Analysis
-
max time kernel
35s -
max time network
46s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15-07-2024 11:07
Static task
static1
Behavioral task
behavioral1
Sample
yfga_game.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
yfga_game.exe
Resource
win10v2004-20240709-en
General
-
Target
yfga_game.exe
-
Size
46.5MB
-
MD5
d45d496bd026d4f710001213527fec6c
-
SHA1
26b050228a42f2514a89461ce1d865c12840b379
-
SHA256
429e9011acfb31b7adc98ab43bf988585a281a04495287345bf0f730bdfe9614
-
SHA512
73098ce3b4e9be578bf93e7a126803a7940b80e977b4ea6c725d387cc2adc19f9d8a769b68a283e99fe21c666cba849987c873663d10510ff00902c739ca4630
-
SSDEEP
786432:N7Ud58tChs1g2uzRU7KPB8NUc3sXEPeEwkHYvgctIKpJZXnfsrQl92Z3tHDUOsj1:Nt96W76B0HkGUvgcaKpDPBl92HHDdsGy
Malware Config
Extracted
C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\@[email protected]
wannacry
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Disables Task Manager via registry modification
-
Processes:
resource yara_rule C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\screenscrew.exe aspack_v212_v242 C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\flasher.exe aspack_v212_v242 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.execmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 9 IoCs
Processes:
screenscrew.exeflasher.execalc.exejokewarehydra.exewalliant.exewalliant.tmpYouAreAnIdiot.exewin7recovery.exewannacryptor.exepid process 3456 screenscrew.exe 4328 flasher.exe 3332 calc.exe 544 jokewarehydra.exe 4324 walliant.exe 1928 walliant.tmp 4580 YouAreAnIdiot.exe 4196 win7recovery.exe 2208 wannacryptor.exe -
Loads dropped DLL 2 IoCs
Processes:
YouAreAnIdiot.exepid process 4580 YouAreAnIdiot.exe 4580 YouAreAnIdiot.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\Desktop\WallPaper = "C:\\Windows\\System32\\FeatureToastBulldogImg.png" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 13 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 732 4580 WerFault.exe YouAreAnIdiot.exe 2488 4196 WerFault.exe win7recovery.exe 4944 4196 WerFault.exe win7recovery.exe 3904 4196 WerFault.exe win7recovery.exe 4120 4196 WerFault.exe win7recovery.exe 1320 4196 WerFault.exe win7recovery.exe 2088 4196 WerFault.exe win7recovery.exe 4880 4196 WerFault.exe win7recovery.exe 1284 4196 WerFault.exe win7recovery.exe 4444 2204 WerFault.exe WbVhxCIDDK.exe 1836 4196 WerFault.exe win7recovery.exe 1192 4196 WerFault.exe win7recovery.exe 4268 4196 WerFault.exe win7recovery.exe -
Delays execution with timeout.exe 7 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 4368 timeout.exe 2148 timeout.exe 724 timeout.exe 2696 timeout.exe 3552 timeout.exe 4836 timeout.exe 1172 timeout.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
xcopy.exexcopy.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe -
Kills process with taskkill 7 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 1644 taskkill.exe 4896 taskkill.exe 2288 taskkill.exe 1448 taskkill.exe 4708 taskkill.exe 1096 taskkill.exe 1320 taskkill.exe -
Processes:
win7recovery.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\Download win7recovery.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no" win7recovery.exe -
Modifies registry class 2 IoCs
Processes:
cmd.execmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings cmd.exe -
Runs net.exe
-
Runs regedit.exe 1 IoCs
Processes:
regedit.exepid process 2500 regedit.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 29 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1644 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
yfga_game.execmd.exenet.execmd.exenet.exewalliant.exedescription pid process target process PID 3392 wrote to memory of 2944 3392 yfga_game.exe cmd.exe PID 3392 wrote to memory of 2944 3392 yfga_game.exe cmd.exe PID 3392 wrote to memory of 2944 3392 yfga_game.exe cmd.exe PID 2944 wrote to memory of 1180 2944 cmd.exe NOTEPAD.EXE PID 2944 wrote to memory of 1180 2944 cmd.exe NOTEPAD.EXE PID 2944 wrote to memory of 1180 2944 cmd.exe NOTEPAD.EXE PID 2944 wrote to memory of 1720 2944 cmd.exe xcopy.exe PID 2944 wrote to memory of 1720 2944 cmd.exe xcopy.exe PID 2944 wrote to memory of 1720 2944 cmd.exe xcopy.exe PID 2944 wrote to memory of 2988 2944 cmd.exe net.exe PID 2944 wrote to memory of 2988 2944 cmd.exe net.exe PID 2944 wrote to memory of 2988 2944 cmd.exe net.exe PID 2988 wrote to memory of 1392 2988 net.exe net1.exe PID 2988 wrote to memory of 1392 2988 net.exe net1.exe PID 2988 wrote to memory of 1392 2988 net.exe net1.exe PID 2944 wrote to memory of 4836 2944 cmd.exe reg.exe PID 2944 wrote to memory of 4836 2944 cmd.exe reg.exe PID 2944 wrote to memory of 4836 2944 cmd.exe reg.exe PID 2944 wrote to memory of 3456 2944 cmd.exe screenscrew.exe PID 2944 wrote to memory of 3456 2944 cmd.exe screenscrew.exe PID 2944 wrote to memory of 3456 2944 cmd.exe screenscrew.exe PID 2944 wrote to memory of 4328 2944 cmd.exe flasher.exe PID 2944 wrote to memory of 4328 2944 cmd.exe flasher.exe PID 2944 wrote to memory of 4328 2944 cmd.exe flasher.exe PID 2944 wrote to memory of 3332 2944 cmd.exe calc.exe PID 2944 wrote to memory of 3332 2944 cmd.exe calc.exe PID 2944 wrote to memory of 3332 2944 cmd.exe calc.exe PID 2944 wrote to memory of 1224 2944 cmd.exe cmd.exe PID 2944 wrote to memory of 1224 2944 cmd.exe cmd.exe PID 2944 wrote to memory of 1224 2944 cmd.exe cmd.exe PID 2944 wrote to memory of 2396 2944 cmd.exe xcopy.exe PID 2944 wrote to memory of 2396 2944 cmd.exe xcopy.exe PID 2944 wrote to memory of 2396 2944 cmd.exe xcopy.exe PID 1224 wrote to memory of 544 1224 cmd.exe jokewarehydra.exe PID 1224 wrote to memory of 544 1224 cmd.exe jokewarehydra.exe PID 1224 wrote to memory of 544 1224 cmd.exe jokewarehydra.exe PID 1224 wrote to memory of 2848 1224 cmd.exe WScript.exe PID 1224 wrote to memory of 2848 1224 cmd.exe WScript.exe PID 1224 wrote to memory of 2848 1224 cmd.exe WScript.exe PID 2944 wrote to memory of 4324 2944 cmd.exe walliant.exe PID 2944 wrote to memory of 4324 2944 cmd.exe walliant.exe PID 2944 wrote to memory of 4324 2944 cmd.exe walliant.exe PID 2944 wrote to memory of 4956 2944 cmd.exe net.exe PID 2944 wrote to memory of 4956 2944 cmd.exe net.exe PID 2944 wrote to memory of 4956 2944 cmd.exe net.exe PID 4956 wrote to memory of 2660 4956 net.exe net1.exe PID 4956 wrote to memory of 2660 4956 net.exe net1.exe PID 4956 wrote to memory of 2660 4956 net.exe net1.exe PID 2944 wrote to memory of 2120 2944 cmd.exe reg.exe PID 2944 wrote to memory of 2120 2944 cmd.exe reg.exe PID 2944 wrote to memory of 2120 2944 cmd.exe reg.exe PID 4324 wrote to memory of 1928 4324 walliant.exe walliant.tmp PID 4324 wrote to memory of 1928 4324 walliant.exe walliant.tmp PID 4324 wrote to memory of 1928 4324 walliant.exe walliant.tmp PID 2944 wrote to memory of 4580 2944 cmd.exe YouAreAnIdiot.exe PID 2944 wrote to memory of 4580 2944 cmd.exe YouAreAnIdiot.exe PID 2944 wrote to memory of 4580 2944 cmd.exe YouAreAnIdiot.exe PID 2944 wrote to memory of 1644 2944 cmd.exe taskkill.exe PID 2944 wrote to memory of 1644 2944 cmd.exe taskkill.exe PID 2944 wrote to memory of 1644 2944 cmd.exe taskkill.exe PID 2944 wrote to memory of 4896 2944 cmd.exe WerFault.exe PID 2944 wrote to memory of 4896 2944 cmd.exe WerFault.exe PID 2944 wrote to memory of 4896 2944 cmd.exe WerFault.exe PID 2944 wrote to memory of 2288 2944 cmd.exe taskkill.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
win7recovery.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System win7recovery.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" win7recovery.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 4852 attrib.exe 3844 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\yfga_game.exe"C:\Users\Admin\AppData\Local\Temp\yfga_game.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\YFGA.bat" "2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\IMPORTANT.txt3⤵PID:1180
-
C:\Windows\SysWOW64\xcopy.exexcopy important.txt C:\Users\Admin\Desktop\text2.txt3⤵
- Enumerates system info in registry
PID:1720 -
C:\Windows\SysWOW64\net.exenet user "GO BACK!" "???" /add3⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user "GO BACK!" "???" /add4⤵PID:1392
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskManager" /t REG_DWORD /d 13⤵PID:4836
-
C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\screenscrew.exescreenscrew.exe3⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\flasher.exeflasher.exe3⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\calc.execalc.exe3⤵
- Executes dropped EXE
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K hydra.cmd3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\jokewarehydra.exejokewarehydra.exe4⤵
- Executes dropped EXE
PID:544 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\annoy3.vbs"4⤵PID:2848
-
C:\Windows\SysWOW64\xcopy.exexcopy china.png C:\Users\Admin\Desktop\somefiles.rg.png3⤵
- Enumerates system info in registry
PID:2396 -
C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\walliant.exewalliant.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\is-53US9.tmp\walliant.tmp"C:\Users\Admin\AppData\Local\Temp\is-53US9.tmp\walliant.tmp" /SL5="$6022E,4511977,830464,C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\walliant.exe"4⤵
- Executes dropped EXE
PID:1928 -
C:\Windows\SysWOW64\net.exenet user "FUCK OFF YFGA" "I DONT KNOW" /add3⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user "FUCK OFF YFGA" "I DONT KNOW" /add4⤵PID:2660
-
C:\Windows\SysWOW64\reg.exereg import reg.reg3⤵
- Sets desktop wallpaper using registry
PID:2120 -
C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\YouAreAnIdiot.exeyouareanidiot.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4580 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 15084⤵
- Program crash
PID:732 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fontdrvhost.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1644 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im TextInputhost.exe3⤵
- Kills process with taskkill
PID:4896 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- Kills process with taskkill
PID:2288 -
C:\Windows\SysWOW64\timeout.exetimeout 53⤵
- Delays execution with timeout.exe
PID:2148 -
C:\Windows\SysWOW64\shutdown.exeshutdown /r /t 30000 /c "HAHA I HACKED YOU AYFGA ROCKS YOU"3⤵PID:3520
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K spam.bat "forkbomb" /min3⤵PID:5096
-
C:\Windows\SysWOW64\timeout.exetimeout 53⤵
- Delays execution with timeout.exe
PID:724 -
C:\Windows\SysWOW64\shutdown.exeshutdown /a3⤵PID:1460
-
C:\Windows\SysWOW64\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
PID:2696 -
C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\win7recovery.exewin7recovery.exe3⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- System policy modification
PID:4196 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 7004⤵
- Program crash
PID:2488 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 9484⤵
- Program crash
PID:4944 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 9564⤵
- Program crash
PID:3904 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 9564⤵
- Program crash
PID:4120 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 10364⤵
- Program crash
PID:1320 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 10084⤵
- Program crash
PID:2088 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 10804⤵
- Program crash
PID:4880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 10764⤵
- Program crash
PID:1284 -
C:\ProgramData\WbVhxCIDDK.exe"C:\ProgramData\WbVhxCIDDK.exe"4⤵PID:2204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 5845⤵
- Program crash
PID:4444 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 12204⤵
- Program crash
PID:1836 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 16244⤵
- Program crash
PID:1192 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 16524⤵
- Program crash
PID:4268 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im WScript.exe3⤵
- Kills process with taskkill
PID:1448 -
C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\wannacryptor.exewannacryptor.exe3⤵
- Executes dropped EXE
PID:2208 -
C:\Windows\SysWOW64\attrib.exeattrib +h .4⤵
- Views/modifies file attributes
PID:4852 -
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q4⤵
- Modifies file permissions
PID:4292 -
C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\taskdl.exetaskdl.exe4⤵PID:2620
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 188771721041795.bat4⤵PID:3680
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE4⤵
- Views/modifies file attributes
PID:3844 -
C:\Windows\SysWOW64\timeout.exetimeout 123⤵
- Delays execution with timeout.exe
PID:3552 -
C:\Windows\SysWOW64\xcopy.exexcopy wtf.png C:\Users\Admin\Desktop\somefile.png\3⤵PID:4832
-
C:\Windows\SysWOW64\xcopy.exexcopy china.png C:\Users\Admin\Desktop\china.png\3⤵PID:1068
-
C:\Windows\SysWOW64\xcopy.exexcopy important.txt C:\Users\Admin\Desktop\text.txt\3⤵PID:1512
-
C:\Windows\SysWOW64\xcopy.exexcopy YFGA.bat C:\Users\Admin\Desktop\clickme.bat3⤵PID:1972
-
C:\Windows\SysWOW64\xcopy.exexcopy YouAreAnIdiot.exe C:\Users\Admin\Desktop\idiot.exe3⤵PID:1836
-
C:\Windows\SysWOW64\xcopy.exexcopy bloatware C:\Users\Admin\Desktop3⤵PID:3796
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:4836 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- Kills process with taskkill
PID:4708 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe3⤵
- Kills process with taskkill
PID:1096 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im WScript.exe3⤵
- Kills process with taskkill
PID:1320 -
C:\Windows\SysWOW64\shutdown.exeshutdown /a3⤵PID:3976
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K bloatware.cmd3⤵PID:4992
-
C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\useroverflow.exeuseroverflow.exe3⤵PID:2136
-
C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\programoverflow.exeprogramoverflow.exe3⤵PID:2396
-
C:\Windows\SysWOW64\notepad.exenotepad.exe3⤵PID:632
-
C:\Windows\SysWOW64\regedit.exeregedit.exe3⤵
- Runs regedit.exe
PID:2500 -
C:\Windows\SysWOW64\mspaint.exemspaint.exe3⤵PID:2840
-
C:\Windows\SysWOW64\charmap.execharmap.exe3⤵PID:100
-
C:\Windows\SysWOW64\net.exenet user "CRY TO UR MOTHA" "1488" /add3⤵PID:1816
-
C:\Windows\SysWOW64\net.exenet user "CRY TO UR MOTHAR HEHEHEEHEHEHAHAHAHHHHHHHHHAAAAAAA" "1488" /add3⤵PID:792
-
C:\Windows\SysWOW64\net.exenet user "CRY TO UR MOTHA" /active:no3⤵PID:3312
-
C:\Windows\SysWOW64\net.exenet user "racism is not good" "1488" /add3⤵PID:4532
-
C:\Windows\SysWOW64\net.exenet user 27501 * /add3⤵PID:4288
-
C:\Windows\SysWOW64\timeout.exetimeout 213⤵
- Delays execution with timeout.exe
PID:1172
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4580 -ip 45801⤵PID:1172
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4196 -ip 41961⤵PID:3912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4196 -ip 41961⤵PID:1608
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4004
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc1⤵PID:724
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4196 -ip 41961⤵PID:512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4196 -ip 41961⤵PID:4896
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:4960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4196 -ip 41961⤵PID:2868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4196 -ip 41961⤵PID:3364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4196 -ip 41961⤵PID:4896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4196 -ip 41961⤵PID:3972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2204 -ip 22041⤵PID:1932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4196 -ip 41961⤵PID:3180
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2696
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4196 -ip 41961⤵PID:3312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 4196 -ip 41961⤵PID:2868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114B
MD5d725d85cc5f30c0f695b03a9e7d0c4c0
SHA1131b68adcddb7ff3b3ce9c34c5277eb5d673f610
SHA2564d4588c42fa8df0ea45ad48aca4511bb4286f0deaa41fdf188c3b7ab9e1b698a
SHA51201f270a15aa10e60e14ac140ccb54e38cf8e57833ef1c0db7d36688a93ecdc0a59ecf9ead9366a5920faac7e28a2e0ee03759eb0fa92d455abc72f406fe8775b
-
Filesize
2.5MB
MD562e5dbc52010c304c82ada0ac564eff9
SHA1d911cb02fdaf79e7c35b863699d21ee7a0514116
SHA256bd54ad7a25594dc823572d9b23a3490ff6b8b1742a75e368d110421ab08909b2
SHA512b5d863ea38816c18f7778ef12ea4168ceb0dae67704c0d1d4a60b0237ca6e758c1dfc5c28d4fc9679b0159de25e56d5dfff8addacd7a9c52572674d90c424946
-
C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\@[email protected]
Filesize933B
MD57a2726bb6e6a79fb1d092b7f2b688af0
SHA1b3effadce8b76aee8cd6ce2eccbb8701797468a2
SHA256840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5
SHA5124e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54
-
C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\@[email protected]
Filesize240KB
MD57bf2b57f2a205768755c07f238fb32cc
SHA145356a9dd616ed7161a3b9192e2f318d0ab5ad10
SHA256b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
SHA51291a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9
-
C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\AxInterop.ShockwaveFlashObjects.dll
Filesize17KB
MD5451112d955af4fe3c0d00f303d811d20
SHA11619c35078ba891091de6444099a69ef364e0c10
SHA2560d57a706d4e10cca3aed49b341a651f29046f5ef1328878d616be93c3b4cbce9
SHA51235357d2c4b8229ef9927fa37d85e22f3ae26606f577c4c4655b2126f0ecea4c69dae03043927207ca426cc3cd54fc3e72124369418932e04733a368c9316cf87
-
Filesize
273B
MD5c538506cae8330844fd21a05f2d065aa
SHA102534de70d8ac6b5b700456a6f90b8f3b72b3cc0
SHA25620cd2cf85675a5cfdcba4d355df959d71a9e1944888a7ecea7e3f7a16e8adbf9
SHA512a2d8070c569d4e4091adc85d570603b0400aedac3da2fd3e18ee588d72b12f1183d27f205ada0fb74e004e89415274fa27e84574f498e2315132c91495fae123
-
C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\Interop.ShockwaveFlashObjects.dll
Filesize21KB
MD5e869d1d4545c212d9068a090a370ded3
SHA1a6a92f108bba390cd14e7103ba710efec1d270f9
SHA25663af704211a03f6ff6530ebfca095b6c97636ab66e5a6de80d167b19c3c30c66
SHA512ee108b0ebefb476c5beb568129da7ce058229fb42ad3500c6fc37a36d718eb67a17b331d73f6920a5290c3977be2eda96aa057533c3344898d161cb464c6ef76
-
Filesize
1KB
MD5ccbc42c8f2ef7f9b47e8c35262774afe
SHA14f588f963b41eb2fd5200e4d55e9eae9984a5746
SHA256aea7b8fa2384a4fe733a67ac69436a65a4d33bc3de2d7cb6a4fb19f64f8585b5
SHA512494ad8f4dad760717ba4ad351842d70314f8c2da4d96ddf36c854b3b4b12493dfe48a8f07816ffab755ede68ae5e02565396287c5c1b9b9eb0b1bccd11ae1ea0
-
Filesize
424KB
MD5e263c5b306480143855655233f76dc5a
SHA1e7dcd6c23c72209ee5aa0890372de1ce52045815
SHA2561f69810b8fe71e30a8738278adf09dd982f7de0ab9891d296ce7ea61b3fa4f69
SHA512e95981eae02d0a8bf44493c64cca8b7e50023332e91d75164735a1d0e38138f358100c93633ff3a0652e1c12a5155cba77d81e01027422d7d5f71000eafb4113
-
Filesize
50B
MD53167d161336cbd296dc579d2295b0f22
SHA153253e5841e6a7a7a1b8bd08378af0a96b2f9a98
SHA256307879bf0d9bec07bab240b5010434801fbee520c99c5a617e8ac630f42dde80
SHA51262af8fa0c9a30ec6aa9b552fcac1879af1f00f5ceb48a77718b2a8e042e3524e2cd299f26fcde31ad8abf2dcb94d15cf45ecbce0bd5f9f93f44aca6327aa53ea
-
Filesize
44B
MD59a2ccbd3e2f1a2382fed7674c28dd086
SHA1b466bdd2079575c938de65285f02739143ecb170
SHA2564519cd5997afce27129ef943f121972f7b0b34aa018e4dd408892fc5c39bb59e
SHA5128929493211c17a8e99b908a8305dbebe2d96e1b54426e89ddba84c2010a86d7f6d0983080f29fa1ab7a0687d536c0546278b9fffe4560d84e4012f243f344d78
-
Filesize
56B
MD519cf22e8d63e787913b6617542211e19
SHA18c3d2f43025e5c4ef70e0c4d1f36692361f51b1f
SHA256dbec312d736f8a56f94ace99986d95d4355ef644a2fd908da1ff4c8b0a003979
SHA5128b9d192dd7f175e63aebcdfc8426876fa8bf3ae00d3cf10bb8fcf0d0c262b906de28784f5b97141f656e87bb548d343b8d5a127c06ecb407289e91f3fc199608
-
Filesize
1.4MB
MD5c17170262312f3be7027bc2ca825bf0c
SHA1f19eceda82973239a1fdc5826bce7691e5dcb4fb
SHA256d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
SHA512c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c
-
Filesize
2.0MB
MD52d183522f195d563fe2a732363b8f757
SHA18b4ba6716e8e635b2b35ee64134784c788fa1b0e
SHA2564b6d2615f53454076b996a91473287e5fc882ce266933cfbe815a63477ed8407
SHA5122c37e38214ed90d21345a8675424cfe3086cce34acd19972081479946c541b747b97cc722910189f9b5e7e8bcd56de0b2326407b3008de6763c40366ceffc67b
-
Filesize
843KB
MD5ff508ab78289efa35e67a05d6cc20717
SHA1174f616661b53371fe93fa5cc4ec4b6e233abb43
SHA256eca41ee73faaa7e85ecf4d4c6d4df0e078c36c6554f25142b5e68b2b6cf68272
SHA512f94fd558e34589c8b0f3da7d20bbb404c4dc6e560aabc5f7e702cdf6a6b8a7870d63d8fb667f6324461ed37c32f6ff8abb0cee65317c6ad745e61c1fc7c80811
-
Filesize
140B
MD585960c66edf9a8db4e5a17d9f15b6ae3
SHA1fb27f19a4e8f55dc2c77d7570d472e8df801531b
SHA25681a20f21135c05252a3dd2042ff39bf044624c79f6d9ec9fd412a8c9b38d83a3
SHA512c8b81cb4901039c5ac26bbf2e98b40db60bfd6ab37d7abbc030d1ba11f78485a148935539c09c2cb5c983f14d66b0fdd9d49c138a1340690b2aa69de35d4975f
-
Filesize
25.2MB
MD514cebb6187a53864094293d616e9af4d
SHA147b89d897f432002520fb4a9c0c862df45257d36
SHA2561e3cf9b81993ca63c3da99c4ec29d8826d5ac65be4088b4e4fd52f11224be96c
SHA512f4bc7cb3f602ac686485ee5b23a856b49ce3e3b73325cc520a728a723d014785f2091905f676312ee7826740f184b074458a31018d3c7d27a6ce2a219643195a
-
Filesize
1.1MB
MD53b89914c7bfe5487af38f7bd8dc31bb5
SHA17204cce974e02495f58731e961e4cdc49a2f1ef3
SHA25614068d0948dfeedc5908573fcaa2704536faa8b0fbea8caac61b9fb264cc204d
SHA51273735b965a0c948a4126bad31ea54fb4aa31b2c8877ab772f7596a27e821be9f6bba17ddbb9f4e87c6c70bba93375277008e4fa354bf1504e1cd2b9b190d45f8
-
Filesize
4.8MB
MD539490d6ae5b10a8cdffecd71d05141dd
SHA1450da6260c6817aca8d9444831a48439ba45785c
SHA256a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb
SHA5127ffb9cb6a53cf233b6ff396eeb6193e683aed75001b3f73a1bbadaeec3ff7dcbce9b7e215d1743a4374e488185b824b90dde4afe93a8d93608b6340af07c14fb
-
Filesize
908KB
MD5e23ffecb44c814aaa4708d56ab5b144b
SHA1202311d615685e7baaa41dc149b5a76a69c05a0e
SHA256d395af3c10e18c944cf8ade76a650623dc23e050eaf652ff31056c84077a013c
SHA5124ae915fb4cb00e30a215ddd439c6e254fb49ce15c4d53000fb12a0cbf5f68820bc7dca6b840a620351060101c6995fd9429ea91f9682503f01ec001f213cfdc3
-
Filesize
780B
MD58124a611153cd3aceb85a7ac58eaa25d
SHA1c1d5cd8774261d810dca9b6a8e478d01cd4995d6
SHA2560ceb451c1dbefaa8231eeb462e8ce639863eb5b8ae4fa63a353eb6e86173119e
SHA512b9c8dfb5d58c95628528cc729d2394367c5e205328645ca6ef78a3552d9ad9f824ae20611a43a6e01daaffeffdc9094f80d772620c731e4192eb0835b8ed0f17
-
Filesize
112KB
MD5829e4805b0e12b383ee09abdc9e2dc3c
SHA15a272b7441328e09704b6d7eabdbd51b8858fde4
SHA25637121ecb7c1e112b735bd21b0dfe3e526352ecb98c434c5f40e6a2a582380cdd
SHA512356fe701e6788c9e4988ee5338c09170311c2013d6b72d7756b7ada5cda44114945f964668feb440d262fb1c0f9ca180549aafd532d169ceeadf435b9899c8f6
-
Filesize
68KB
MD5732dabce85a07f8c14199ab45ff7a438
SHA1576d530078f6aeaf824748e7c9948930760646c4
SHA256db58369e888f471c8ac8ec1580ac96003788b7bf249ab02fae6d5160a2affdc3
SHA512f6963ac6f6c586ec76c00068de3145dd351f7e5b52b6733a00a46327c43a1ec34b6daa7a93cf2315cfb4a6048877bbcdc12c77b694d60f7196d75dd5ddf54e2d
-
Filesize
246KB
MD59254ca1da9ff8ad492ca5fa06ca181c6
SHA170fa62e6232eae52467d29cf1c1dacb8a7aeab90
SHA25630676ad5dc94c3fec3d77d87439b2bf0a1aaa7f01900b68002a06f11caee9ce6
SHA512a84fbbdea4e743f3e41878b9cf6db219778f1479aa478100718af9fc8d7620fc7a3295507e11df39c7863cb896f946514e50368db480796b6603c8de5580685a
-
Filesize
47B
MD55e578014c7017a85ca32f0b7e5d7df7f
SHA1c88d8e7179fcc070d4419be9f4d8647354c2f6ed
SHA256a964a717e3c47cb7d274e98928ca1271377d0d76a8908448e1b70e63af4082ad
SHA5127eb206b0cbc2a9b744246d8a83b2fccc70204c6e777b0fcbb838e63d477fe047d8827f3c0de823d55b9ab5cba2ab572ff3f543f76a3451fa81b31584cc767106
-
Filesize
43KB
MD5b2eca909a91e1946457a0b36eaf90930
SHA13200c4e4d0d4ece2b2aadb6939be59b91954bcfa
SHA2560b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c
SHA512607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf
-
Filesize
46KB
MD595673b0f968c0f55b32204361940d184
SHA181e427d15a1a826b93e91c3d2fa65221c8ca9cff
SHA25640b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd
SHA5127601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92
-
C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\msg\m_chinese (simplified).wnry
Filesize53KB
MD50252d45ca21c8e43c9742285c48e91ad
SHA15c14551d2736eef3a1c1970cc492206e531703c1
SHA256845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a
SHA5121bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755
-
C:\Users\Admin\Desktop\yfga_game_d90c1a44-8594-446b-8530-8043295bd162\msg\m_chinese (traditional).wnry
Filesize77KB
MD52efc3690d67cd073a9406a25005f7cea
SHA152c07f98870eabace6ec370b7eb562751e8067e9
SHA2565c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a
SHA5120766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c
-
Filesize
38KB
MD517194003fa70ce477326ce2f6deeb270
SHA1e325988f68d327743926ea317abb9882f347fa73
SHA2563f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171
SHA512dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c
-
Filesize
39KB
MD5537efeecdfa94cc421e58fd82a58ba9e
SHA13609456e16bc16ba447979f3aa69221290ec17d0
SHA2565afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150
SHA512e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b
-
Filesize
36KB
MD52c5a3b81d5c4715b7bea01033367fcb5
SHA1b548b45da8463e17199daafd34c23591f94e82cd
SHA256a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6
SHA512490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3
-
Filesize
36KB
MD57a8d499407c6a647c03c4471a67eaad7
SHA1d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b
SHA2562c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c
SHA512608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12
-
Filesize
36KB
MD5fe68c2dc0d2419b38f44d83f2fcf232e
SHA16c6e49949957215aa2f3dfb72207d249adf36283
SHA25626fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5
SHA512941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810
-
Filesize
36KB
MD508b9e69b57e4c9b966664f8e1c27ab09
SHA12da1025bbbfb3cd308070765fc0893a48e5a85fa
SHA256d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324
SHA512966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4
-
Filesize
37KB
MD535c2f97eea8819b1caebd23fee732d8f
SHA1e354d1cc43d6a39d9732adea5d3b0f57284255d2
SHA2561adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
SHA512908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf
-
Filesize
37KB
MD54e57113a6bf6b88fdd32782a4a381274
SHA10fccbc91f0f94453d91670c6794f71348711061d
SHA2569bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc
SHA5124f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9
-
Filesize
36KB
MD53d59bbb5553fe03a89f817819540f469
SHA126781d4b06ff704800b463d0f1fca3afd923a9fe
SHA2562adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61
SHA51295719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac
-
Filesize
47KB
MD5fb4e8718fea95bb7479727fde80cb424
SHA11088c7653cba385fe994e9ae34a6595898f20aeb
SHA256e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9
SHA51224db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb
-
Filesize
36KB
MD53788f91c694dfc48e12417ce93356b0f
SHA1eb3b87f7f654b604daf3484da9e02ca6c4ea98b7
SHA25623e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4
SHA512b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd
-
Filesize
36KB
MD530a200f78498990095b36f574b6e8690
SHA1c4b1b3c087bd12b063e98bca464cd05f3f7b7882
SHA25649f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07
SHA512c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511
-
Filesize
79KB
MD5b77e1221f7ecd0b5d696cb66cda1609e
SHA151eb7a254a33d05edf188ded653005dc82de8a46
SHA2567e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e
SHA512f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc
-
Filesize
89KB
MD56735cb43fe44832b061eeb3f5956b099
SHA1d636daf64d524f81367ea92fdafa3726c909bee1
SHA256552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0
SHA51260272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e
-
Filesize
40KB
MD5c33afb4ecc04ee1bcc6975bea49abe40
SHA1fbea4f170507cde02b839527ef50b7ec74b4821f
SHA256a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536
SHA5120d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44
-
Filesize
36KB
MD5ff70cc7c00951084175d12128ce02399
SHA175ad3b1ad4fb14813882d88e952208c648f1fd18
SHA256cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a
SHA512f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19
-
Filesize
38KB
MD5e79d7f2833a9c2e2553c7fe04a1b63f4
SHA13d9f56d2381b8fe16042aa7c4feb1b33f2baebff
SHA256519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e
SHA512e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de
-
Filesize
37KB
MD5fa948f7d8dfb21ceddd6794f2d56b44f
SHA1ca915fbe020caa88dd776d89632d7866f660fc7a
SHA256bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66
SHA5120d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a
-
Filesize
50KB
MD5313e0ececd24f4fa1504118a11bc7986
SHA1e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d
SHA25670c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1
SHA512c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730
-
Filesize
46KB
MD5452615db2336d60af7e2057481e4cab5
SHA1442e31f6556b3d7de6eb85fbac3d2957b7f5eac6
SHA25602932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078
SHA5127613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f
-
Filesize
40KB
MD5c911aba4ab1da6c28cf86338ab2ab6cc
SHA1fee0fd58b8efe76077620d8abc7500dbfef7c5b0
SHA256e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729
SHA5123491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a
-
Filesize
36KB
MD58d61648d34cba8ae9d1e2a219019add1
SHA12091e42fc17a0cc2f235650f7aad87abf8ba22c2
SHA25672f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1
SHA51268489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079
-
Filesize
37KB
MD5c7a19984eb9f37198652eaf2fd1ee25c
SHA106eafed025cf8c4d76966bf382ab0c5e1bd6a0ae
SHA256146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4
SHA51243dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020
-
Filesize
41KB
MD5531ba6b1a5460fc9446946f91cc8c94b
SHA1cc56978681bd546fd82d87926b5d9905c92a5803
SHA2566db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415
SHA512ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9
-
Filesize
25KB
MD5aebe09cd7095ec201dc8acc350443242
SHA1df7337e051bd02e1fdd4005b63ed45b8ca3d9726
SHA256405d47dca73a5d6180db42e90c35931047c666ed1f1d6fab5ead6110c2356cc7
SHA512ffc658faf04fee47c1284d439a4c5b3931d2f9bcac9b40e36f59ad0ed4917f0252e639284f817ca84a6da57552f8e0fdf96936987c3f5cf689a537e42b47288d
-
Filesize
111KB
MD5e87a04c270f98bb6b5677cc789d1ad1d
SHA18c14cb338e23d4a82f6310d13b36729e543ff0ca
SHA256e03520794f00fb39ef3cfff012f72a5d03c60f89de28dbe69016f6ed151b5338
SHA5128784f4d42908e54ecedfb06b254992c63920f43a27903ccedd336daaeed346db44e1f40e7db971735da707b5b32206be1b1571bc0d6a2d6eb90bbf9d1f69de13
-
Filesize
5.0MB
MD5929335d847f8265c0a8648dd6d593605
SHA10ff9acf1293ed8b313628269791d09e6413fca56
SHA2566613acb18cb8bf501fba619f04f8298e5e633cb220c450212bbc9dd2bef9538d
SHA5127c9a4d1bec430503cc355dc76955d341e001b06196d4b508cc35d64feb2e8ba30e824e7c3a11c27135d7d99801f45f62a5b558563b4c78f89f5d156a929063fd
-
Filesize
3.4MB
MD584c82835a5d21bbcf75a61706d8ab549
SHA15ff465afaabcbf0150d1a3ab2c2e74f3a4426467
SHA256ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
SHA51290723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
-
Filesize
467KB
MD5ab65e866abc51f841465d19aba35fb14
SHA1ec79f1f511a199291b0893bc866a788ceac19f6e
SHA2562ac0ca4ffda10b1861dd4ae0c2f0131a6400214cb4f5fa33951f3062b784a755
SHA5122474905f174635b236e5f6e8f8c497e44435c94edd02ec47d3440c9a216f6840d040e6acc5fe2ec301ada80467f6cf55225d6361c1e7c6c6c7edccb9e7b5a35e