hxxps://www[.]mediafire[.]com/file/qatocdld3p8l8y3/RansomFlop2[.]zip/file

Analysis

max time kernel
43s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 16:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/qatocdld3p8l8y3/RansomFlop2.zip/file

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3616	vlc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3552	msedge.exe
3552	msedge.exe
3524	msedge.exe
3524	msedge.exe
5596	identity_helper.exe
5596	identity_helper.exe
6556	msedge.exe
6556	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3616	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	7020	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	7020	AUDIODG.EXE
Token: 33	3616	vlc.exe
Token: SeIncBasePriorityPrivilege	3616	vlc.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3616	vlc.exe
3616	vlc.exe
3616	vlc.exe
3616	vlc.exe
3616	vlc.exe
3616	vlc.exe
3616	vlc.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3616	vlc.exe
3616	vlc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3616	vlc.exe
3616	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 2316	3524	msedge.exe	82
PID 3524 wrote to memory of 2316	3524	msedge.exe	82
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 232	3524	msedge.exe	83
PID 3524 wrote to memory of 3552	3524	msedge.exe	84
PID 3524 wrote to memory of 3552	3524	msedge.exe	84
PID 3524 wrote to memory of 528	3524	msedge.exe	85
PID 3524 wrote to memory of 528	3524	msedge.exe	85
PID 3524 wrote to memory of 528	3524	msedge.exe	85
PID 3524 wrote to memory of 528	3524	msedge.exe	85
PID 3524 wrote to memory of 528	3524	msedge.exe	85
PID 3524 wrote to memory of 528	3524	msedge.exe	85
PID 3524 wrote to memory of 528	3524	msedge.exe	85
PID 3524 wrote to memory of 528	3524	msedge.exe	85
PID 3524 wrote to memory of 528	3524	msedge.exe	85
PID 3524 wrote to memory of 528	3524	msedge.exe	85
PID 3524 wrote to memory of 528	3524	msedge.exe	85
PID 3524 wrote to memory of 528	3524	msedge.exe	85
PID 3524 wrote to memory of 528	3524	msedge.exe	85
PID 3524 wrote to memory of 528	3524	msedge.exe	85
PID 3524 wrote to memory of 528	3524	msedge.exe	85
PID 3524 wrote to memory of 528	3524	msedge.exe	85
PID 3524 wrote to memory of 528	3524	msedge.exe	85
PID 3524 wrote to memory of 528	3524	msedge.exe	85
PID 3524 wrote to memory of 528	3524	msedge.exe	85
PID 3524 wrote to memory of 528	3524	msedge.exe	85

Views/modifies file attributes 1 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
7052	attrib.exe
6300	attrib.exe
7164	attrib.exe
5276	attrib.exe
5352	attrib.exe
2916	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/qatocdld3p8l8y3/RansomFlop2.zip/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1fe446f8,0x7fff1fe44708,0x7fff1fe44718
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7304 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7452 /prefetch:8
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7672 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8396 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8548 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8724 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8904 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8788 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7408 /prefetch:8
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9344 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9040 /prefetch:1
  2⤵
  PID:6172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10028 /prefetch:1
  2⤵
  PID:6244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7340 /prefetch:1
  2⤵
  PID:6252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9960 /prefetch:1
  2⤵
  PID:6260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10484 /prefetch:1
  2⤵
  PID:7136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10584 /prefetch:1
  2⤵
  PID:7144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10120 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16411759778896112672,7949531215279523655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10196 /prefetch:1
  2⤵
  PID:3900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1844

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6816

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\read me.txt
1⤵
PID:6168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\RansomFlop.bat" "
1⤵
PID:6916
- C:\Windows\system32\attrib.exe
  attrib +h RansomFlop.bat
  2⤵
  - Views/modifies file attributes
  PID:7052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K RansomFlop2.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  PID:7068
- - C:\Windows\system32\attrib.exe
    attrib +h RansomFlop2.bat
    3⤵
    - Views/modifies file attributes
    PID:7164
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4464
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6564
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3956
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1356
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3276
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6964
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6608
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5296
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6492
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4464
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2912
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3168
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5540
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2748
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:652
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6736
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:836
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5528
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6816
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4560
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2200
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4692
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5252
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5508
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6100
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5420
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3520
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1364
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6632
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6212
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2748
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7012
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6312
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6640
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6456
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7152
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6636
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7164
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2140
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4840
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2516
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6100
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5588
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6492
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4976
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1764
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2648
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1544
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1816
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4976
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6096
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:652
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6284
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6696
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1764
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3532
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6440
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6512
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1596
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7052
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6696
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6492
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6964
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6572
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6168
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7048
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6484
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1764
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5480
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6748
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5244
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3996
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2068
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2648
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4592
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6212
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2748
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5628
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2968
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5504
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6784
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7004
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6580
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1072
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7060
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2084
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4976
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6412
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6372
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6728
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4308
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2728
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6784
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4256
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6912
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2648
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4444
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5288
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3996
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6728
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4456
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:760
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3708
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6812
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6552
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3532
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6636
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3812
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5724
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3520
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5932
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4256
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:632
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5320
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2140
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4396
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5104
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5296
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4148
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5504
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7152
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5748
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2740
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7012
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3532
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6660
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2968
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5024
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2656
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6752
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3824
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6116
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6128
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:652
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3684
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2952
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6284
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5540
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5296
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6100
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6860
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6716
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5712
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2544
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6492
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2676
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6284
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7064
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2936
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:840
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5060
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4712
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:752
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6288
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6036
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6952
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5364
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2312
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:640
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5452
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6096
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6248
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2244
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6844
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3368
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5584
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5296
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2252
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5368
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3672
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2216
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6636
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5472
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4480
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5728
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2200
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6128
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6168
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4376
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5616
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4200
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6104
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6564
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5384
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2944
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K RansomFlop2.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  PID:6516
- - C:\Windows\system32\attrib.exe
    attrib +h RansomFlop2.bat
    3⤵
    - Views/modifies file attributes
    PID:6300
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:3616
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3372
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7032
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6812
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2644
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5708
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7004
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2700
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2740
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6636
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4296
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5728
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6132
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5620
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6492
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6648
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5528
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4692
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6132
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5296
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5544
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5288
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7052
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6636
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5296
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5084
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1228
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6484
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3356
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6336
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3168
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5748
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2656
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5248
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4896
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6132
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:836
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:652
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1228
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6932
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4896
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1764
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4336
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6552
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6336
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5052
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7140
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6580
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3956
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4692
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1596
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6412
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5156
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7144
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5256
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6996
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6636
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5536
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5156
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2084
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2744
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6580
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6944
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6640
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6284
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2648
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5368
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6704
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7012
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5504
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5384
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6728
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6168
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7044
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2604
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5244
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5688
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4040
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6688
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:968
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7060
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7144
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6592
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6564
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6728
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3584
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4456
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5544
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4840
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6860
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2604
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4236
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6636
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1228
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3612
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6628
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4768
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2760
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5156
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5520
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5236
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6912
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6088
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4692
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6632
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3020
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6932
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6456
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6324
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2140
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3280
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1816
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6684
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6748
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5592
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3532
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1544
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7140
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:468
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:944
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4420
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6188
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7012
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3368
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4568
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6548
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6168
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6964
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5388
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1540
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1896
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6908
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3532
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3356
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3220
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6896
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6712
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4040
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6100
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2648
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6648
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4680
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6104
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5732
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6732
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1352
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2768
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6484
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1228
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5504
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:636
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5480
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1236
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4560
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5212
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5724
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4480
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6872
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4984
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4692
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1816
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6112
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5352
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5716
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2312
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3220
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1712
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4680
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2968
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6608
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3372
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1904
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3824
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6440
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4604
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6660
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3392
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6212
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5356
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6636
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4604
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7120
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4040
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6752
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3588
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3020
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2980
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4256
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5212
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4768
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1612
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1020
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5396
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6440
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6636
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:912
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7048
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4900
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6188
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5520
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K RansomFlop2.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  PID:6464
- - C:\Windows\system32\attrib.exe
    attrib +h RansomFlop2.bat
    3⤵
    - Views/modifies file attributes
    PID:5276
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6456
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6368
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5508
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2752
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3404
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6372
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6716
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7004
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5508
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7048
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3372
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2788
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7048
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6636
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3392
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6312
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4256
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6644
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2968
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2760
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6132
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3220
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2740
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1816
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4464
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3532
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6820
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6372
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5036
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3404
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2068
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7052
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2788
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7052
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6952
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6512
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5808
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5248
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3168
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6544
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2760
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6512
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6632
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6996
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3392
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5612
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6820
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6580
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7144
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1540
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5296
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5432
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6168
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7004
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4924
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5372
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6716
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3392
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5384
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2980
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6484
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6680
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6316
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4692
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2068
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5808
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6648
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3276
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6704
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6824
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2984
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6372
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6952
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4692
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6544
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2084
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6744
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:632
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5588
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2084
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3020
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:632
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5256
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6492
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2068
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5084
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2900
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4580
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4216
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5780
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6544
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2948
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6744
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4456
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6640
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3452
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6164
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6824
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2200
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6440
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5244
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2736
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4592
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5524
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5932
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2084
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4660
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2980
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2728
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2644
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5236
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5084
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1228
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7016
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2504
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:836
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6668
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5104
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6832
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5540
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4148
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5252
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3688
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1460
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6492
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5320
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5052
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1224
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6660
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2748
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5592
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6688
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2604
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4580
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4320
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1228
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5128
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1392
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4712
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2736
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1564
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5476
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5992
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6696
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6764
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6100
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4236
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6716
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6484
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4924
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5824
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3532
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6592
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6416
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6444
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2716
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6912
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5128
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7120
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5448
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4516
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6996
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:636
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4524
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2716
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2068
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2448
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6316
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1544
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4900
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5004
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6188
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7084
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5616
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6452
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2448
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2604
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6896
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3184
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5432
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5584
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K RansomFlop2.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  PID:6496
- - C:\Windows\system32\attrib.exe
    attrib +h RansomFlop2.bat
    3⤵
    - Views/modifies file attributes
    PID:2916
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6564
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:836
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3404
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3448
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1816
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6996
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6512
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4376
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4320
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6368
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6952
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6820
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6512
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5748
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3448
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3520
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5420
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6812
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4840
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2140
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6952
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6544
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6312
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6300
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7044
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4976
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5536
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3448
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6564
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2604
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5620
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5084
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2988
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6088
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5808
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6336
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5156
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6716
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6284
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5536
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3448
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6932
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7152
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5664
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1816
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1836
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1764
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2736
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6100
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2748
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6512
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6088
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2604
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6644
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2084
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2748
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5520
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2752
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2656
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6132
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5440
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6372
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6440
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6964
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5244
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1764
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7048
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6820
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3368
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6688
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6708
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6492
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5084
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5620
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6636
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5688
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2740
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4560
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6700
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3996
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6440
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4236
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6372
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6952
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4560
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4296
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6484
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6820
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1544
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6544
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2900
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6096
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1228
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3276
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4040
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5520
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6760
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:632
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1764
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5528
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2752
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6964
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2980
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5084
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4308
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5180
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2980
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6644
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2516
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5236
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4704
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3776
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5388
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6564
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6712
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6608
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2788
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5256
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7096
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3996
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:664
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6696
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4444
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1764
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6744
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4456
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2744
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6440
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6608
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2936
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5212
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2980
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3812
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6088
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6324
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3776
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6696
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5732
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5128
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6764
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6812
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5256
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6700
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6268
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:640
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6852
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5304
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5288
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:228
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2752
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5452
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6716
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5104
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6892
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3432
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1020
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5724
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2376
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2956
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5812
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6912
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5472
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6816
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6752
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5528
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7060
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3220
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5024
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1596
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2956
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5452
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5420
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2980
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1356
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6268
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1800
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6100
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2604
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6804
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6116
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4532
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5764
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1048
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2748
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5704
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2744
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7112
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5976
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5992
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4712
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2540
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6252
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4532
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3584
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4524
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6508
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6804
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6252
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5752
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5432
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1756
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5296
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4692
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5276
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4944
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3708
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5688
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5164
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5732
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5724
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:808
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2656
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5688
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1392
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K RansomFlop2.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  PID:6432
- - C:\Windows\system32\attrib.exe
    attrib +h RansomFlop2.bat
    3⤵
    - Views/modifies file attributes
    PID:5352
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5620
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4980
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4976
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6372
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7016
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2748
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2644
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4336
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5620
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6592
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3452
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6316
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2760
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7152
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:760
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6712
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6632
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:760
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6336
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2736
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:836
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1356
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1836
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4336
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5156
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6608
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5288
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6716
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2164
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7140
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2752
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6832
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7144
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3368
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6820
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2200
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2952
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5036
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5288
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3956
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2516
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7060
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5480
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3588
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6816
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4188
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5100
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6952
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1596
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6128
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6188
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5748
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3996
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7016
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6644
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2164
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2644
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6816
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2656
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4216
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6100
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6552
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6632
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6284
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6816
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6492
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5368
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3280
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3520
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4420
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2980
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2644
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5372
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6212
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6732
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3588
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5856
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6776
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6132
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6784
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3584
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2936
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4704
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6764
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4788
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5544
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1352
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2900
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5416
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6644
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6128
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5632
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4980
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5480
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5728
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6780
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7096
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1540
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2604
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4840
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6912
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6816
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2952
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6684
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4560
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5036
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4516
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4216
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7016
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6932
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:572
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6372
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2768
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6560
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6212
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5764
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:760
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2084
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6036
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6668
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7052
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4704
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5236
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4396
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1884
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5704
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4604
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5504
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6824
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6680
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5128
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6872
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4712
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6252
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3392
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7072
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4308
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4976
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6540
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6560
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6780
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:3328
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4016
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2140
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6776
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5420
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4920
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2900
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4200
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6372
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2752
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5308
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:752
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6736
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5128
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4984
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6116
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6132
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4464
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5252
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4216
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5520
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6728
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6268
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2448
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7096
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:652
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6736
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5724
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5452
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2084
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6268
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:7120
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6508
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2968
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:6748
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:4924
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1788
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:2728
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:5352
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RansomFlop2\RansomFlop\flop.mov"
    3⤵
    PID:1544

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x150 0x504
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
64KB

MD5
475b50689dfe5ac600b3de04ace088ea

SHA1
fbb328c285b985d98e436e1a2025dc2ef814f08d

SHA256
bb3580399452f7fc44aa591302242cc83e1a1c5daad646fcc2d1d3e81b9b7bc1

SHA512
55bef283c23fe00a25ab86c8e62df455236bb4a114d72da8986d0ab51b46567f195d35f94de1e133ae61e95d121de99938aa02e80abfd38c3c841fde9214c381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
20KB

MD5
8dc2756f85fccea2e456061d06bdea5e

SHA1
cdb7f846722ae88cfcca334697b1c61e7945d8ea

SHA256
ff17f0a5c2b621ce0625cfd2d947bf0eabf322c95a8e75a27f42d0722329ae9e

SHA512
585b17e9f72a35299cf49d23567dd29d1fbc70caef0c8374f20ed43c16bcfbbe0cb95107a88e3666b88c1d09263e2180771effeb9fdfdd8423cc08840dcf0d69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d9798c8eae7eb5530225c6e3e94d2b4a

SHA1
42b5526e44c61add34f32ca88fd99f34eff0b9bc

SHA256
86641715ed7e242ecc6a46b25ed225c3fb02da61ded798dc2c4cd3d55aa0c434

SHA512
da1a19b2937845f61abdcbe6554ca949876919fb22211fad7a8c5c37501518d569e1f900826a97cfe557d4d89d755477bbafaa91bd7e92e821f854aa02057be9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
eadca9b55c55d41270989767790ac94e

SHA1
67b0688648c6134299c6632d4c397fadfb971137

SHA256
cff38df73eeec3f87abb33e11e365f00e18c6a3a96239ffd6807716ddea90bca

SHA512
9a95e53ca748e287724df6df7f96d53adf11b4de621298ad9153a9abd861b0089696931f4dfbbacb4be19be863a645d7214f9d59a15113ad2e87a4ed7bd79c0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
049bcb5a93bb606619545839e934f75b

SHA1
69b7669519b5a4de1ac14d5c763425574a1fe461

SHA256
253ba14d1f94656479071ec36c6546c7521ecb63b19142a68baaae7f5db6436f

SHA512
bd77571bf29015840443eeffb7f12f92e19e18fee7595f26395ff4ee92df20d91a03aa006e8c6267eb4b62c5c35524621f13f651b6b420cf6ddb41ca4676d932

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
19e0d0068e036671ce26716cd3a1e2ee

SHA1
96af51892763982e1b1748d675ed9ca071e0328f

SHA256
75e72c7d05de305cb1d968b9c948efaf7c8c2a9e80621252905ee820648f99e7

SHA512
331ae4e6434c49f5241fd9f40fec809f0c5b9a6bdd888e6f1cc212247a95defd679278de998b7275b8e46d8d4c9f2236dfe172963b9a9f504f6cc9faf0317928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
37f4aa26e075dc2116247932932874a4

SHA1
9b5ca3112aed73ec42cf91de71ed8dff2ff09827

SHA256
c51a27ada033757927f6e40e655c957fc1c2979ece0a4fa2f2c615570a471e40

SHA512
ed500580dafa1e6a2c270cb052c634f186386465a711555e533ed0a4c348121f26724dcd2910c00557166a777142cfb059e49aa6d1eeb8828138ae9592395782

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
97699a3933503533df0a4426e79c62d9

SHA1
8e2810e206889a5c49c2613d3f00e8b1aed58bcf

SHA256
e64185eb910fc415e0072603ac5c1117ea4139f0c6ca6501f5e4c8ce8203f3ef

SHA512
753b59401774290657226844b6f6f6693a2ee410520a68dca4091aa2532a4b693537d046fa188e4dae229460cac90aff717de91347da87a50a6031e3540fe7e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
b83d0908a08ca6580539eba2c52ca162

SHA1
4cfc818c81a7f4472a1b5ca639ae8785228146b7

SHA256
e3eeae23fd6d42b385ad9145d9e31fc293695d0e98c9cb19224fa49eb7817001

SHA512
51fbe5b20611236dde1d750a3ea38376c4702ca19bc50a20b88457858c55ca24d8e5b0af5e3e79dfbcd5abe08f3b0131f2b866cf690dfac8b7a899957668f4e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
7f9d411d69e90b0d9feaac14e939270d

SHA1
7a18de6fe2722e976f4ef91c59427843f8c01a74

SHA256
c437d18262a4798c24004f6cc50f5704ef0b31805af405756e50230a0cbc6ea2

SHA512
0b92c39b99b447b458e09363826888d6c4de8e6b1221185dd2458186ed30149d44fb83c74fcd76b9a3f194d60aec9db8458d6961428144db7c226836088276e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6a1bf1142ee0c405564cbe46d2de71fa

SHA1
2ef9814445dcf56101e3301afa3eb53dc15609a8

SHA256
dc09b909bbe9791c574c1d1fc1e085fe2abbfb8af2105e04ab8a879a20d6c187

SHA512
850b38d6db3997fe642e7c7e3ed8dd0d5717527a3360fff4419e08d754ad049162ec52afb8728e4b49c862be8909e21bb39d73f72f3ddcf98cf5343ccfe07bd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
1cfed8011acfbb4a3e20f2188dd497d3

SHA1
4f331720889087eb7bc36318ed2af227d1030497

SHA256
394c129af5a09d79be79475d4a106e61f6d0f3187ee1971b2b76b110fcb4b9ab

SHA512
9e64db1562c249435089f9984568ab22e7da953dfc2d5652a6cb7480bcb91d811ca78676219bfa82107cfc4ebb3c617f139083447445333c4697f0504bfc6840

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578fec.TMP

Filesize
3KB

MD5
9d1edd5e44f631d60de6952aa7dd5cde

SHA1
1424c116b9a0f4e06071536bccc20cf6508ee153

SHA256
d531e85ada28617a24c127ffc8f74a79f83e51a93cdd57a4e5bb465b30cef9d1

SHA512
c591424adbb98250dddc49629abc0cd35de001d7fed1365668cde98e101efa29607368f6a5273bc8c4484948d3bd9dfa63b0f385bec0282d63fd45cf101fe21c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5e91ea66d1c90aec3f2a6a837e2f079b

SHA1
ffd224861baee39fd973288cf7650b279e0da1b5

SHA256
71ec0c745d234a292255ac3156c5612b1adbf9c32f2983db0ccbf74dfcf644ad

SHA512
21669ecd485974032c8759e17c90372feb31f06e24bca3a07756d7644283fa8f9774fc9c70ebd088bf02ea47401f31825546067f611ec35ada0dbb51f49ee544

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
fe856f02ce59b2e1a079d196c747196f

SHA1
ce198663d291ea1dce448f913b077e50738e7969

SHA256
ed6897fee141172556cbc36c530be49bffe80bd2b3f408557587490143e55027

SHA512
06a0b0a3b48578f2ae6b8bc3082a46b91729d23d897b88f074e3e6ea2295cc2a14138782a7e91095ed44a4b0a1913dbe539dc90df92f301813fb06585670b1df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
90a34ccfc14f4a8674cc2cd1e0b602f9

SHA1
c147203e0755becb1974953f6f59840aa2cc7294

SHA256
3ae6df1b14c312790fd6da22be47953196406662f85cee4b1ae74692f4aaf348

SHA512
5ad870e7a82137576dbb3c5cbf0c4f8f960dd0c6a9d1a415de6625b2d3b9e387d6e9d6e132a2bb35447f67d40b000a564ff0f7a156f4339f3ca8a642169ddefc

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
95B

MD5
88111e156beade33c4dca803712caf49

SHA1
54ad7faea2fb88071045cc1d7ccd73811c4bab1a

SHA256
fd7cc35b309d98774940ebda223096d173268e3218cb7f640179c87449bc795c

SHA512
6029271295545b3cedbc5315d7222efd607cfd3914348e364c0a068317f66727cda667c7d00ecd6c168819e3643f4aabe9295850a26f1e3f469aa42be3514d88

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.Ya3616

Filesize
94B

MD5
a1fadc618e5716a91165c7ee1516ccbe

SHA1
481998f341750d0f45949545bfede8a2ca1ac3d3

SHA256
acb3cba82905ada194df56d226a3cbfa7f3de367fa0a9f291904af5922df5649

SHA512
05327a4a32a240a1bef4747cf9748c224f7fd896f2ef007cfce85ea117e0665dc68ce260ef17691379b6f7565b24d3da0d14be3b88780720dcc1ac6750be75be

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.lock

Filesize
18B

MD5
f45162ae5f03de8a25e0cd88cb8e5729

SHA1
c4c71fa4e0a7f96aa74b38394dc85377e530526a

SHA256
91bf7e4211246be735a4330ec3d12ad5c7a5cde13a1353ae46787b140ae082a8

SHA512
de63f136e85acfaf6e6cf52d906d8370cdab7b0c3d54920cbdfa14d7ce6f531671b4366bd894d52db5fb60715e15e335c56567ec76791c14955d0d4141c7c513

Download Submit
C:\Users\Admin\Downloads\RansomFlop2.zip

Filesize
3.2MB

MD5
4c44f958ccf711d50380442b67d58c1d

SHA1
54c4d1b1b8cd11b89765e9f66b7dc6a5702f360a

SHA256
94983c58b63762c5cedb50b293f434be2b7c01b8ed9a41a5a41a2327f1617f23

SHA512
1a0564ecce416e7b2effd625690ff443c27f9c186c6b4003954e492114461cf4790db4d20ffe9c1e6c781de03157de9db9a9916dd061e597ce98ff017815dfd3

Download Submit
memory/1356-339-0x00007FFF1BAA0000-0x00007FFF1BAD4000-memory.dmp

Filesize
208KB

Download
memory/1356-342-0x00007FFF16B70000-0x00007FFF16B87000-memory.dmp

Filesize
92KB

Download
memory/1356-343-0x00007FFF112B0000-0x00007FFF112C1000-memory.dmp

Filesize
68KB

Download
memory/1356-341-0x00007FFF17230000-0x00007FFF17248000-memory.dmp

Filesize
96KB

Download
memory/1356-340-0x00007FFF0CCD0000-0x00007FFF0CF86000-memory.dmp

Filesize
2.7MB

Download
memory/1356-338-0x00007FF7E6020000-0x00007FF7E6118000-memory.dmp

Filesize
992KB

Download
memory/3372-325-0x00007FFF112B0000-0x00007FFF112C1000-memory.dmp

Filesize
68KB

Download
memory/3372-324-0x00007FFF16B70000-0x00007FFF16B87000-memory.dmp

Filesize
92KB

Download
memory/3372-323-0x00007FFF17230000-0x00007FFF17248000-memory.dmp

Filesize
96KB

Download
memory/3372-320-0x00007FF7E6020000-0x00007FF7E6118000-memory.dmp

Filesize
992KB

Download
memory/3372-322-0x00007FFF0CCD0000-0x00007FFF0CF86000-memory.dmp

Filesize
2.7MB

Download
memory/3372-321-0x00007FFF1BAA0000-0x00007FFF1BAD4000-memory.dmp

Filesize
208KB

Download
memory/3956-306-0x00007FF7E6020000-0x00007FF7E6118000-memory.dmp

Filesize
992KB

Download
memory/3956-319-0x00007FFF112B0000-0x00007FFF112C1000-memory.dmp

Filesize
68KB

Download
memory/3956-318-0x00007FFF16B70000-0x00007FFF16B87000-memory.dmp

Filesize
92KB

Download
memory/3956-315-0x00007FFF1BAA0000-0x00007FFF1BAD4000-memory.dmp

Filesize
208KB

Download
memory/3956-316-0x00007FFF0CCD0000-0x00007FFF0CF86000-memory.dmp

Filesize
2.7MB

Download
memory/3956-317-0x00007FFF17230000-0x00007FFF17248000-memory.dmp

Filesize
96KB

Download
memory/4464-304-0x00007FFF0CCD0000-0x00007FFF0CF86000-memory.dmp

Filesize
2.7MB

Download
memory/4464-303-0x00007FFF1BAA0000-0x00007FFF1BAD4000-memory.dmp

Filesize
208KB

Download
memory/4464-302-0x00007FF7E6020000-0x00007FF7E6118000-memory.dmp

Filesize
992KB

Download
memory/4464-309-0x00007FFF17230000-0x00007FFF17248000-memory.dmp

Filesize
96KB

Download
memory/4464-310-0x00007FFF16B70000-0x00007FFF16B87000-memory.dmp

Filesize
92KB

Download
memory/4464-311-0x00007FFF112B0000-0x00007FFF112C1000-memory.dmp

Filesize
68KB

Download
memory/4980-363-0x00007FFF1BAA0000-0x00007FFF1BAD4000-memory.dmp

Filesize
208KB

Download
memory/4980-364-0x00007FFF0CCD0000-0x00007FFF0CF86000-memory.dmp

Filesize
2.7MB

Download
memory/4980-362-0x00007FF7E6020000-0x00007FF7E6118000-memory.dmp

Filesize
992KB

Download
memory/4980-365-0x00007FFF17230000-0x00007FFF17248000-memory.dmp

Filesize
96KB

Download
memory/4980-366-0x00007FFF16B70000-0x00007FFF16B87000-memory.dmp

Filesize
92KB

Download
memory/5620-327-0x00007FFF1BAA0000-0x00007FFF1BAD4000-memory.dmp

Filesize
208KB

Download
memory/5620-330-0x00007FFF16B70000-0x00007FFF16B87000-memory.dmp

Filesize
92KB

Download
memory/5620-326-0x00007FF7E6020000-0x00007FF7E6118000-memory.dmp

Filesize
992KB

Download
memory/5620-331-0x00007FFF112B0000-0x00007FFF112C1000-memory.dmp

Filesize
68KB

Download
memory/5620-328-0x00007FFF0CCD0000-0x00007FFF0CF86000-memory.dmp

Filesize
2.7MB

Download
memory/5620-329-0x00007FFF17230000-0x00007FFF17248000-memory.dmp

Filesize
96KB

Download
memory/6368-356-0x00007FF7E6020000-0x00007FF7E6118000-memory.dmp

Filesize
992KB

Download
memory/6368-357-0x00007FFF1BAA0000-0x00007FFF1BAD4000-memory.dmp

Filesize
208KB

Download
memory/6368-361-0x00007FFF112B0000-0x00007FFF112C1000-memory.dmp

Filesize
68KB

Download
memory/6368-360-0x00007FFF16B70000-0x00007FFF16B87000-memory.dmp

Filesize
92KB

Download
memory/6368-359-0x00007FFF17230000-0x00007FFF17248000-memory.dmp

Filesize
96KB

Download
memory/6456-332-0x00007FF7E6020000-0x00007FF7E6118000-memory.dmp

Filesize
992KB

Download
memory/6456-333-0x00007FFF1BAA0000-0x00007FFF1BAD4000-memory.dmp

Filesize
208KB

Download
memory/6456-336-0x00007FFF16B70000-0x00007FFF16B87000-memory.dmp

Filesize
92KB

Download
memory/6456-337-0x00007FFF112B0000-0x00007FFF112C1000-memory.dmp

Filesize
68KB

Download
memory/6456-334-0x00007FFF0CCD0000-0x00007FFF0CF86000-memory.dmp

Filesize
2.7MB

Download
memory/6456-335-0x00007FFF17230000-0x00007FFF17248000-memory.dmp

Filesize
96KB

Download
memory/6564-344-0x00007FF7E6020000-0x00007FF7E6118000-memory.dmp

Filesize
992KB

Download
memory/6564-312-0x00007FFF17230000-0x00007FFF17248000-memory.dmp

Filesize
96KB

Download
memory/6564-307-0x00007FFF1BAA0000-0x00007FFF1BAD4000-memory.dmp

Filesize
208KB

Download
memory/6564-314-0x00007FFF112B0000-0x00007FFF112C1000-memory.dmp

Filesize
68KB

Download
memory/6564-345-0x00007FFF1BAA0000-0x00007FFF1BAD4000-memory.dmp

Filesize
208KB

Download
memory/6564-346-0x00007FFF0CCD0000-0x00007FFF0CF86000-memory.dmp

Filesize
2.7MB

Download
memory/6564-349-0x00007FFF112B0000-0x00007FFF112C1000-memory.dmp

Filesize
68KB

Download
memory/6564-313-0x00007FFF16B70000-0x00007FFF16B87000-memory.dmp

Filesize
92KB

Download
memory/6564-347-0x00007FFF17230000-0x00007FFF17248000-memory.dmp

Filesize
96KB

Download
memory/6564-348-0x00007FFF16B70000-0x00007FFF16B87000-memory.dmp

Filesize
92KB

Download
memory/6564-305-0x00007FF7E6020000-0x00007FF7E6118000-memory.dmp

Filesize
992KB

Download
memory/6564-308-0x00007FFF0CCD0000-0x00007FFF0CF86000-memory.dmp

Filesize
2.7MB

Download
memory/7032-354-0x00007FFF16B70000-0x00007FFF16B87000-memory.dmp

Filesize
92KB

Download
memory/7032-350-0x00007FF7E6020000-0x00007FF7E6118000-memory.dmp

Filesize
992KB

Download
memory/7032-353-0x00007FFF17230000-0x00007FFF17248000-memory.dmp

Filesize
96KB

Download
memory/7032-352-0x00007FFF0CCD0000-0x00007FFF0CF86000-memory.dmp

Filesize
2.7MB

Download
memory/7032-351-0x00007FFF1BAA0000-0x00007FFF1BAD4000-memory.dmp

Filesize
208KB

Download
memory/7032-355-0x00007FFF112B0000-0x00007FFF112C1000-memory.dmp

Filesize
68KB

Download