3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4756 -
C:\Windows\SysWOW64\xcopy.exexcopy C:\Windows\Fonts\seguisym.ttf C:\Windows\Boot\Fonts\segoe_slboot.ttf /y3⤵
- Enumerates system info in registry
PID:3968 -
C:\Windows\SysWOW64\reg.exereg import reg.reg3⤵
- Sets desktop wallpaper using registry
PID:3520 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fontdrvhost.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2860 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im TextInputhost.exe3⤵PID:4828
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵PID:1596
-
C:\Windows\SysWOW64\timeout.exetimeout 53⤵
- Delays execution with timeout.exe
PID:3260 -
C:\Windows\SysWOW64\shutdown.exeshutdown /r /t 30000 /c "HAHA I HACKED YOU AYFGA ROCKS YOU"3⤵PID:2088
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K spam.bat "forkbomb" /min3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1084 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:3720
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3000 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3496 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:784
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:1240
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1844 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4092 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:2860
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:3260
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2088 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1076 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:2512
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:4908
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:940 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4756 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:2304
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:3196
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3496 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:820 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:2592
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:3640
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2848 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4652 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:2936
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:4364
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4628 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:820 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:3820
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:456
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:844 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2256 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:4076
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:2644
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2376 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2324 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:1844
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:1784
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1544 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3520 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:2200
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:620
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4652 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5132 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5160
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5180
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5204 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5244 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5276
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5292
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5304 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5364 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5396
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5420
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5436 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5528 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5576
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5596
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5640 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5728 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5776
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5788
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5836 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5872 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5944
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5976
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5992 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:6040 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6100
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6132
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6140 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5240 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5268
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5252
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5356 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5512 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5532
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:3608
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5524 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5640 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:4100
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5768
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:808 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5848 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5916
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5904
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5872 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:6032 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6084
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6076
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1308 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5260 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5132
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5240
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5336 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5508 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5656
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5624
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2176 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4404 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:1660
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5912
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5736 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5932 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:788
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:1344
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:6108 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5488 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5572
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5644
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2176 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5852 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:1556
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5736
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:6032 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5496 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:2180
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:2176
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5672 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3472 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5484
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5860
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2300 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:6168 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6196
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6216
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:6244 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6280
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6324
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6340
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6384
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6416
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6444
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6464
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:6484 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:6528 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6556
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6572
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:6588 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6640
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6668
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6684
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6692
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6752
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6784
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6804
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6820
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6868
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6896
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6924
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6932
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6980
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7008
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7024
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:7056 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:7092
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7124
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7140
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:7148
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6172
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6272
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6244
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6396
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6424
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6504
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6520
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6484
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6664
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6728
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6748
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6764
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6880
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6956
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6960
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6932
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:7056
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7092
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7148
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:3204
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6412
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6508
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6616
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6316
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:2740
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:824
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6640
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6644
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6764
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6880
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6992
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:7096 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6396
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:1012
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:828
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6772
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6884
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6428
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6188
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6304
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6888
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:2828
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6884
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:4440
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:7176
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7204
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7216
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:7252
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:7288
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7316
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7336
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:7344
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:7400
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7428
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7448
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:7456
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:7516
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7544
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7572
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:7580 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:7644
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7672
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7692
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:7704
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:7756 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7788
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7796
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:7808
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:7872
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7900
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7924
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:7948
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:7988
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8016
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:8024
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:8052 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:8104
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8132
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:8152
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:8160
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:4440 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7176
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7252
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:7292
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:7344
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7408
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7496
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:7456
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:7636
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7644
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7728
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:7780 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:7864
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7892
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7976
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:7964
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:8056
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6432
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7192
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:8100
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:7604
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7652
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7636
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:7828
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:8084
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8092
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:8104
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:8124
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:7616
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8088
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7808
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:8052
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:3200
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7616
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:1496
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:7600
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:8228
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8256
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:8272
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:8280
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:8352
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8384
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:8396
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:8404
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:8476
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8508
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:8520
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:8532 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:8604
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8640
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:8660
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:8676
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:8732
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8776
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:8784
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:8804
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:8868
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8896
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:8916
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:8924
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:8988
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:9028
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:9048
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:9060
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:9112 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:9144
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:9152
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:9212
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:7540
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8252
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:8232
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:8236
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:8448
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:4396
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:8484
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:8576
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:8344
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8608
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:3012
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:8748
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:8880
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8968
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:8972
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:8924
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:9136
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8200
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:9212
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:8052
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:8420
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8576
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:8628
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:8612
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:8880
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:9200
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:9112
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:1788 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:3604
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5228
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5288
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:4292
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:5124
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5272
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5360
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:5636
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:9268
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:9304
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:9336
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:9356
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:9404
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:9440
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:9460
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:9480
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:9544
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:9580
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:9596
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:9608
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:9672
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:9732
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:9760
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:9768
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:9856
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:9904
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:9948
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:9956
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:10012
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:10048
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10072
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:10104
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:10140
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:10184
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10204
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:10216
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:9292
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:208
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:1748
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:9380
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:9504
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:9564
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5060
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:9640
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:9808
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:9852
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:9540
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6060
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:9960
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:10016
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10020
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:10152
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:9256
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:9288
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:2020
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:9408 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6108
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:9640
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:9832
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:772 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:10036
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:10148
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10216
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:5832
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:9684
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:3824
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:9960
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6256
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:6624 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:9508
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6612
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6920
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:10288
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:10336
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10356
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:10380
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:10436
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:10468
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10488
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:10500
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:10572
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:10600
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10608
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:10620 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:10704
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:10732
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10752
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:10768
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:10832
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:10876
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10904
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:10912
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:10972
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:11008
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:11016
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11048
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:11108
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:11144
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:11156
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11200
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:11240
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:9968
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6156
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:10308
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:10436
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:10520
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10532
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:4656
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:3924
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:10620
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:4400
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:3440
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:10828
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:10856
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10684
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:3616
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:6892 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:11116
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10960
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11204
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:4716
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:4048
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10320
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:10644
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:4236
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:10940
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7468
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11124
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:11216
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:4736
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10772
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11084
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:11204
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:11260
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7936
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:7612
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:11316
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:11364
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:11392
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11408
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:11460
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:11504
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:11524
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11532
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:11588 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:11632
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:11664
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11680
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:11736
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:11764
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:11776
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11788
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:11880
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:11908
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:11924
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11932
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:12016
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:12048
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:12064
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:12076
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:12152
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:12208
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:12224
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:12276
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:11272
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:11320
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:11444
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11440
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:11536
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:11588
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:11708
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11712
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:11800
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:11660
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:11936
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11944
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:2780
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:12104
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:12124
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11292
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:11332
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:864
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:4368
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11420
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:11712 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8460
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:11880
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:12016
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6320
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:11088
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:3544
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:3620
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:7952
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8728
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:11740
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:5056
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:11900
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8964
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10400
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6320
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:11332
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7952
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:11532
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:4712
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:4384
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:11268
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:11272
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:3388
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:4384
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8736
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:2884
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:4384
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:12328
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:12360
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:12376
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:12388
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:12468
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:12508
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:12520
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:12572
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:12600
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:12644
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:12672
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:12692 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:12740
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:12776
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:12804
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:12816
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:12876 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:12916
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:12944
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:12952
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:13016
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:13052
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:13068
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:13084
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:13144
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:13184
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:13208
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:13248
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:13284
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:1596
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:3000
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:4384
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:3516
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:12464
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:12460
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:12476
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:12624
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:12728
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:12704
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:9388
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:12844
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5536
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:12892
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:9660
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:9756
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:13088
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:13084
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:13156
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:5720 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5756
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:12344
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:5200
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:3776
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:1768
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:12608
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:12612
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:5672 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:12844
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10128
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:9660
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:9424
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6584
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10224
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:5720
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6828
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:12468
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5628
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:3492
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:3132
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:10260
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6364
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:9660
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:9424
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:776
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5320
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:1668
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:1912
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5672
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6964
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:10816
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:12768
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:3492
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:4328
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11076
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:7076
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6516
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:11076
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:10312
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:13328 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:13356
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:13372
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:13384
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:13460
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:13488
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:13500
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:13552
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:13588
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:13632
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:13652
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:13676
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:13736
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:13764
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:13784
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:13800
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:13864
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:13912
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:13928
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:13940
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:14024
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:14052
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:14064
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:14084
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:14156
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:14184
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:14212
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:14220
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:14284
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:14320
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10576
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:10548
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:3404
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:13484
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:13468
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:13572
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:13608
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:4228
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7712
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:13760
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:13800
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7568
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7912
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:13960
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:14032
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:13904
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7284
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:14180
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:14296 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7744
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7116
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11824
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:13556
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:13608
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:12140
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:13824
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:10768
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:12148
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:14036
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:14028
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:4444
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:14240
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:11244
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11656
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:13572
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8544
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7552
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:13824
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:13568
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:14028
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:14160
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11580
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:12028
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5040
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:11788
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11556
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:11432
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:4040
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:912
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:8412
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:8712
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8996
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:2024
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11388
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:8528
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8712
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:3484
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:3156
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:8528 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:12560
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:1296
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:5588 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:14352
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:14380
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:14408
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:14416
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:14480
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:14524
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:14544
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:14568 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:14612
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:14656
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:14672
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:14684
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:14740
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:14784
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:14796
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:14844
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:14872
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:14916
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:14944
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:14952
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:15016
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:15048
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:15072
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:15080
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:15148
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:15192
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:15208
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:15220
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:15288 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:15332
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:15352
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:9348
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6120
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:12836
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:14456
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:5528
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:5772 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:14580
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:9740
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:13100
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:14764
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:10056
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10828
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:1168
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:14888
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:14900
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:1736
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:5848
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:15016 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5936
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:15120
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:15164 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:15264
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:15040
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:15300
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:15292
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:14372
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6580
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:9588
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:14484
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6028
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:14684
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:772
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:9488
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:1168
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:5680
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10364
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:14988
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:10568 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:9876
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:15168
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6692
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:5152
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:14356
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:14372
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:1464 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:13100
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:3832
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:11448
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:9256
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:10248
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:4644
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5220
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:14988
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:10744
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6168
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:5152
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6408
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6028
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7588
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:6316
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:9256 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:13860 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:6904
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7824
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6828
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:5104
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:14124
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:11372
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6524
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:7312
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:13956
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:13644
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:6408
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:10568
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7948
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:13584
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:11948
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:6524
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:13328
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:7580
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:12236
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:15376 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:15428
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:15448
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:15464
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:15512
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:15556
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:15572
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:15588
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:15664
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:15692
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:15708
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:15720
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:15792 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:15824
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:15836
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:15848
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:15932 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:15960
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:15972
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:15984
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:16092
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:16136
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:16152
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:16184
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:16228
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:16268
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:16296
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:16324
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:16360
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:11324
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:11404
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:10972
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:15484 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7960
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:8188
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:15512
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:15620
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:15688
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:15668
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:8796 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:15816
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:8292
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:3680
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:4964
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:4056
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:16072
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:15808
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:16036
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:8492
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:16188
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:8184
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:16244
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:16324
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7964
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:8280
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:8892
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:15484
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:7660
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:12536
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:15412
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:1924
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:12784
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:15880
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:15868
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:14608
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:16036
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:16216
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:16208 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:14836
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:16324
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:10972
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:3392
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:3232
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:15468
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:8944
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:9168
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:10156
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:16496
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:16516
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:16524
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:16604
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:16648
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:16668
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:16692
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:16740
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:16768
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:16796
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:16804
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:16864
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:16904
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:16936
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:16948
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:17032
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:17068
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:17084
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:17096
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵PID:17184
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:17228
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy.vbs"4⤵PID:17244
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵PID:17256
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regedit.exe4⤵
- Kills process with taskkill
PID:17328 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\annoy2.vbs"4⤵PID:17356
-
C:\Windows\SysWOW64\timeout.exetimeout 53⤵
- Delays execution with timeout.exe
PID:2316 -
C:\Windows\SysWOW64\shutdown.exeshutdown /a3⤵PID:4796
-
C:\Windows\SysWOW64\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
PID:2264 -
C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\win7recovery.exewin7recovery.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2320 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 6044⤵
- Program crash
PID:2936 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 9364⤵
- Program crash
PID:4812 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 9444⤵
- Program crash
PID:840 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 9444⤵
- Program crash
PID:4652 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 10164⤵
- Program crash
PID:2544 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 10084⤵
- Program crash
PID:4628 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 10644⤵
- Program crash
PID:844 -
C:\ProgramData\WbVhxCIDDK.exe"C:\ProgramData\WbVhxCIDDK.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1532 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 5845⤵
- Program crash
PID:3604 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 5845⤵
- Program crash
PID:16420 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 8044⤵
- Program crash
PID:2660 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 16564⤵
- Program crash
PID:5544 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 17284⤵
- Program crash
PID:5736 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 17124⤵
- Program crash
PID:5928 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 18404⤵
- Program crash
PID:6092 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 20564⤵
- Program crash
PID:5492 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 21124⤵
- Program crash
PID:5664 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 21804⤵
- Program crash
PID:5676 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 10404⤵
- Program crash
PID:9836 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 22204⤵
- Program crash
PID:15620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 13564⤵
- Program crash
PID:14608 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 12924⤵
- Program crash
PID:16480 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im WScript.exe3⤵PID:4580
-
C:\Windows\SysWOW64\timeout.exetimeout 123⤵
- Delays execution with timeout.exe
PID:3096 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:4544 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵PID:2408
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe3⤵PID:3824
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im WScript.exe3⤵PID:3600
-
C:\Windows\SysWOW64\shutdown.exeshutdown /a3⤵PID:4076
-
C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\useroverflow.exeuseroverflow.exe3⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\Desktop\yfga_game_34045056-240b-4727-bf76-1be499083996\programoverflow.exeprogramoverflow.exe3⤵
- Executes dropped EXE
PID:632 -
C:\Windows\SysWOW64\notepad.exenotepad.exe3⤵PID:4428
-
C:\Windows\SysWOW64\regedit.exeregedit.exe3⤵
- Runs regedit.exe
PID:1228 -
C:\Windows\SysWOW64\mspaint.exemspaint.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:636 -
C:\Windows\SysWOW64\charmap.execharmap.exe3⤵PID:4348
-
C:\Windows\SysWOW64\timeout.exetimeout 213⤵
- Delays execution with timeout.exe
PID:3952
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:4168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2320 -ip 23201⤵PID:728
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:1848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2320 -ip 23201⤵PID:4628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2320 -ip 23201⤵PID:816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2320 -ip 23201⤵PID:2592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2320 -ip 23201⤵PID:4200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2320 -ip 23201⤵PID:3212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2320 -ip 23201⤵PID:3520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1532 -ip 15321⤵PID:4332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2320 -ip 23201⤵PID:3392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2320 -ip 23201⤵PID:5504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2320 -ip 23201⤵PID:5708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2320 -ip 23201⤵PID:5892
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2320 -ip 23201⤵PID:6072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2320 -ip 23201⤵PID:5368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2320 -ip 23201⤵PID:5672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2320 -ip 23201⤵PID:5496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2320 -ip 23201⤵PID:9792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2320 -ip 23201⤵PID:3476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2320 -ip 23201⤵PID:8284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1532 -ip 15321⤵PID:8284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2320 -ip 23201⤵PID:16456
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ce9564f1a1bb9d09693629dcfab40356
SHA1f29a70fb365cc6789ec60f9fae9478f36a809902
SHA25662ef98b00232f9d63a647e201abfb354582d3fbc342ec63df15b2a0ce514b5a6
SHA512da9712b7e550595fd924bd0c9752e4100f9fa3a33c4e36d1c3c87058f9cd018f90fff54e5d036f3a10a45815b178c3267eae2f55239d2789930ba696446b2162
-
Filesize
114B
MD5e89f75f918dbdcee28604d4e09dd71d7
SHA1f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA2566dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
SHA5128df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0
-
Filesize
23KB
MD535cbdbe6987b9951d3467dda2f318f3c
SHA1c0c7bc36c2fb710938f7666858324b141bc5ff22
SHA256e4915f18fd6713ee84f27a06ed1f6f555cdbebe1522792cf4b4961664550cf83
SHA512e1f456f0b4db885f8475d2837f32f31c09f4b303c118f59be4786cf4303a31a2d3004656a3fcfbbf354326ed404afcb4d60966bca04a5e5de8fb8feaf581bce7
-
Filesize
114KB
MD5bf6a0f5d2d5f54ceb5b899a2172a335b
SHA1e8992a9d4aeb39647b262d36c1e28ac14702c83e
SHA25632ef07a1a2954a40436d625814d0ce0e04f4a45e711beebc7e159d4c1b2556b6
SHA51249a093345160b645209f4fc806ae67a55ff35e50f54c9fa7ec49d153743e448db9c2fafae61659165d0082fabc473c3e7d47573a481161ddb4c9b5fdd079fc90
-
Filesize
495KB
MD5283544d7f0173e6b5bfbfbc23d1c2fb0
SHA13e33b2ef50dac60b7411a84779d61bdb0ed9d673
SHA2569165e595b3a0de91ac91a38e742597e12ebb2a5a8fa53058d964a06ceaef7735
SHA512150b45cd43dc5cf191c85524c15dea09fbb48766ad802851270eaacfd73f3d097fef8dcf0ea042184220e7bc71413677d88a206d8bbe60374986e4789054040b
-
Filesize
72KB
MD5c1a31ab7394444fd8aa2e8fe3c7c5094
SHA1649a0915f4e063314e3f04d284fea8656f6eb62b
SHA25664b7231eda298844697d38dd3539bd97fe995d88ae0c5e0c09d63a908f7336c4
SHA5123514a69552dd1e1b63a235d7e3a1e982a72a9741ade4a931fc8d8e61f402228ad3243be9321d87fdefdfe137fc357925a931966266ec58c19296adb210be9b0e
-
Filesize
378KB
MD5f5ee17938d7c545bf62ad955803661c7
SHA1dd0647d250539f1ec580737de102e2515558f422
SHA2568a791af9e3861e231662b657098a823b21a084cbb6a4901d6ccf363405849a78
SHA512669a89ad811cda4f3ff4aa318aa03e26e4cb41ea22bc321bad02a671273d867cbd223a64bb30da592a5484a9f1cec77c96f5bf63b1fe586b6d3688b8c9da530c
-
Filesize
11.3MB
MD5fddc7534f3281feb4419da7404d89b4c
SHA119bdefc2c9e0abd03fe5ee4fad9c813a837f844f
SHA256f13da9813fa11b81ee4180794cbad2b280422716a080bf4c0791996be7f7908e
SHA512c5428179dc222366234125bd78f63a9350c9329e4d46646bb3361de143974d261bd7a8df6155bc7ef46ad3725302837f4769a26459b8b4b5b5304a810303b1ea
-
Filesize
257KB
MD560d3737a1f84758238483d865a3056dc
SHA117b13048c1db4e56120fed53abc4056ecb4c56ed
SHA2563436c29dec2c7f633f4766acaf334f6c395d70ea6180c0ea7c1610591d5d89b9
SHA512d34f42b59349f3be1ac39a57207f616a44f56a6c74157be8116fff5df75275928065065a89f10bd79849e58b14d1e5e0ea156be5996ff8ca4f5d854e107c96fe
-
Filesize
1KB
MD5b492287271363085810ef581a1be0fa3
SHA14b27b7d87e2fdbdda530afcda73784877cc1a691
SHA256a5fcca5b80f200e9a3ff358d9cac56a0ffabb6f26d97da7f850de14f0fb2709e
SHA512859fa454d8a72771038dc2ff9e7ec3905f83a6a828cc4fc78107b309bdcd45724c749357011af978163f93e7096eb9e9419e3258ea9bd6b652154fe6dd01d036
-
Filesize
114B
MD5d725d85cc5f30c0f695b03a9e7d0c4c0
SHA1131b68adcddb7ff3b3ce9c34c5277eb5d673f610
SHA2564d4588c42fa8df0ea45ad48aca4511bb4286f0deaa41fdf188c3b7ab9e1b698a
SHA51201f270a15aa10e60e14ac140ccb54e38cf8e57833ef1c0db7d36688a93ecdc0a59ecf9ead9366a5920faac7e28a2e0ee03759eb0fa92d455abc72f406fe8775b
-
Filesize
6KB
MD5e4211d6d009757c078a9fac7ff4f03d4
SHA1019cd56ba687d39d12d4b13991c9a42ea6ba03da
SHA256388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
SHA51217257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e
-
Filesize
2.5MB
MD562e5dbc52010c304c82ada0ac564eff9
SHA1d911cb02fdaf79e7c35b863699d21ee7a0514116
SHA256bd54ad7a25594dc823572d9b23a3490ff6b8b1742a75e368d110421ab08909b2
SHA512b5d863ea38816c18f7778ef12ea4168ceb0dae67704c0d1d4a60b0237ca6e758c1dfc5c28d4fc9679b0159de25e56d5dfff8addacd7a9c52572674d90c424946
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms
Filesize5KB
MD5250536878dc3ff157fd6a0ae1e7b7283
SHA17ee61c172973aac1f3bac08536f9e819e20e128f
SHA25634ec4a5b108929f6241ef55fd4775a0b8d8a7c829701ddceb464e0817a87ea8b
SHA512c1b823da584384fabf34f6cc7abc5420aed55364a45a0a2edfa7d05364d974a5851efc0b2e3e71c2ccb0e86ec283d9ff3b8873d2c2f227826f8b6cb4c571db54
-
Filesize
1KB
MD57357406b4e49ee4e20c53ec47373d20e
SHA10a302cdfc3f23ccf07dda46089824e4ccc99ffa6
SHA2565d2e84563ea8baa662a2df2eeec0084eefc6e0c3bdcb52e4575e4ab4a674b697
SHA512f8f89366fa1b60e32d0b2205b0150413c1e20c419c2062d6a972094cf0ee89d296763eaba79a741d40bc05a5d9cc4d52b949fd205165bee15a428c02662c9dca
-
Filesize
1KB
MD505c6af7c741e910e0546a8067f5c0c91
SHA184c99161e17a02d9db44f7bc77bdaf992025a561
SHA2562d815d2e59574acfb023f2a5dcf03c01ab65f0a8b72ed372ef88b836b10e211f
SHA512dc40eda66933d8743fd54e6f694dac3716d7cf7a332016b472a27f093f414e4e47ff0035c29b8db8dafa1e963c75b748f270f940fc082f1e3d7b2fb242eba423
-
Filesize
50B
MD53167d161336cbd296dc579d2295b0f22
SHA153253e5841e6a7a7a1b8bd08378af0a96b2f9a98
SHA256307879bf0d9bec07bab240b5010434801fbee520c99c5a617e8ac630f42dde80
SHA51262af8fa0c9a30ec6aa9b552fcac1879af1f00f5ceb48a77718b2a8e042e3524e2cd299f26fcde31ad8abf2dcb94d15cf45ecbce0bd5f9f93f44aca6327aa53ea
-
Filesize
44B
MD59a2ccbd3e2f1a2382fed7674c28dd086
SHA1b466bdd2079575c938de65285f02739143ecb170
SHA2564519cd5997afce27129ef943f121972f7b0b34aa018e4dd408892fc5c39bb59e
SHA5128929493211c17a8e99b908a8305dbebe2d96e1b54426e89ddba84c2010a86d7f6d0983080f29fa1ab7a0687d536c0546278b9fffe4560d84e4012f243f344d78
-
Filesize
56B
MD519cf22e8d63e787913b6617542211e19
SHA18c3d2f43025e5c4ef70e0c4d1f36692361f51b1f
SHA256dbec312d736f8a56f94ace99986d95d4355ef644a2fd908da1ff4c8b0a003979
SHA5128b9d192dd7f175e63aebcdfc8426876fa8bf3ae00d3cf10bb8fcf0d0c262b906de28784f5b97141f656e87bb548d343b8d5a127c06ecb407289e91f3fc199608
-
Filesize
246KB
MD59254ca1da9ff8ad492ca5fa06ca181c6
SHA170fa62e6232eae52467d29cf1c1dacb8a7aeab90
SHA25630676ad5dc94c3fec3d77d87439b2bf0a1aaa7f01900b68002a06f11caee9ce6
SHA512a84fbbdea4e743f3e41878b9cf6db219778f1479aa478100718af9fc8d7620fc7a3295507e11df39c7863cb896f946514e50368db480796b6603c8de5580685a
-
Filesize
47B
MD55e578014c7017a85ca32f0b7e5d7df7f
SHA1c88d8e7179fcc070d4419be9f4d8647354c2f6ed
SHA256a964a717e3c47cb7d274e98928ca1271377d0d76a8908448e1b70e63af4082ad
SHA5127eb206b0cbc2a9b744246d8a83b2fccc70204c6e777b0fcbb838e63d477fe047d8827f3c0de823d55b9ab5cba2ab572ff3f543f76a3451fa81b31584cc767106
-
Filesize
43KB
MD5b2eca909a91e1946457a0b36eaf90930
SHA13200c4e4d0d4ece2b2aadb6939be59b91954bcfa
SHA2560b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c
SHA512607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf
-
Filesize
566KB
MD5c4aab3b24b159148d6d47a9e5897e593
SHA17061c2e85de9f3fd51cccdecb8965f1e710d1fe5
SHA25603a4d3563a7519542c662b5fd5d61215f3d76a3902717efe11230292ea4bbafc
SHA5129bc522ff0d598a1f1425a09a2794584c4991a99bc382b0ee9135311950cdbf2f5331ae041a4b01052735b5fae3a2763ea1b5c01ce679b07fba73c6f75cb4c252
-
Filesize
25KB
MD5aebe09cd7095ec201dc8acc350443242
SHA1df7337e051bd02e1fdd4005b63ed45b8ca3d9726
SHA256405d47dca73a5d6180db42e90c35931047c666ed1f1d6fab5ead6110c2356cc7
SHA512ffc658faf04fee47c1284d439a4c5b3931d2f9bcac9b40e36f59ad0ed4917f0252e639284f817ca84a6da57552f8e0fdf96936987c3f5cf689a537e42b47288d
-
Filesize
111KB
MD5e87a04c270f98bb6b5677cc789d1ad1d
SHA18c14cb338e23d4a82f6310d13b36729e543ff0ca
SHA256e03520794f00fb39ef3cfff012f72a5d03c60f89de28dbe69016f6ed151b5338
SHA5128784f4d42908e54ecedfb06b254992c63920f43a27903ccedd336daaeed346db44e1f40e7db971735da707b5b32206be1b1571bc0d6a2d6eb90bbf9d1f69de13
-
Filesize
158B
MD54af4ab45205580fecf659dd857522f6b
SHA178ec5ff7647ca56d8c8d72b4da551efa86e53675
SHA256b997f3a0d79493418f3e9da03dd95aea6b45b8a8c454e8e7d1f06de3ad3e1111
SHA512f77c7b4d034def85c363805fe625aefb4e461770418f9015d4d5241fb8d09707b9918d54e9b2cc35d06008097174cdda0bee9702466fe7e097014794fe4d77cb
-
Filesize
578KB
MD5533d78fdd538bbeee31fb0b72a8cfb7c
SHA1cb0e46804e784525f5bece40d51772bbdd9a5dc4
SHA256b7a4fcc7f474c091edc09349af5e53915d23f14071d78a3026c92c49d2467989
SHA51285e393cbdd2b20da8892173c7951ddf8e75dbfa29cf81fa725a2da56e606b848ea8a6636528d4fe26eca5e6b251406ec870242fe0d44e7863bf22c739d7759d5
-
Filesize
5.0MB
MD5929335d847f8265c0a8648dd6d593605
SHA10ff9acf1293ed8b313628269791d09e6413fca56
SHA2566613acb18cb8bf501fba619f04f8298e5e633cb220c450212bbc9dd2bef9538d
SHA5127c9a4d1bec430503cc355dc76955d341e001b06196d4b508cc35d64feb2e8ba30e824e7c3a11c27135d7d99801f45f62a5b558563b4c78f89f5d156a929063fd
-
Filesize
3.4MB
MD584c82835a5d21bbcf75a61706d8ab549
SHA15ff465afaabcbf0150d1a3ab2c2e74f3a4426467
SHA256ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
SHA51290723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
-
Filesize
467KB
MD5ab65e866abc51f841465d19aba35fb14
SHA1ec79f1f511a199291b0893bc866a788ceac19f6e
SHA2562ac0ca4ffda10b1861dd4ae0c2f0131a6400214cb4f5fa33951f3062b784a755
SHA5122474905f174635b236e5f6e8f8c497e44435c94edd02ec47d3440c9a216f6840d040e6acc5fe2ec301ada80467f6cf55225d6361c1e7c6c6c7edccb9e7b5a35e
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\eb603fa6eb1f1fdefda6ce5d5c1c889a\System.Core.ni.dll
Filesize2.2MB
MD5bb0899ae59fc17c1a8a72996ac3e815f
SHA1ba652eac573b14ddf7067178e163e7994c56823f
SHA2562cddd784c8d0530ccf7e8df9322f105a3aa0528eeac562dc32216db36d1704cf
SHA512fef4f770085c61af8b4685c392b5dfddf66ed801c61129aa0f790192ae6a202f3ee158d4f43014ae5153d67bfde201427d397239b7c36a449cb2e20e82ef8151
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c6927e14e1fbf4feae9cd67df04eaabe\System.ni.dll
Filesize7.6MB
MD5d529d885d3e8c67af854946ace2330c3
SHA105473025381cdc7934751aaa00d00973a5cb22e1
SHA2569b68713c68db8622638ac5579f9abb08bcdf11002b7d72a1dd43b87a0065cd6e
SHA5121ee5c887aadca6df9e112e82f3fd27bae4680a3a360c38577dcdb7e75300636147dcf797edffaaa14364af9352dd498236e6b9428dae2ce2bb41cd3fc9e25cfd
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\mscorlib.ni.dll
Filesize11.0MB
MD5c456d0c26f5b97064b1dccc06e4bf804
SHA1331d45960873615c8b307480ca5597448514c355
SHA256f0fcad91909b97262f1b96e31e43066f00dbf3a14e2627487e85b5fb3daf0ed1
SHA5121ad099cdb6598eff7ea3a59b5e8a9fb7b5660ca271620be09d91f4f316dc25368e1d221c316b826cd16a708cf31e6bb3b192537095ba2aea8a6809d85f85637b
-
Filesize
1KB
MD525861697d12f40ef864ea0f607d574b4
SHA1478ae8f221f8a643a416582424fcbced73cc4caf
SHA2561bca955e2018e6b42e52bd2245d13c1653063cb0559bb986c2bd01b56dcf55a4
SHA512a745f1894a18713ac23ad98c11593cdcb5aa8dce52669fe8ed24adda359ac6068d56681fd30bdf066a5ba424cbc4bea410683511778089a106553fd6b92c264f