Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/10/2026, 20:11

General

  • Target
    Boufbowl Fan.exe
  • Size 38.1MB
  • Sample261022-yyefxabd85
  • SHA256 be0e2b25667a837ad16498ee7e4e964efd011a38f76961b689d8acff525930e9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 43 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Boufbowl Fan.exe
    "C:\Users\Admin\AppData\Local\Temp\Boufbowl Fan.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2256
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /d /s /c ""C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\Jouer.cmd""
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1112
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5736
      • C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\flashplayer.exe
        "C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\flashplayer.exe" "C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\bin\boufbowl-client-1.9.6.swf"
        3⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4552

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Jouer.cmd

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\Jouer.cmd
        • Size 669B
        • SHA256 1e682c43526392047f262f39651a815b5a367facd6ac00809fc77428da9b5fd9
        • MD5 SHA1 SHA512 TLSH

        cutscene-boufbowler-repository.swf

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\artworks\cutscene-boufbowler-repository.swf
        • Size 723KB
        • SHA256 1842dedc365f63e7c1db4c641096d179720230d8aacb086d401298adf8cc6308
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cutscene-illustration.swf

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\artworks\cutscene-illustration.swf
        • Size 2.5MB
        • SHA256 405e131c05287c9eeffd95d6d58677e82b011ffab1ceccd429225328a1fe06d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cutscene-pompom.swf

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\artworks\cutscene-pompom.swf
        • Size 312KB
        • SHA256 c48cbaf7b11daea767feb9ff9a35331aa7a3321ae4e6fcdda7a4fa81590e55a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cutscene-versus.swf

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\artworks\cutscene-versus.swf
        • Size 39KB
        • SHA256 ba71813be48b11922ca8984f8d29988c3654a0e2d944043cf8b9bc505df3fbe8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        movies.swf

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\artworks\movies.swf
        • Size 602KB
        • SHA256 8196c38fd9fcfce0a5911256c6e763323efb60358b6d647c0865def9df5745a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fx.swf

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\fx\fx.swf
        • Size 4.7MB
        • SHA256 4256e4d650edd9129087920d35bcd412729ae551c5c9dfd826bdc56ffbfd47a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        onomatopoeia.swf

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\fx\onomatopoeia.swf
        • Size 7KB
        • SHA256 8a8addd5b66624abb340e19cdda6c06a9c4b7a687192ce211c5cb1d815568042
        • MD5 SHA1 SHA512 SSDEEP TLSH

        alentours.jpg

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\models\stadiums\theme_frigost\images\alentours.jpg
        • Size 177KB
        • SHA256 9f544760abf9a1f7c82ecbec0536f519339fa81159f54ba298aa0507ccdf15c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        banc.jpg

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\models\stadiums\theme_frigost\images\banc.jpg
        • Size 3KB
        • SHA256 3ccab555238a889ac571e1e1fe9cd4e8c9bf6bf7ecc7819f86b6a22062cd821a
        • MD5 SHA1 SHA512 TLSH

        caisse_b.jpg

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\models\stadiums\theme_frigost\images\caisse_b.jpg
        • Size 8KB
        • SHA256 a90f68234cc7e8095063ded774d8a32257817436bb8a27462b82b211b1c671a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        environment.jpg

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\models\stadiums\theme_frigost\images\environment.jpg
        • Size 154KB
        • SHA256 1433c96df80abf19c570109dbfc4696b2730319a02ca47eb24f5ab894197ac92
        • MD5 SHA1 SHA512 SSDEEP TLSH

        grange_b.jpg

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\models\stadiums\theme_frigost\images\grange_b.jpg
        • Size 49KB
        • SHA256 10198ed9f1194940b2de7e4a1b5a0a6e383cafd7e98591c0ee5428cec8e530cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        latrines.jpg

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\models\stadiums\theme_frigost\images\latrines.jpg
        • Size 5KB
        • SHA256 3a95fc7ea40edf614f0317aa4469d5b062695563ab2dd9b8ff0ed5fc1c4e1777
        • MD5 SHA1 SHA512 SSDEEP TLSH

        linge.png

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\models\stadiums\theme_frigost\images\linge.png
        • Size 27KB
        • SHA256 0867466b31a1633125126285aae4986b814d76a13ab03c6e3eef993a7fb3beef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        panneaubouftou.png

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\models\stadiums\theme_frigost\images\panneaubouftou.png
        • Size 39KB
        • SHA256 e482f893281ccfbe45fb7779caf274dc52b4c189ae7433f2cb653e4b43055e6e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pierre_test.jpg

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\models\stadiums\theme_frigost\images\pierre_test.jpg
        • Size 11KB
        • SHA256 bea13cd6b21de1a2b9236230358d410c6eb321a0d8a1232e6b33e7a2ff75cbe1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pitidrapeaux_d.png

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\models\stadiums\theme_frigost\images\pitidrapeaux_d.png
        • Size 27KB
        • SHA256 b76c7219e824ca3bf55599f9bc30f4dcacefbc4ff171876a29d515f3ae1476c5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pitidrapeaux_g.png

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\models\stadiums\theme_frigost\images\pitidrapeaux_g.png
        • Size 32KB
        • SHA256 56da032bcbdd73a1b136ef2415b88002d3eb8f92c95d3df743f7aa3227d6bb43
        • MD5 SHA1 SHA512 SSDEEP TLSH

        poteau.jpg

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\models\stadiums\theme_frigost\images\poteau.jpg
        • Size 4KB
        • SHA256 9867f5b21c149487f6913de16636a0b9016cc4b4b71aea0a733a6ee7c847dccf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        poteaubleu.jpg

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\models\stadiums\theme_frigost\images\poteaubleu.jpg
        • Size 5KB
        • SHA256 aff98103e4ee932eaaf6cd97216045333ed02d56242eb10068d4cdb30d64d7d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        poteaufeu.jpg

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\models\stadiums\theme_frigost\images\poteaufeu.jpg
        • Size 5KB
        • SHA256 bf2e6bf769ecfc6ddedf5b0e1f6e66fd12e71c426106617dc6785ef0d934e4c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        poutre.jpg

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\models\stadiums\theme_frigost\images\poutre.jpg
        • Size 2KB
        • SHA256 bafdf72cee3991e57f80f2c2cd515be4eef6cc894e6488a4de09e5e1d1766b06
        • MD5 SHA1 SHA512 TLSH

        trucs_verts.png

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\models\stadiums\theme_frigost\images\trucs_verts.png
        • Size 60KB
        • SHA256 f030eafaab51d5b3a0e0ca787e969a559ee83dea9f4d4f194d459789e90cab42
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vert_uni.png

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\models\stadiums\theme_frigost\images\vert_uni.png
        • Size 2KB
        • SHA256 17327f2aadb31e7fc5f0f0b8dd245579329d6b15948b1d29bf7aebe3dd5e1f28
        • MD5 SHA1 SHA512 TLSH

        model.dae

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\models\stadiums\theme_grass\model.dae
        • Size 340KB
        • SHA256 12f991aa7d3a4fcb55e00e4b72ec7764aed8d0fb5a9a0629765fea18ccc45ee4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0-balle.swl

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\sprites\bones\0-balle.swl
        • Size 219KB
        • SHA256 db6453fea14c9375364b24a100c029a9538caf55489acc7aebc56e2c4aebf9cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0-contact.swl

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\sprites\bones\0-contact.swl
        • Size 161KB
        • SHA256 62304120df5f1800d067aca5e090d8a8a5359a0785950a8e7345a0464dff5f9e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0-deplacement.swl

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\sprites\bones\0-deplacement.swl
        • Size 97KB
        • SHA256 197cfa4db65b0c4cd421e39c48eb062a9b6325062896170f26ea88e65cc9078f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0-etat.swl

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\sprites\bones\0-etat.swl
        • Size 268KB
        • SHA256 5a2f346951d1aea286035123d9833e31265bda7e3b4edbfb42fba8198d345aee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0-passes.swl

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\sprites\bones\0-passes.swl
        • Size 147KB
        • SHA256 e08806e94e68cf2d6503617b222cbcb8273345b905e5d3c83c4c05415c73f65e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0.xml

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\sprites\bones\0.xml
        • Size 43KB
        • SHA256 db90e4ef2d2fe5dba976c87290275b34e0f1e665bbdae38d14d8d382464174ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        index.xml

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\sprites\bones\index.xml
        • Size 352B
        • SHA256 241ca8dc49588fe8a83905c723287fb5444db6c68281eb475bea29d98bf3121d
        • MD5 SHA1 SHA512 TLSH

        boufball.swf

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\assets\sprites\boufball.swf
        • Size 4KB
        • SHA256 7fefebd5ab983361fb479bd7cd28ba369494bb4abf4875cbd2f2d9d9ca8459a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        boufbowl-client-1.9.6.swf

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\bin\boufbowl-client-1.9.6.swf
        • Size 4.2MB
        • SHA256 aec92952254ce24df1baca6bd5dc8d143d885ddddc5fa493cea50baf068caad9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        flashplayer.exe

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\flashplayer.exe
        • Size 15.2MB
        • SHA256 a4b333ac1da12026989549015303d82231982838bccfb544ba5fd188746066f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        config.json

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\resources\config.json
        • Size 1KB
        • SHA256 f7a6b93f27a7cc4c3982a6a4c459ab031c6cbfbf663ef9b2ac64e4f90ae7769e
        • MD5 SHA1 SHA512 TLSH

        jerakine-log.xml

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\resources\jerakine-log.xml
        • Size 108B
        • SHA256 6ee16a16c3fdf38e71fcaebeae526f39283e00feaac0f18011f8f0afc2c771d6
        • MD5 SHA1 SHA512 TLSH

        lang.json

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\resources\lang.json
        • Size 278KB
        • SHA256 bb379640e5126ba0ae3a0c12eee69ea370d6b46db5302f16dc765460e208322d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logback.xml

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\resources\logback.xml
        • Size 917B
        • SHA256 22f2dfa4fd398887f12826d5211da4342b4fec61df65763f6784cd41a895e35d
        • MD5 SHA1 SHA512 TLSH

        motd.json

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\resources\motd.json
        • Size 718B
        • SHA256 310475fee68349791ab406cd29eb1dd14daf7db80207c1aef163a742221fe913
        • MD5 SHA1 SHA512 TLSH

        sound.json

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\resources\sound.json
        • Size 5KB
        • SHA256 e4fd46561e3e8ec51fa34df7e4b2a907c9539619093231655af57b6394632938
        • MD5 SHA1 SHA512 SSDEEP TLSH

        stadiums.json

        • Path C:\Users\Admin\AppData\Local\Boufbowl\player\9c86f89329ab0894a2fc9d4e5d9e1bbce4b1fa73c142685b3d008a3859c6dda8\resources\stadiums.json
        • Size 13KB
        • SHA256 ec4fd2bfac813b81d625d6c45864f47a0ff2c5b1efefa54adbb8fb0e97e1525d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsExec.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nss61C0.tmp\nsExec.dll
        • Size 10KB
        • SHA256 61f0e47b09316d39979c62a05403a3baa3ee58841dfd97cc00fb4dc086843815
        • MD5 SHA1 SHA512 SSDEEP TLSH

        boufbowl-client.cfg

        • Path C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\#Security\FlashPlayerTrust\boufbowl-client.cfg
        • Size 112B
        • SHA256 ef374f57e93ed724d16615db4abb340efeffbbf7f54fd2ee8f94c3a9dc79146b
        • MD5 SHA1 SHA512 TLSH

        BoufbowlBackend_Local_Player_https___boufbowl-fan_fr_api_.sol

        • Path C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\H53F6EJN\localhost\BoufbowlBackend_Local_Player_https___boufbowl-fan_fr_api_.sol
        • Size 168B
        • SHA256 2c188b5c61d8c01e418b8eb6044132d957515ab2ef703ba56608c774a8a16231
        • MD5 SHA1 SHA512 TLSH

        BoufbowlClient.sol

        • Path C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\H53F6EJN\localhost\BoufbowlClient.sol
        • Size 80B
        • SHA256 590c69020de865aee0c2a50a6b199d7dc8e0fd27e4e7e76bcdb2a3d6d9b2595b
        • MD5 SHA1 SHA512 TLSH

        settings.sxx

        • Path C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx
        • Size 420B
        • SHA256 976fe2a66dac73a986e42e87a67d9d26cb0057dd3e81f4eea4db44e691a4cf2c
        • MD5 SHA1 SHA512 TLSH

        settings.sxx

        • Path C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx
        • Size 446B
        • SHA256 ce51fdd99568307ab4ded27fa6bcc41ee868b398aea752e2f7a8fc41841f5ffc
        • MD5 SHA1 SHA512 TLSH

        settings.sxx

        • Path C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx
        • Size 1KB
        • SHA256 0a58c6d6e8593f29944b320d145c96a4826fe30c19d6ac779b77c969437c6870
        • MD5 SHA1 SHA512 TLSH

        RevocationCacheFile.dat

        • Path C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\openssl\cache\RevocationCacheFile.dat
        • Size 1024B
        • SHA256 5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef
        • MD5 SHA1 SHA512

        memory/2256-2877-0x0000000000400000-0x00000000004AC000-memory.dmp

        memory/2256-2878-0x0000000074B40000-0x0000000074B49000-memory.dmp

        memory/4552-3836-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3813-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3821-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3768-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3848-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3847-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3846-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3845-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3844-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3843-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3842-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3841-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3840-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3839-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3838-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3837-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3835-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3834-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3832-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3831-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3830-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3829-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3828-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3826-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3825-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3824-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3823-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3820-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3819-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3818-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3815-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3771-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3812-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3811-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3810-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3809-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3807-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3806-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3805-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3804-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3802-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3801-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3800-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3799-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3796-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3798-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3795-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3794-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3791-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3774-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3772-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3816-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3817-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3770-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3790-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3769-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3767-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3793-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3789-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3775-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3773-0x0000000004730000-0x0000000004930000-memory.dmp

        memory/4552-3766-0x0000000004730000-0x0000000004930000-memory.dmp