mimikatz | hxxps://github[.]com/enginestein/Virus-Collection/blob/main/Windows/Binaries/Ransomware

Analysis

max time kernel
234s
max time network
235s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2024 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/enginestein/Virus-Collection/blob/main/Windows/Binaries/Ransomware

Score

10^/10

mimikatz troldesh bootkit discovery evasion persistence ransomware spyware stealer trojan upx

Malware Config

Signatures

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh
Renames multiple (77) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000023d4f-421.dat	mimikatz

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Krotten.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Krotten.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	NotPetya.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	HIkckYYg.exe

Executes dropped EXE 31 IoCs

pid	Process
5284	Krotten.exe
5876	NoMoreRansom.exe
6012	NoMoreRansom.exe
2960	NotPetya.exe
5760	EF5C.tmp
5688	PolyRansom.exe
4960	pcgcUMEk.exe
5064	HIkckYYg.exe
448	PolyRansom.exe
1524	PolyRansom.exe
2276	PolyRansom.exe
3408	PolyRansom.exe
5280	PolyRansom.exe
4372	PolyRansom.exe
5740	PolyRansom.exe
3936	PolyRansom.exe
1124	PolyRansom.exe
3448	PolyRansom.exe
3480	PolyRansom.exe
2652	PolyRansom.exe
2124	PolyRansom.exe
4008	PolyRansom.exe
5608	PolyRansom.exe
4980	PolyRansom.exe
2268	PolyRansom.exe
5888	PolyRansom.exe
6028	PolyRansom.exe
2960	PolyRansom.exe
5092	PolyRansom.exe
5504	PolyRansom.exe
5560	PolyRansom.exe

Loads dropped DLL 1 IoCs

pid	Process
5144	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\WINDOWS\\Web\\rundll32.exe"	Krotten.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPCC = "C:\\WINDOWS\\Cursors\\avp.exe"	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	NoMoreRansom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pcgcUMEk.exe = "C:\\Users\\Admin\\DYcEkQcs\\pcgcUMEk.exe"	PolyRansom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HIkckYYg.exe = "C:\\ProgramData\\PcwYAUcg\\HIkckYYg.exe"	PolyRansom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HIkckYYg.exe = "C:\\ProgramData\\PcwYAUcg\\HIkckYYg.exe"	HIkckYYg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pcgcUMEk.exe = "C:\\Users\\Admin\\DYcEkQcs\\pcgcUMEk.exe"	pcgcUMEk.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
62	raw.githubusercontent.com
63	raw.githubusercontent.com

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "DANGER"	Krotten.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Äëÿ òîãî ÷òîáû âîññòàíîâèòü íîðìàëüíóþ ðàáîòó ñâîåãî êîìïüþòåðà íå ïîòåðÿâ ÂÑÞ èíôîðìàöèþ! È ñ ýêîíîìèâ äåíüãè, ïðèøëè ìíå íà e-mail [email protected] êîä ïîïîëíåíèÿ ñ÷åòà êèåâñòàð íà 25 ãðèâåíü. Â îòâåò â òå÷åíèå äâåíàäöàòè ÷àñîâ íà ñâîé e-mail òû ïîëó÷èøü ôàèë äëÿ óäàëåíèÿ ýòîé ïðîãðàììû."	Krotten.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\shell32.dll.exe	HIkckYYg.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5876-297-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5876-298-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5876-299-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5876-301-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/6012-314-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/6012-315-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/6012-333-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5876-345-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5876-357-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5876-435-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5876-454-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5876-466-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5876-727-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5876-812-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5876-1024-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5876-1889-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5876-2474-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5876-2502-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5876-2547-0x0000000000400000-0x00000000005DE000-memory.dmp	upx

Drops file in Program Files directory 54 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrome.7z	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS	rundll32.exe
File opened for modification	C:\Program Files\TraceUse.sql	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Archive.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\java.settings.cfg	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.VBS	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.pdf	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.XLSX	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\classfile_constants.h	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jawt.h	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jni.h	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033\FPEXT.MSG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.pdf	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.cfg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\javafx-src.zip	rundll32.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jvmti.h	rundll32.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\Web	Krotten.exe
File created	C:\Windows\perfc.dat	NotPetya.exe
File opened for modification	C:\Windows\perfc.dat	rundll32.exe
File created	C:\Windows\perfc	rundll32.exe
File created	C:\Windows\dllhost.dat	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PolyRansom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PolyRansom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PolyRansom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PolyRansom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PolyRansom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PolyRansom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PolyRansom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PolyRansom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PolyRansom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PolyRansom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PolyRansom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HIkckYYg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Control Panel 6 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\sTimeFormat = "ÕÓÉ"	Krotten.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\WallpaperOriginX = "210"	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\WallpaperOriginY = "187"	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\MenuShowDelay = "9999"	Krotten.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International	Krotten.exe

Modifies Internet Explorer settings 1 TTPs 17 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window title = ":::::::::::::::::: ÌÎÉ ÕÓÉ ÏÐÎÒÓÕ À ÏÈÇÄÀ ÃÍÈÅÒ ::::::::::::::::::"	Krotten.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{63E736A5-90BC-11EF-ADF2-E24E87F0D14E} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Window title = ":::::::::::::::::: ÌÎÉ ÕÓÉ ÏÐÎÒÓÕ À ÏÈÇÄÀ ÃÍÈÅÒ ::::::::::::::::::"	Krotten.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://poetry.rotten.com/lightning/"	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://poetry.rotten.com/lightning/"	Krotten.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	msedge.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\REGFILE\SHELL\OPEN\COMMAND	Krotten.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
2944	reg.exe
2940	reg.exe
5440	reg.exe
5128	reg.exe
2940	reg.exe
868	reg.exe
2960	reg.exe
3468	reg.exe
2580	reg.exe
3936	reg.exe
736	reg.exe
1432	reg.exe
3656	reg.exe
644	reg.exe
1628	reg.exe
5564	reg.exe
2296	reg.exe
1976	reg.exe
4120	reg.exe
4408	reg.exe
3404	reg.exe
3100	reg.exe
5192	reg.exe
5768	reg.exe
1396	reg.exe
3100	reg.exe
3904	reg.exe
5448	reg.exe
3408	reg.exe
3092	reg.exe
6140	reg.exe
6140	reg.exe
4688	reg.exe
3468	reg.exe
6044	reg.exe
2212	reg.exe
4144	reg.exe
4552	reg.exe
436	reg.exe
700	reg.exe
5756	reg.exe
1524	reg.exe
2384	reg.exe
3632	reg.exe
5460	reg.exe
5224	reg.exe
5400	reg.exe
3320	reg.exe
3968	reg.exe
5304	reg.exe
3632	reg.exe
1000	reg.exe
5380	reg.exe
2520	reg.exe
1376	reg.exe
368	reg.exe
5768	reg.exe
5792	reg.exe
5380	reg.exe
1944	reg.exe
5852	reg.exe
5216	reg.exe
3920	reg.exe
2652	reg.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 540405.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 486891.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 672175.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 337206.crdownload:SmartScreen	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5852	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5160	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4524	msedge.exe
4524	msedge.exe
64	identity_helper.exe
64	identity_helper.exe
5184	msedge.exe
5184	msedge.exe
5780	msedge.exe
5780	msedge.exe
5876	NoMoreRansom.exe
5876	NoMoreRansom.exe
5876	NoMoreRansom.exe
5876	NoMoreRansom.exe
6012	NoMoreRansom.exe
6012	NoMoreRansom.exe
6012	NoMoreRansom.exe
6012	NoMoreRansom.exe
5020	msedge.exe
5020	msedge.exe
5144	rundll32.exe
5144	rundll32.exe
5760	EF5C.tmp
5760	EF5C.tmp
5760	EF5C.tmp
5760	EF5C.tmp
5760	EF5C.tmp
5760	EF5C.tmp
5760	EF5C.tmp
2124	msedge.exe
2124	msedge.exe
5688	PolyRansom.exe
5688	PolyRansom.exe
5688	PolyRansom.exe
5688	PolyRansom.exe
448	PolyRansom.exe
448	PolyRansom.exe
448	PolyRansom.exe
448	PolyRansom.exe
1524	PolyRansom.exe
1524	PolyRansom.exe
1524	PolyRansom.exe
1524	PolyRansom.exe
2276	PolyRansom.exe
2276	PolyRansom.exe
2276	PolyRansom.exe
2276	PolyRansom.exe
3408	PolyRansom.exe
3408	PolyRansom.exe
3408	PolyRansom.exe
3408	PolyRansom.exe
5280	PolyRansom.exe
5280	PolyRansom.exe
5280	PolyRansom.exe
5280	PolyRansom.exe
4372	PolyRansom.exe
4372	PolyRansom.exe
4372	PolyRansom.exe
4372	PolyRansom.exe
5740	PolyRansom.exe
5740	PolyRansom.exe
5740	PolyRansom.exe
5740	PolyRansom.exe
3936	PolyRansom.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5160	vlc.exe
5064	HIkckYYg.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	5284	Krotten.exe
Token: SeSystemtimePrivilege	5284	Krotten.exe
Token: SeSystemtimePrivilege	5284	Krotten.exe
Token: SeShutdownPrivilege	5144	rundll32.exe
Token: SeDebugPrivilege	5144	rundll32.exe
Token: SeTcbPrivilege	5144	rundll32.exe
Token: SeDebugPrivilege	5760	EF5C.tmp

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
5160	vlc.exe
5160	vlc.exe
5160	vlc.exe
5160	vlc.exe
5160	vlc.exe
5160	vlc.exe
5160	vlc.exe
5160	vlc.exe
5160	vlc.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
5160	vlc.exe
5160	vlc.exe
5160	vlc.exe
5160	vlc.exe
5160	vlc.exe
5160	vlc.exe
5160	vlc.exe
5160	vlc.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5160	vlc.exe
2960	NotPetya.exe
5836	IEXPLORE.EXE
5836	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 4556	4524	msedge.exe	86
PID 4524 wrote to memory of 4556	4524	msedge.exe	86
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 2216	4524	msedge.exe	87
PID 4524 wrote to memory of 4692	4524	msedge.exe	88
PID 4524 wrote to memory of 4692	4524	msedge.exe	88
PID 4524 wrote to memory of 1808	4524	msedge.exe	89
PID 4524 wrote to memory of 1808	4524	msedge.exe	89
PID 4524 wrote to memory of 1808	4524	msedge.exe	89
PID 4524 wrote to memory of 1808	4524	msedge.exe	89
PID 4524 wrote to memory of 1808	4524	msedge.exe	89
PID 4524 wrote to memory of 1808	4524	msedge.exe	89
PID 4524 wrote to memory of 1808	4524	msedge.exe	89
PID 4524 wrote to memory of 1808	4524	msedge.exe	89
PID 4524 wrote to memory of 1808	4524	msedge.exe	89
PID 4524 wrote to memory of 1808	4524	msedge.exe	89
PID 4524 wrote to memory of 1808	4524	msedge.exe	89
PID 4524 wrote to memory of 1808	4524	msedge.exe	89
PID 4524 wrote to memory of 1808	4524	msedge.exe	89
PID 4524 wrote to memory of 1808	4524	msedge.exe	89
PID 4524 wrote to memory of 1808	4524	msedge.exe	89
PID 4524 wrote to memory of 1808	4524	msedge.exe	89
PID 4524 wrote to memory of 1808	4524	msedge.exe	89
PID 4524 wrote to memory of 1808	4524	msedge.exe	89
PID 4524 wrote to memory of 1808	4524	msedge.exe	89
PID 4524 wrote to memory of 1808	4524	msedge.exe	89

System policy modification 1 TTPs 37 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPrinterTabs = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPrinters = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoManageMyComputerVerb = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D} = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFavoritesMenu = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoUserNameInStartMenu = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoThemesTab = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "1044"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMMyDocs = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsMenu = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	Krotten.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuPinnedList = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMMyPictures = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Uninstall\NoAddRemovePrograms = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSaveSettings = "1"	Krotten.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogOff = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMFUprogramsList = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMyMusic = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktop = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewOnDrive = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetHood = "1"	Krotten.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuSubFolders = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{450D8FBA-AD25-11D0-98A8-0800361B1103} = "1"	Krotten.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Uninstall	Krotten.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/enginestein/Virus-Collection/blob/main/Windows/Binaries/Ransomware
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1a8f46f8,0x7ffe1a8f4708,0x7ffe1a8f4718
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5184
- C:\Users\Admin\Downloads\Krotten.exe
  "C:\Users\Admin\Downloads\Krotten.exe"
  2⤵
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies WinLogon
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5780
- C:\Users\Admin\Downloads\NoMoreRansom.exe
  "C:\Users\Admin\Downloads\NoMoreRansom.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:5876
- C:\Users\Admin\Downloads\NoMoreRansom.exe
  "C:\Users\Admin\Downloads\NoMoreRansom.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020
- C:\Users\Admin\Downloads\NotPetya.exe
  "C:\Users\Admin\Downloads\NotPetya.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2960
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Windows\perfc.dat #1
    3⤵
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5144
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 22:27
      4⤵
      PID:5408
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 22:27
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\EF5C.tmp
      "C:\Users\Admin\AppData\Local\Temp\EF5C.tmp" \\.\pipe\{EB4ECC97-966C-4309-BE9B-6F06502403EC}
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2124
- C:\Users\Admin\Downloads\PolyRansom.exe
  "C:\Users\Admin\Downloads\PolyRansom.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5688
- - C:\Users\Admin\DYcEkQcs\pcgcUMEk.exe
    "C:\Users\Admin\DYcEkQcs\pcgcUMEk.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:4960
- - C:\ProgramData\PcwYAUcg\HIkckYYg.exe
    "C:\ProgramData\PcwYAUcg\HIkckYYg.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:5064
  - - C:\Windows\SysWOW64\notepad.exe
      notepad.exe "C:\Users\Admin\My Documents\myfile"
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" about:blank
      4⤵
      PID:3328
    - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" about:blank
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:5836
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5836 CREDAT:17410 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:740
  - - C:\Users\Admin\Downloads\PolyRansom.exe
      C:\Users\Admin\Downloads\PolyRansom
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:448
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        5⤵
        
        PID:5108
      - C:\Users\Admin\Downloads\PolyRansom.exe
        
        C:\Users\Admin\Downloads\PolyRansom
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        7⤵
        
        PID:5764
        
        C:\Users\Admin\Downloads\PolyRansom.exe
        
        C:\Users\Admin\Downloads\PolyRansom
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
        
        C:\Users\Admin\Downloads\PolyRansom.exe
        
        C:\Users\Admin\Downloads\PolyRansom
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        11⤵
        
        PID:4924
        
        C:\Users\Admin\Downloads\PolyRansom.exe
        
        C:\Users\Admin\Downloads\PolyRansom
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:672
        
        C:\Users\Admin\Downloads\PolyRansom.exe
        
        C:\Users\Admin\Downloads\PolyRansom
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        15⤵
        
        PID:5824
        
        C:\Users\Admin\Downloads\PolyRansom.exe
        
        C:\Users\Admin\Downloads\PolyRansom
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        17⤵
        
        PID:6028
        
        C:\Users\Admin\Downloads\PolyRansom.exe
        
        C:\Users\Admin\Downloads\PolyRansom
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        19⤵
        
        PID:5172
        
        C:\Users\Admin\Downloads\PolyRansom.exe
        
        C:\Users\Admin\Downloads\PolyRansom
        20⤵
        Executes dropped EXE
        
        PID:1124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        21⤵
        
        PID:1588
        
        C:\Users\Admin\Downloads\PolyRansom.exe
        
        C:\Users\Admin\Downloads\PolyRansom
        22⤵
        Executes dropped EXE
        
        PID:2124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:5784
        
        C:\Users\Admin\Downloads\PolyRansom.exe
        
        C:\Users\Admin\Downloads\PolyRansom
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        25⤵
        
        PID:5752
        
        C:\Users\Admin\Downloads\PolyRansom.exe
        
        C:\Users\Admin\Downloads\PolyRansom
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        27⤵
        
        PID:5824
        
        C:\Users\Admin\Downloads\PolyRansom.exe
        
        C:\Users\Admin\Downloads\PolyRansom
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        29⤵
        
        PID:1368
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        30⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        29⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5224
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        30⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        29⤵
        Modifies registry key
        
        PID:3936
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        30⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        29⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3404
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        30⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oUkUgUko.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        29⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        30⤵
        System Location Discovery: System Language Discovery
        
        PID:1008
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        27⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        27⤵
        Modifies registry key
        
        PID:368
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        27⤵
        Modifies registry key
        
        PID:1976
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        28⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jKYEIEsU.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        27⤵
        System Location Discovery: System Language Discovery
        
        PID:3576
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        28⤵
        System Location Discovery: System Language Discovery
        
        PID:5516
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        25⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        25⤵
        Modifies registry key
        
        PID:2580
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        25⤵
        Modifies registry key
        
        PID:5400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GuoAAAYo.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        25⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        26⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        23⤵
        Modifies registry key
        
        PID:2520
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        23⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3968
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        23⤵
        Modifies registry key
        
        PID:3468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dwwMIkgg.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        23⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        24⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        21⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        21⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5756
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        21⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JgogsYMg.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        21⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        22⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        19⤵
        Modifies registry key
        
        PID:5192
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        19⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2296
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        19⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XkswgkwE.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:3276
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        17⤵
        Modifies registry key
        
        PID:3656
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        17⤵
        Modifies registry key
        
        PID:700
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        17⤵
        Modifies registry key
        
        PID:5460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ycIIsIUs.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:5420
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        18⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        15⤵
        Modifies registry key
        
        PID:5448
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        15⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5128
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        15⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GigUcEkc.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:4396
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        16⤵
        
        PID:396
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        13⤵
        Modifies registry key
        
        PID:2944
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        13⤵
        Modifies registry key
        
        PID:1432
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        13⤵
        Modifies registry key
        
        PID:2960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uWoEkcIM.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        13⤵
        
        PID:740
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:1348
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        11⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:736
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        11⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3100
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        11⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZCscgkUg.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        11⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        12⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        9⤵
        Modifies registry key
        
        PID:3904
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1420
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        9⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VqsckYsQ.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1620
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        10⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        7⤵
        Modifies registry key
        
        PID:6140
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        7⤵
        Modifies registry key
        
        PID:868
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        7⤵
        Modifies registry key
        
        PID:4552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TkMYUkUo.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6104
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        8⤵
        
        PID:5404
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        5⤵
        Modifies registry key
        
        PID:644
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        5⤵
        Modifies registry key
        
        PID:2940
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:4144
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WAYIEEsw.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:704
      - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        6⤵
        
        PID:5368
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:1000
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    - Modifies registry key
    PID:2212
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2652
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UIwoIoMU.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
    3⤵
    PID:4980
  - - C:\Windows\SysWOW64\cscript.exe
      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
      4⤵
      PID:1684
- C:\Users\Admin\Downloads\PolyRansom.exe
  "C:\Users\Admin\Downloads\PolyRansom.exe"
  2⤵
  - Executes dropped EXE
  PID:3448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
    3⤵
    PID:1728
  - - C:\Users\Admin\Downloads\PolyRansom.exe
      C:\Users\Admin\Downloads\PolyRansom
      4⤵
      Executes dropped EXE
      PID:2652
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
      - C:\Users\Admin\Downloads\PolyRansom.exe
        
        C:\Users\Admin\Downloads\PolyRansom
        6⤵
        Executes dropped EXE
        
        PID:5608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        7⤵
        
        PID:5460
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:3656
        
        C:\Users\Admin\Downloads\PolyRansom.exe
        
        C:\Users\Admin\Downloads\PolyRansom
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4344
        
        C:\Users\Admin\Downloads\PolyRansom.exe
        
        C:\Users\Admin\Downloads\PolyRansom
        10⤵
        Executes dropped EXE
        
        PID:5092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        11⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        11⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3920
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        11⤵
        Modifies registry key
        
        PID:6044
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        12⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        11⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1628
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        12⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ASQsYUoY.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:684
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        12⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        9⤵
        Modifies registry key
        
        PID:5380
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        9⤵
        Modifies registry key
        
        PID:5792
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        9⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vAEUgQIk.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        9⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4120
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        7⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1376
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        7⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        7⤵
        Modifies registry key
        
        PID:5216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OMwMMoEI.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        7⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        8⤵
        
        PID:2840
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        5⤵
        Modifies registry key
        
        PID:4688
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3632
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:436
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:6120
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jccEMoEo.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        5⤵
        
        PID:6024
      - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        6⤵
        
        PID:1432
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    - Modifies registry key
    PID:3320
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    - Modifies registry key
    PID:5768
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    - Modifies registry key
    PID:1944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XqwkkAUE.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5676
  - - C:\Windows\SysWOW64\cscript.exe
      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
      4⤵
      System Location Discovery: System Language Discovery
      PID:5868
- C:\Users\Admin\Downloads\PolyRansom.exe
  "C:\Users\Admin\Downloads\PolyRansom.exe"
  2⤵
  - Executes dropped EXE
  PID:3480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
    3⤵
    PID:3620
  - - C:\Users\Admin\Downloads\PolyRansom.exe
      C:\Users\Admin\Downloads\PolyRansom
      4⤵
      Executes dropped EXE
      PID:4008
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3676
      - C:\Users\Admin\Downloads\PolyRansom.exe
        
        C:\Users\Admin\Downloads\PolyRansom
        6⤵
        Executes dropped EXE
        
        PID:2268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5376
        
        C:\Users\Admin\Downloads\PolyRansom.exe
        
        C:\Users\Admin\Downloads\PolyRansom
        8⤵
        Executes dropped EXE
        
        PID:2960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        9⤵
        
        PID:5228
        
        C:\Users\Admin\Downloads\PolyRansom.exe
        
        C:\Users\Admin\Downloads\PolyRansom
        10⤵
        Executes dropped EXE
        
        PID:5504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\PolyRansom"
        11⤵
        
        PID:452
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        11⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5564
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        12⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        11⤵
        Modifies registry key
        
        PID:3092
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        11⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wwEosUcI.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        11⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        12⤵
        
        PID:448
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        9⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4120
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        9⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5768
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        10⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        9⤵
        Modifies registry key
        
        PID:3468
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        10⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zowwokYc.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5480
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        10⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        7⤵
        Modifies registry key
        
        PID:3100
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        7⤵
        Modifies registry key
        
        PID:5440
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        7⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RIYQkwIw.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        8⤵
        
        PID:1124
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2940
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        5⤵
        Modifies registry key
        
        PID:4408
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:5304
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iUoYAQEA.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
        5⤵
        
        PID:3480
      - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5184
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:6140
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5380
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
    3⤵
    - Modifies registry key
    PID:1524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XaokUMsY.bat" "C:\Users\Admin\Downloads\PolyRansom.exe""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4940
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:740
  - - C:\Windows\SysWOW64\cscript.exe
      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
      4⤵
      PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6348 /prefetch:2
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,4070422010900603791,16759330282259956658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:5220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:464

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5988

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\OpenFormat.MOD"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe

Filesize
655KB

MD5
e69326b3b801334413e5729f2343065b

SHA1
f10ea0f08382012237f8417e9c19797705d3eb58

SHA256
88be99712bef6559012997fee1ba2d5035db46ba0e0cdd353ce51161d88fbc89

SHA512
e112ca607396ed2625d547e5c88f8bcec5d385673cf66e518fae75ba130a179330534e05a154608fc18b042a137a9545cc8ceb1aad50ef6af0be45a9034073fe

Download Submit
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.exe

Filesize
222KB

MD5
f4085a3d935843c93f99661c43ed19bd

SHA1
2a1461873a05a86293d96464746a9f96d2c5f03e

SHA256
cb4125908a0ebedda7c753839746c44c19272392b6737f356296a204e9f4b2b1

SHA512
6fe9130769bdb15463e72d7dce45eda36a0e92d3f4e8d164c44a1f5f287fe0591ef995e2af5e3286b61d372395cc9932084ef0555e8e041a02ab2d76778968a4

Download Submit
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.exe

Filesize
244KB

MD5
709a29d1507baa9e5c70ece25e92e503

SHA1
8f5332d5e762f483a506efe30fe051150ddeb870

SHA256
fb44faeb6e0b91d6346984388165ebb90a2de3d66ff64dcbdb3473fcc4482838

SHA512
e338200eff7628eea979a665f716b77bf2baf27d7ef16944ed6a3dba8858c6ab6c347b0c4572f542380516c9538c4b1a2ca9b4ca717ad6fca1ffb2caef91e31c

Download Submit
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.exe

Filesize
214KB

MD5
d8f696b6f6ef50b2b0db6e3506438188

SHA1
0f86c2f5263fd9b75b143122f8c680f442f80a2c

SHA256
120ff988ff59818df800c08cce65338f9a7ff6d56d427b118d617f8fbca8fbf2

SHA512
3c018f9600019f0788007947e06db9d37f66a4186aa11eb563096b161fe2adf5dbd64646cfae0649b28fd5cb9064589c43ff7b83229b2b7539ec08b3faee99d2

Download Submit
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.exe

Filesize
213KB

MD5
7d9a87b0166da8e72a160eecf52e5184

SHA1
9f4069e9c7481afe73fc73234130267ea4c572cb

SHA256
d6c879020cfde38b2fcd3bdc3accf1ecfbe2431253523ca3c39d66fcae53e920

SHA512
ab86341a8e5f6ad602013fd85c2dc1fb045482e02be6249fc9808e971e3fbbb310735ceefc044ceb52dced2e1db5aec15006e4317dfed3d110e2906a1794ad43

Download Submit
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.exe

Filesize
207KB

MD5
7907f2f55aa7b722f57c3c3dadf960b8

SHA1
425def7e805e1c349d7be74acbc87339d9eb86e5

SHA256
d2b321202a8b8f8c3e787a71e14a4fa9fab9ce436b5e96e477f6dd08354a27c3

SHA512
242005bcffd3d3420140d74e3bc49c22a761a8d6b6c7edf955cc91b0f34674d9bc391d1c77e1bedffa54f01049644eaaa14c49986926e0f6ed22b9f01ad0aa25

Download Submit
C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.exe

Filesize
782KB

MD5
cf294a1f9ccabf372a0ae4756f9285ed

SHA1
fc55fd77e6eca7711e97f2ce5bfa30cb0477b50c

SHA256
205d4c5c634b22cfa2cfafeada4a982a6ad34ac53761f66566b7480093cbe2e3

SHA512
dad25b1af2da9645636e27c6114fc798b943b0eaa37beef4aed03fb16e6751ec73a7917371c9a191d53bb1fa30222d042d6f17447b115adcf0dcfdad7ca202e1

Download Submit
C:\ProgramData\Microsoft\User Account Pictures\user.bmp.exe

Filesize
789KB

MD5
d23401356407052553939c8ab0644d51

SHA1
b6032a84b204b467e5373d59da35568de1debae2

SHA256
97d2c1ef86acef7894359b36421eb0c2060f3855e4d0dcfef1c39035ccbda3ce

SHA512
90f2cd60027010b5ed5026a2f04f9eba5a52e801af62fd3732d4f931be996a81dcf3105b85198497638d277bf48e74ea43217414a69a5419031cd349637ecc7c

Download Submit
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe

Filesize
820KB

MD5
84f7afe9d6099d50ac947354914a0a11

SHA1
9a721568b59ab53b6e50f8b61cb6ac33e189c2a5

SHA256
045359902fa8200777eabcac4f1c24fc08befc14dcefca9b3c7d87bc72cab090

SHA512
d7d3efb95fa45c125d7add19791def552056bf57b83d7777db2b9e756530804a7d95cfb87a46ce2c7530906ca0ab409cb7f7c79525ee937d9af6646019035e9c

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

Filesize
810KB

MD5
bf7a5be70f1ac82baa5724f1c92bb8ab

SHA1
aa9fdf7f222c419004e2010cf45ada22518cf8b3

SHA256
338265f0d1f8d453aa79f0ed2178acd6579243ead24e6b8e7580e3a38700c086

SHA512
f7f4a0e42b57b41585f31f13f7ad410d76da5a803fbf45f519dbaffa659b66a652b51f8c4e9ba328f5c3f9f32410eb28d8dc61d50f936aae278fc54d4e844128

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
643KB

MD5
4b57361830ce4ae4f038d183720ed51f

SHA1
d2c1a4bd85301e070aebe090a9399f5e308fe018

SHA256
649db46a978a8290abc9f7428344508db753f38e7970078d258bfce082a84e3a

SHA512
642e4fe3ae66c3cc0dbaedb8839783f2fc6592f52e421a74ecaf3e46b40f2b187071103bdef7bd00d386075f83d309a76f657e3cf0f5a14f68083cb871688cc6

Download Submit
C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe

Filesize
809KB

MD5
f403cd4b136651ef64a4b48349d1b547

SHA1
442d1deaa6cfcee8736445070786550d91f068d1

SHA256
72413ceab426ca9ae81f06ce6c01634d5e74e2f666aebcb2998682961ad7ec65

SHA512
1a4ba5898061da87023cb37f40e984fa7871a51197c83dedcd48f85f39751f8ea21d4c3606701b8cd80d89d4446b94af1ca6d3d4ff61a6ef820a702d0753ce92

Download Submit
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe

Filesize
635KB

MD5
7f9515ce2f4b7ab54cb55de0eaf2098b

SHA1
bf37f9fb6103de9058bd5e47500c0a52f0ea2332

SHA256
228fbad5bc2c54bf67774186e425b18d5ebd8d5c708dd92b7e475cfbe8c04ec2

SHA512
efb5ddafc32508d83ba87f803bdabe50f07287e7699eb4335bef0c2c86d91e6b2298b0c49b9972b8aea63b62d5719fc79bf327b44c735e4ca64ac921234be12f

Download Submit
C:\ProgramData\PcwYAUcg\HIkckYYg.exe

Filesize
200KB

MD5
f078f7d7ab7bc1d94b70a09f03a23371

SHA1
3bd0c7cd1bf6132d66b9f180747c03dd121d2622

SHA256
9a08cd159e41ea1b68f38a7b6ed0786e7a0575473133194d309723547d17f5a7

SHA512
b295710ad8dbf82c6465220932afcfce4804359ba1ae5fadbe3a58d08c9c6a4c5577822a050dddc04f4e90619a7ab5b7c1152d7474bea8d610884bb864da9c0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.82.1_0\128.png.exe

Filesize
205KB

MD5
cfbfab8ffa510eda1d97fd4a8ef3de46

SHA1
4c49c49a7c1dfbbd5253770d8599f2b06f835710

SHA256
e69b21e4d508173629b64726b32278c8d7412c39aa901b35cb96655ed5786024

SHA512
5c8498d274a43b499fafd00bdff04f69e07141c8a2b7c5987bdb4772160a17decbd8d044606d4b1f85e887de1ce9384a9233c75e39e3809106c1f2fd3f180663

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png.exe

Filesize
202KB

MD5
15cde99063885ba388217047ee2a9e6d

SHA1
967a054d91bab081736f9639a2ebc7de2e95b600

SHA256
3f7c30f6aaf515b48c0b2ac696a45b7177bf28f22fd92f9accf2924cf3a2c130

SHA512
80159343999370f38a769f50b97c5a249821cdef8efa847133e2b6fc318f4dc304e417082eb5a1c1c045a0931a7c75ba3cd8aed259704eab4da1d4c86ea431c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png.exe

Filesize
192KB

MD5
f94b4e3c5607b074d336d398f607a9d1

SHA1
74f4ce958365eb719bf12019005f57b04d46507e

SHA256
4ab6e3bd4324fea301cd4534db62356dcc69f2e8286ce8f8dbcdb64da492752e

SHA512
e01fa070f6f45bf98351f7a4b5baa1e84ca0e210f18b99a029fd4e0cb94fe5ab04998848230fd599ecc093f2e969faeb62517a3e6629440c164045654b58ee35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png.exe

Filesize
196KB

MD5
abb43aa4241cb5a0cc41a023420ee192

SHA1
ba0ed95da414e7952899bed9c681f24dccad2284

SHA256
742631675c623aa686c6da92dff3471f236748292db7b56744cb7003150e9f96

SHA512
8914b3aec1383c1569b581e8113513e1bffcd459ddd9fc2bcf62323879177bcbc6693036818ed9312b0d265549daeb99b34a3c231bced49b224b0d216f218f72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png.exe

Filesize
194KB

MD5
db05378792a580ee35d4bd9ef0e90d8b

SHA1
7d253a7fbc7c3c2c5d3b9d09a1cd9ad73b125073

SHA256
ef7ffaaa54df53c9e5ee1e3a0f35919d14ebd085537d095c5c85ec87ebf81247

SHA512
d490f70751afcbb033877143a7452f4e714103174a18602b1c7e5eac927ac6829135cb7431b57f7c176e2fde07f9185b68a566bda135c9c85116d30e96327123

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png.exe

Filesize
180KB

MD5
0e59185ec9b1673ff74102a154fa28c8

SHA1
094d79fbf46bd4da4fa2dc83c0d25d26398ed44d

SHA256
62d7fb918dd012a69f746280aadd666f01b1147c1d009c4b720686c755d83eb6

SHA512
345273455165ec290ca2480431e059aa137d2d8579a59068954d7e49bce2bd85e6e6fe1696a6c09b8ec4df6d4c9ebadf6aed8bb9e6a7ecd60f73efcb92742f53

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png.exe

Filesize
197KB

MD5
60fdca25a60f2b2a57a46ad7684a2b02

SHA1
5e2be0e26110af82265c8765a70c15a4856002eb

SHA256
f4e5dc95dc416dfb3e3386984259a20020c0b3b7d3b5ecd1ffeaeec8f8c2a059

SHA512
bb87baf99e44837bd4b6019cd9c9b2058ae7b726a75c32c8befaf5e3fa140ae66c7876af0de691135fb73780bcf284467529e479bf3ca7e6e84509de8184a1d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png.exe

Filesize
189KB

MD5
e91408f26a8843dc4ed96e3f5c95ea92

SHA1
b649627cc1d009d4aa823233d0625caa74ed7b26

SHA256
ed3febc80f5fc2149aeab78dc9b838338634f880975a5363a07957a34e99317a

SHA512
697a995dcbcfbc6f959edbdd7b7ec97c779583e5d7882b2cc6a7bbe05e2ea9cbb8fe2929a04c71c13e8fd412118794047e449776f4423e6dd1e57940d70c72d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f72a0fe4e842eb31a7d7d3eb15d0cff5

SHA1
373f7f5844152d56c0a0417018662e3953458450

SHA256
3d2cdc2d77046040955d4a80490fbb696d0ab3807c9a4207c93b51055c818d81

SHA512
33b9477b8e2d76d6c1079a2c3eca81ba782618673455054657e69ae786ef84769c10c30538cb4dc8a3c7264ce94a32066b53a2e1b811748c2c4b87f9a0ccd9cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
ed5f4213c17629776cd75510648fc019

SHA1
ebfa685dca9b7c920cd5ad521c03e4ad0ce435b9

SHA256
e969795f0e63ec8a35cdf34d5bc43867ca0825bebfed9734943e69b34ed2ad87

SHA512
71bcc166ae5a48f7a79aa5de7ecc7e10dce22c39240ca9ffe9d0f9340f40fc2a2429529cfee8b2b5d7082efe94921fa7df3454852d5313ff4093bfdffc189627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b4497d2f28d63929f76ca597b06112b0

SHA1
4d308d02bfacd855fa9ea521ab3eb0e1d9c4245d

SHA256
e598c4abac85ad3893cadc554d444111f1f78be012434e20e3caf9b2b9748064

SHA512
972cace5f6673a290ade2ca10fd699f52a1e1a3d859f7127d30e8885934441e3e3bdde3ee60f1a4e8b5ac46e9a577bfe3544001fde5994be992647e3dd0b3539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8e4603e4c54d1e51e656d0fab0868ae5

SHA1
258a97d0fbd9d2252ebe4572a1c9e54d20d74a09

SHA256
cb8a58229e5df3240200f46359993a967ebe8626e1475a2fc06e1e4f1119ae2c

SHA512
9b287c408d4ac4ef4c3ec610182f5b2c6fed1144957dde2dd46ec6e47a697bda06f804a6426ed9900ddeb4d921cbb9e5ce3f6c13b142fc4a803326cb45919d46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bf954b5730d21e1c8a9a75f5821aed11

SHA1
5576f7c4f7311fc716c6227db11dbce474111ff3

SHA256
983598b596f9efe2190c4cf55b5c11cf9474af9530fc0f519b9d358224af7a9d

SHA512
d32a3c12350683e5078620b8253aecd4997bce51439e08fa2b4cd07d7e4c2f07c277ed220641a206a2cfd2cc4169387d7902e6e7cdad5eb49c41472f10ab2ffa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
82545685735d729bb98f2c5d235eea6b

SHA1
cff2f8b9d3772f07d4e78443dd3942099749402f

SHA256
a16a444bc268a9876c6efe6bdafd590f6c55b60caed3b5ded454e0aa00463c7a

SHA512
23e6d61f96ee8063ac21ddbeaa459f52a5bf39ac783c38156693e78695dfa730dd0f86e600831acad590615091f58380b1b7ecc30e121ddc215f28da4d34231e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b7b2a80d0793d95b8ca4946b87950c2d

SHA1
e624bace6948438eb09475946847be826b977479

SHA256
ec52bba25374aea79ac3646f7c024b461b74179f30d3086617903bbff0a5ed93

SHA512
665f8820c4ee815ceb71ead9005d64112c2d3eb8f14f5fdfe3a337837c1779c64a170d885c62d61fc41f289be504ada07523553c003b9a71adb66361b0be7a26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3be97d5aef1a81e5647a1aaa5c0d8004

SHA1
5b288e563117bed03650c8676e1c66fc525ee8d2

SHA256
76fa9218f4ea4b31cfd9dbc70410d4844e2871c7325db4c704ea87b034ed8b58

SHA512
d303d036ee811dc461149203b906ed13e06bc67945eb4c585b6abc5f94b009e9898f66dcb0783118901c48d719df3ff8e8ff50220b6ca2e10415c2b0824c51ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
157bc78eea6fd518c87869de59d6ead1

SHA1
8ac415139aeb73fb91ad61bcd9430185e2c9e8ea

SHA256
31bd287eed00aa1a7a1dd583b8916d25ecdfc1791875ffc0aef631cda2c3b7c5

SHA512
70e185581473e1d1ebd2d43ed71fd8e28abeb656b8ae6418d84c18d6ad654b1f729dea8bb50f4eff1295b6669ffc0a638586bf3feff568b8ae26f11fde11b528

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bf2a6ab8e3ea1201c7d8a6f1b99fc4d9

SHA1
a792a3423e121e3c98ff2067a1961212da1361c6

SHA256
bc443492ed419541a815a1461a58e3303de8d61a1b104dcc1e150de1daed288a

SHA512
28817c8a62c8ee05a9e2c9ff5ee0d213d5c41fe6c51fabf931a5fe2c0a3ea01bd273268d09a220a4ddbd67e2f43da550e9ed6cf131760406aeafd25c512d45fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3d7fe78278f2b04307f38c719f418f30

SHA1
d44ac8050e072d59fbdc552c3a3ecb9f13eb9dcd

SHA256
d5316fa2b41cb137889ecfdeaef5dfbff1eaa93b11dc60ddf02490277aa8041b

SHA512
16ad3ecc2f6ae4e2fb878a184d73ec7e899992e33c813ceec42aab9233302ebd38caa9ed153fdb1185b84767acfe4f8a6d5b68126b42dd6e52b92191ecfbc319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9a952be4751c6a0be28ee17853df90e7

SHA1
d89118d9f89c2658d9eff16e15ed5a6fb857b984

SHA256
22fed9c3763055ff0261592bbe55785e858bd8c219f23be62d4b936ffc2018a5

SHA512
bf942f983e98177c64497819545e616e837fa8f8a394a9d610412ac105c658661d28c5c87e1cc95cf2f4d2397f3594644a2fa0199eb1a88168f2068057550dc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b4c677a12b2e4e71aa0fecf60e81d95a

SHA1
84180ad768a59fe0c24313b19e9429ca266f23ac

SHA256
b64553f284819a488f6e7ad15cbb6f1d91b2caf26e1c8db996c914ee11cfd27a

SHA512
f3bf7033ff5cffda808f3afa5a5e55aad336fe8d1b38b5fc6d8918c5748d9f1882452b83d2c3e438ff23ebe91b01952a7da00847e906c84bafd0e305c17de817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8196f1db4d229deb346d948938cae696

SHA1
90cefa533875ede1ac8bb4f6756edf69f58eeb82

SHA256
5bfe7e54ea63110303a9332cd9b42b98aef0de28704f01a7b368ea5bb9c344df

SHA512
49c9f674b0488ef71cdbcc31818b1f7b10b59bf4719de4ca591d149a407c7fc33dfe8e864a8546976f86909e33e2cceb43f38b9c690a7ff3e226574575f3a22c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1b07285c534a5406bc3281c8ea5884c8

SHA1
d33d1313490e27f99bc1a6864fc1043ba290fb6e

SHA256
5aa3aeac8964f6db25a9cdfe9623866dc06fe3fafef6da72b87d86ecb5a7e57c

SHA512
4fab4e9c8a01c3bd414571d2975918b19126abd38392f9ab71edf4a228f6e03806a7d09fa211d7f1a3a25f59051f862778f4bc47402e17e80841b9a4067314ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f935.TMP

Filesize
1KB

MD5
96fe9c857061d9060942fa9473698f68

SHA1
743c8762139e6c2a2b391437ed83e6a6ee7e3ba7

SHA256
d0736a1c86213598ff1ae6f51efe012244a99cd416c015bc475874d44857b271

SHA512
51ade5d59d46fce27aa1be4f2d36dad69a8e34a2655d46553a1d1290bbd6de4c82e492735441adb97a5aedc5e4942f1cfc994dc6551dc2756b6478fc291c8450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
645b1d74fdbfd9700bf16d9db91dbfa2

SHA1
6b8de81915fcd0e9bba66adce6dc26fe1dc72512

SHA256
195b723633d63cd970db96aec8b2a77c8dc33f55e6d9079100616efa9cca6a55

SHA512
a03e0519b9843daacb11d9fb865190677a979e0f52b55a7be0668d680e2d83d7a13f568dc8fef020269344ff720a622c493a3f3afbe305e8d49656a6303092f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6f6159288569cc933857edb4fe743686

SHA1
b8da6c6d9635b30ae9f12583406f5efad795fe66

SHA256
f263e16417aeb5f251408d3d57e32c896bccc4fea83be2e84b672b9252896af6

SHA512
7d4bda50bbf7f034ba3b2b922f335a609b109dc58662b9ec693e73136056981129059c64c9a567724ab2b2661e413050bab47acde4d971e6841f1e725f8b6a26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
90f78b1de86e2979bf2b7f11b73e9a06

SHA1
63a769602e5f0873412bc0650270c1bd1a73edfe

SHA256
f622ee1b6d86d3e79d648e238d58e6f844f65d2e0946f90cb2b95e80666a3ffe

SHA512
4344f72bdab1a60fdec6a47d62c40d71845b3ce02d544a77d5d4c429c619266b1175357c8045b7dee3b3f7ef81e0368d21d9b59b1b1f3dbec90b491eeaaa37c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7f41e431248fc2f428b36893d81a55ce

SHA1
c787aabd52e03d05357b79b263e005f8a5bc00f2

SHA256
922e0cb49de7ce5505cf13981fefa1209b6c161ef6ac51f2b8ca6d554ce352a1

SHA512
ceec946817e975ab1140c31af55c23ced220d352e807a5611cafef65a7fb5458d1bfef626177ed069529e4f79944722a4452601a89866cecb820563aee9b73f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1176b465f9f734ae8ebfce219ea9287e

SHA1
35314af3cdd599822797a6b2cbad7da2669868a6

SHA256
d350778012ff27757f729032feaf98e40b7e10912e9730008f1bf8bbff56397a

SHA512
126086983403b9efeb63e4e39c88724a168024b3198d39fb615a65910c064b94ae5755f2c6b1d7cd2a86ffcb376cef18cce43e8519a0d132888c81e9adabd4a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.gif.exe

Filesize
571KB

MD5
8a4decaa3ff8a3ef9bfb60ea5dcd69bc

SHA1
f903cac7adc1d036e6d964f0e937fbeebffd2941

SHA256
8dcc10038c832c0902256126f514d53649bb353f9606c07e95dfecfd266d2149

SHA512
49fbb3a32d67cd4f96bc0d9aab759227f1a00052c88f870d4f056f5f0197a47bca2a832ba4482f1508e76f1e2f919c4fe59a76fad2bd53b64f3fa73f9d195ef1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png.exe

Filesize
204KB

MD5
460bcca19974a73cb08f8ad89df0e5ff

SHA1
55a8e31b394bd40678e3f0d95d90ac708dea2878

SHA256
8c5265d4fc2bf8d0e82784ea93165e94e5a0f923e63fe9ffcf5168d425eb8af9

SHA512
667df6397c05a12c5357411615683c3119e019b7cf54996ec7f5e26bf2c5e3958798e83b6ba9a325a6872cbb2e3d24877e38712ac4002e90702d06122b320ff5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png.exe

Filesize
199KB

MD5
e304790527c0a1880f03325be8806055

SHA1
dd3b51ffd15cb3e51cabc760f09fa8257a0b28a7

SHA256
b3e31cf2920cc11c69b4464ee4b7ba1c2673c2b7588b98c76fecd058d2928833

SHA512
d3d703174777de1d8fd39fd06d77fcf946681942f59a7b2e5d3a9301643a5ec80e837953653ee8d85b539dd85860862635a4d282e79f0e33e38743c56c56a11b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ScreenshotOptIn.gif.exe

Filesize
438KB

MD5
9e13f3dc1a2ca117464b80c301dc6f22

SHA1
fce03577dbfd07f3f5fb925924b8fec4acad7de7

SHA256
d727f8641d46d55b14d0bbb5cdc7c0c8eb07fe3e5e96b458577711a9c28c9547

SHA512
53f69b8b6bc1c6258787b52a9937a9ea62ed87ba82c9aa4a4f441b61f7953416de3bb8344ef7f856d25c43c8253ebe7ba4e8cf6a1c161b69b617c96da06d69b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png.exe

Filesize
183KB

MD5
f18e25711259d84cda463749b4e40b2d

SHA1
8af18fbe0ad1d7286713b3798cc9c7e12828e4ed

SHA256
cb724f0cfeb5fc10bb205f3349eccde2365f3a87adf33b06386af6e4274a26a7

SHA512
0912c472ed05655e399a4d1be28c4850882663cd9c4a7d2f98ec07cac7a2d7c2bdd1419030a88d599170117f4b313a8e0d5ca769fff5a1dca1bddfb604693e83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png.exe

Filesize
184KB

MD5
21a4c575d7ea6ed684d0a6c160e55044

SHA1
fe5cfe10c5d4972afe1ff06a6868a8ec7b1f5a51

SHA256
d3ac302a65e1d6560bf9073ac1e1e33628737dc8f561bf64e7d1cc54cc1cca7c

SHA512
af421db622eadcc8d91f825174d0ee8203804af0679412c436cbc258a08d413c89c22b860b3883620440e43d61fd525d500e76d0864c151a1ad87c8da30bcde8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png.exe

Filesize
192KB

MD5
369448f71c9fa4dcb3ff5f0817c198fb

SHA1
cda6e6c6cb4e1fdeb6ecbd45267c5cf393de9081

SHA256
d090321cc91642815d9f827f684573869c91bdb663c8fef331cd236ae103ae89

SHA512
5bc4f5de01621aba30d0d2501f3738773979db6374cb7023298f658d33fce258fd7af229c8d2d81b47744d1f61447ad7a57660b7d2de0031dd8557ee37d88576

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png.exe

Filesize
182KB

MD5
6640606b3947ae271e9e5fb015039e20

SHA1
3a525b0d94b8af9ad85eaa0ef9c595c14f06b80f

SHA256
d9332362479285e7b5d5ae1036d8483875c5838b0db690c86fbdea9e62696e1a

SHA512
a3d0a70d7daa458108644e145f8360c355c3ca72e5a2e13e0b0b8ec742c4479d819259a4bada5dc9822c59b7831b89c0cdfcb71306c5d5ecc31786679d240ac7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png.exe

Filesize
192KB

MD5
06fa4464d91e014219c1d9c7794e653e

SHA1
1053d18547db037f2269c5dc835106fc353dada6

SHA256
4a845d353bdf7ba898a57d666558b58048d1ac2c8f0e03c17998d22d6f804781

SHA512
46f8f780e99f3d532a42e4fe49c799724775f15113851c3195434b98151b7f5e0bfda88c414b873b5eb81659be4b0c304c763c9ce7cbeaf9f2be7aea7fa14c3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\EF5C.tmp

Filesize
55KB

MD5
7e37ab34ecdcc3e77e24522ddfd4852d

SHA1
38e2855e11e353cedf9a8a4f2f2747f1c5c07fcf

SHA256
02ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f

SHA512
1b037a2aa8bf951d2ffe2f724aa0b2fbb39c2173215806ba0327bda7b096301d887f9bb7db46f9e04584b16aa6b1aaeaf67f0ecf5f20eb02ceac27c8753ca587

Download Submit
C:\Users\Admin\AppData\Local\Temp\UIwoIoMU.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\DYcEkQcs\pcgcUMEk.exe

Filesize
199KB

MD5
4ca8e545b2f19c2a10e7307af94fb9b0

SHA1
c01badafd61d1192e04271b3a45b3c9540aa37df

SHA256
20a266f34edd248488af34032d5aa05234106127b1fbb4c642d42d0997835916

SHA512
d51a1ca998c0cdeecc5ab14362ce265a477facd14bafe0fa2c880c3c49bfad779c5d96cc68ab303125171907e58161779f68503bc2eec0fcf4a8819884385f77

Download Submit
C:\Users\Admin\Downloads\1d4322dbad293847de14eca09bee5056eaede7ce178490e101642bf1f5875e37.zip

Filesize
19KB

MD5
df4e3d17b109e81cff23d215ad8366dd

SHA1
d4990ed8c663dc3fa778e12595724c1ad7c04a6d

SHA256
58038ba64962ce0ba94e0e0c4dc0356e607d5a1a6aaa64662eb6731cb7e87ba5

SHA512
082c75b1b1311e0fac66b43286f13fa180209060f2c1df01f6d50dde7bcb786959d27b1456b95d59be43c344806e02f501bf132d8084c17e676908366a8d3025

Download Submit
C:\Users\Admin\Downloads\Asgk.exe

Filesize
239KB

MD5
a382701e315887e752e99b7af435dcb6

SHA1
7dde64af6e42eb9c6b555d5bc350647e42e1be78

SHA256
0e6434edc7ad3c4e3024630bc53c0ab32057aa1c27e5d4642f0cf9da59a4f3b4

SHA512
cb87af1d66bbb1daccd85b0b5f312e2651ca031177e27b7d2f621183b78cb821a1ef460c14a5d1888b047b9eb202aa59d3fa4d21d15c16e76d9b2149f8136eca

Download Submit
C:\Users\Admin\Downloads\EooK.exe

Filesize
326KB

MD5
61bd34f76415f1b88721c16dc7913ea3

SHA1
17bcdee50bfb290dbeb57100c8b5727ffb03b34d

SHA256
c678eabc8d753be84e0dacef85c2beeb1339588e35dbe1e7db8d7ef975b4492f

SHA512
56b5097ab4795304ec507396d7087ebdd26af9ab64a676dccf1120f0c741b04c7ee81fb026b099bd913801471a5b16c9da67f5442e8a68f771fd5f2b7f54e9af

Download Submit
C:\Users\Admin\Downloads\GMUc.exe

Filesize
808KB

MD5
36013ef6b63283259ac9dbca9278d181

SHA1
36388e46b7c06f77a72ba5c0c3bb9addf46b096b

SHA256
36daf22e1099a562a59159867a3cd499d7e21ceb08c95802dc2509f303b7a210

SHA512
2148f95e5871129ea8c4ef86f86352001a42b6da2de6cbc2c7ad47d81c4c1136d86fa32bbb82783a3f90b298b5dd7d432e84a8282fb4ce6803a10b4ea9361675

Download Submit
C:\Users\Admin\Downloads\GQoA.exe

Filesize
187KB

MD5
01d6a41410fec9b91dc40939cbd943c9

SHA1
8311d3c8a469d222a5f676cf2285042aa3a348f0

SHA256
e6fce9fe51f6bd95f1a391dda3b4cc56dcef7547cbc7e9825b93f6ecf770ebea

SHA512
e6d08750ba1862227badc733ef6ccae80e76343c43de30f0992a29e3a65cb92a71dc3c9f5d14b6985a01bd41afe2aea6a7c1c46b182b17bda8b19bae4ba75f2f

Download Submit
C:\Users\Admin\Downloads\Ggsk.exe

Filesize
195KB

MD5
12be6a8620f4efabc2143d632ae46aaa

SHA1
145283d8a64857648029cee454fc9e89d5897321

SHA256
1ba2f221af37bc3d72efeec38de986e9122f392b8e1d8e6fa78d9fbf58893d12

SHA512
89a5fb0c5a2481de853f1315e3280f6a221acec9629e57ed7a865c35ea2da2a4f318a02079b4bc7668d8e728d687a3f4e5fb9d2af0199a3a5d632fc3c1de43df

Download Submit
C:\Users\Admin\Downloads\GkkA.exe

Filesize
466KB

MD5
84c49c6f4cfd804a05150978a5c72728

SHA1
b6526d1d1b3670ddf4d8ff9cd0f31cfd0ee856fd

SHA256
6c57e6e01c593ac1109c6de413b262175587ba8818ee9302329f711613d13f84

SHA512
ead055320ef0a13b08546436281da448f52c71a407a15602cc06fe2a37bbfd7b795f91b6317ef562d9ac4cbb94d9763f3e1aff1503c385b976ce6018b72836fb

Download Submit
C:\Users\Admin\Downloads\IAEy.exe

Filesize
323KB

MD5
9e48ad712102d771a8ec1e59314ebbe2

SHA1
4ce8aed25d2ca3a6cc563076b6d4260c8eec225b

SHA256
dfafb35276db08f9bd4e90112a48c32e1f93b59dbaf98a1739669da605eee63a

SHA512
2f90f0198e1f8508e615a5ac0fb73c94855068025a72017837f8a93a59927c33d2d4ec50be82b8b1c3c4909ab89a2dbb33989bc06042435b1da56d1176ab0527

Download Submit
C:\Users\Admin\Downloads\IIEG.exe

Filesize
626KB

MD5
3b4624cc36b1b5c6e7c19ef76a87dd56

SHA1
2baac46df86bf60464e135fe737d2e8d1f1a3e6e

SHA256
5b8cf178d1c1827786f22b8c31de0004da03764af2db9666fcebe40ca2f34a2a

SHA512
3c6e7a4400463317037be8a9513da6e5ef802d1343f62677cfbfc02fd35a611cbb0efa873133bd5291a3398c22fa7ec00cdc88144cecebe151a841a722d23e05

Download Submit
C:\Users\Admin\Downloads\IMgc.exe

Filesize
429KB

MD5
30bb5e49df9fd4d7f149aa438fad7024

SHA1
7faf25c4e1cfd20fff39a21d3c99805a9ef2b61d

SHA256
e5e4f3db367aea7e3fc412f878b04d99966cd42c1c9424780ce2928a44563508

SHA512
921386d7a32a43a352a6835b7517d59873bdf3b278f4e5e69e7219fb18567a5cea098a417d302cbee5088c626e940ca13cb7cee57fb137b88301a717013bc862

Download Submit
C:\Users\Admin\Downloads\KQoc.exe

Filesize
315KB

MD5
b47838cf710195f93f8a8a9a822f5943

SHA1
81b92ff6719329842dd026cff2aacec68b76b76d

SHA256
3ac4b930cc0c91fc719b634ec8c2c34bc2795168f9e4dde45547ff9853a76201

SHA512
1234e641c440eaa98c126e366131053cff69c1ca34352a617b58528ba9f5b22e0e19c537fbe92dd5936ba0f70cf1946b32514e1c604ea6258eec16d119d3b0f3

Download Submit
C:\Users\Admin\Downloads\KUMQ.exe

Filesize
196KB

MD5
7efea04599fe2f2e9ce3f9592a535d4b

SHA1
7a441f83b732bca5d8d69bc7a54c09d29010ab91

SHA256
96c950fc1e75d6c399776269ba093ff2d6a475c10ae170a5735b11cc6df09f9f

SHA512
2d994b4ef02e89088952000fd8317e618038a394fe79a88ff9692a619e8b1d0629be6fafe3a4d42b4e64c897a8297458a21602cdde949ef062256500ca69e79b

Download Submit
C:\Users\Admin\Downloads\KYEC.exe

Filesize
199KB

MD5
63b0522b71f03838a985ad66bfbb866e

SHA1
eb96c552e77023fc8f5c810d40e32943f2e27306

SHA256
fc6cf322612d6c41e26c7c890abcfc2951ce3dceaa24a349341cf9b09b33fd56

SHA512
977e6fd8b8705299480c9551502e49b5cd9874c5151a82262c2a3716a1e390600bf7332037cbb528b2cbddc6181e129ea776c855b9cb27451c548f30ace71ba6

Download Submit
C:\Users\Admin\Downloads\KoYc.exe

Filesize
241KB

MD5
39fdb9290f6552e20ee57a7220d67073

SHA1
6a6b1e8c17a166b19e450507bb620f8270074bf6

SHA256
291c7efb30cbe52775cd88da8f2fd014aae7f3fb9d6902b815d469a9ca10a1eb

SHA512
f89c093850c418af636d9eab312cdf5d752a34dc156379913ef937281b1ee74d115714e62e98953e36a04497cd57459ad876b8991998df9ea3fa81c233ee774e

Download Submit
C:\Users\Admin\Downloads\MAMw.exe

Filesize
214KB

MD5
dfc59d6634f3146f7a1c33269426065e

SHA1
60365d60a9778a4b855d3dcaf322cc905951718c

SHA256
5b779d473dd1440ccb315051902a05fac2d1b5f4340a00625cd252f0bd6550bf

SHA512
77c0097754a23e1e56749be95207a63cc3e585bcad116436ee399d076254d63f30f9902f9b09e0e4cd74d9339f29dc90b9cceb4e196e6eb0675decbbac5d9600

Download Submit
C:\Users\Admin\Downloads\MEwG.exe

Filesize
195KB

MD5
0e690bf76d7bbc1674e07718c03d8081

SHA1
0a7518f34f558c8b0334b4ffe91bce4672c84898

SHA256
c47bfdc268fc6c1d25146b9c39f9a4d0558cd2cbf7994b9ad347e3b6f2f1c596

SHA512
731d92453d92764bb3d417143b6569e74f4d0a249859de4b435ed0e5a8921f032929fdf4fd8899c248cd75690ac3ae506a1bba4fecc54d7780424ec545c8f83c

Download Submit
C:\Users\Admin\Downloads\MQAo.exe

Filesize
206KB

MD5
20bea579205a96a315c52ce11ff12b4f

SHA1
f6d37b0c9569269d7292991ed82ff8ef2e9807de

SHA256
51cf8a59306b677047b002a95f47648ef53d529d7f537e7dde1037fb41b777dd

SHA512
42ff32d87659cc6283d0040d394ad6acbbef4ebe403a18599e7cb6a2293b8e87527e5d64c4e258aeb3991935ae0beb8487168ca0486f0d5f84707b5ccdf78918

Download Submit
C:\Users\Admin\Downloads\MQcI.exe

Filesize
211KB

MD5
cc6b9d4d0a88f17f80e922ba3b1272ff

SHA1
ddb50a3ddb852afc05ea325d727b1ea3746f7216

SHA256
abf580d6bfb47b088e03bf756d402b83d403ed096a88fcff0f365d7a2fd6335f

SHA512
55f0291b14c43c51800ed03be0a8a091543aa2f9baf13459646b479b4111dc649b32565d70b4f11ff3bbbcd1b4437792bf7241d2ddc454a2dc969ef9fdbe3417

Download Submit
C:\Users\Admin\Downloads\MoEG.exe

Filesize
207KB

MD5
e20613dcf5020d837ce81b0a80ef3b23

SHA1
5c31779e65aa1ab7cf605cb483ea706fcc7c5331

SHA256
a667e8bb271109092334cf12b801466032e406822d641819ef23d31be97e4456

SHA512
269365fd482eac333e0ab53b26f183faad18c939f95a07995e4b53fa753903a35315d05d9be1b43928f4a3f4c76c7cec0e9b6946068a7b5a03a6ff92b1e0dcbf

Download Submit
C:\Users\Admin\Downloads\MwYe.exe

Filesize
372KB

MD5
19428de335a71aa892c1376558e2c5c2

SHA1
f067156ee6786c6594c637b7fae42deb74112d33

SHA256
7dc61ba62effca86edef3eb4a5b13317ddb03656d750d8719db7b69cd387d0c7

SHA512
c3483fbf50f5da68998565dc05838c1ab8ffe4d4d72fb4283e5b20851d8b2cdf6d978e5a515b049ddb524071338f8ffd0c6f6e817039d464fad7e8ad9aa1193a

Download Submit
C:\Users\Admin\Downloads\NotPetya.exe

Filesize
587KB

MD5
e228362766e16af9b309eccbdb70003b

SHA1
c809c9f4c83b78eba4979052231b1111e027bc02

SHA256
4baad6a71cc54600a11ac09917ef0cbb8c3681e42975e5e4de8fe022805eb589

SHA512
d13d83aa2de3827f3c170a1b2f0bfeb145993de78c3cf36f61bdc2bda62a758f132a998cef818959b9736f2798fd55ea6a6c327ba93ec0a2091c590e6bf3d77e

Download Submit
C:\Users\Admin\Downloads\OYQM.exe

Filesize
190KB

MD5
c2449ee243587332ce334a6a14e9efa6

SHA1
ab7d2674856ef8228a9c50a040403ccb287dfb6a

SHA256
dca93d6573a06131bbc3e33270a6d6ce305091ebd420445a4631577ea1275f17

SHA512
fec0e93503d67498b96e60efe433e5ed4f5f8c6c692bd2dccfd1dd20b26bdb7befffcb3600ceff845af388e2f9b26a2731b55474e75034fafce8d8535a66c7f6

Download Submit
C:\Users\Admin\Downloads\Okky.ico

Filesize
4KB

MD5
f31b7f660ecbc5e170657187cedd7942

SHA1
42f5efe966968c2b1f92fadd7c85863956014fb4

SHA256
684e75b6fdb9a7203e03c630a66a3710ace32aa78581311ba38e3f26737feae6

SHA512
62787378cea556d2f13cd567ae8407a596139943af4405e8def302d62f64e19edb258dce44429162ac78b7cfc2260915c93ff6b114b0f910d8d64bf61bdd0462

Download Submit
C:\Users\Admin\Downloads\OoQu.exe

Filesize
193KB

MD5
820bf880a193c74ca03ea388eda537b5

SHA1
051fd3f19b979ddfa11900aff42907dc707d3fba

SHA256
fa1b880d5725c0eb1b1040463eb470c1c20c900bd1b5ee19d59ba6589b6d3ce9

SHA512
c3c082dfb6a1d29af83280262aab0e5e7991b7cb9d35dbc39c1b590f61e65ec8cf1fe4437ecb68df37aff4a24f695ac4f19088aaa752da506e99eaefc2483dfa

Download Submit
C:\Users\Admin\Downloads\OwUS.exe

Filesize
209KB

MD5
d4ad31381ab7798ffea49b7be92fe343

SHA1
c45b406185977154c4954a8eaba92219af6c43cc

SHA256
d64f3766add09b5dcf89f3a77fe2f24c5d726ab7cdd71b7ab11a997f17a84134

SHA512
371066046bf1d9fe55cf23798516d15dd1f62232839a166422bbfa34a45608fad241aaebef364a1a933f7f389d428f793efb20fd315945d58692899ead3efbcd

Download Submit
C:\Users\Admin\Downloads\PolyRansom

Filesize
25KB

MD5
2fc0e096bf2f094cca883de93802abb6

SHA1
a4b51b3b4c645a8c082440a6abbc641c5d4ec986

SHA256
14695f6259685d72bf20db399b419153031fa35277727ab9b2259bf44a8f8ae3

SHA512
7418892efe2f3c2ff245c0b84708922a9374324116a525fa16f7c4bca03b267db123ad7757acf8e0ba15d4ea623908d6a14424088a542125c7a6394970dd8978

Download Submit
C:\Users\Admin\Downloads\QIcA.exe

Filesize
218KB

MD5
735fc95a631afe6a510ffbccadd07ed6

SHA1
615360ed105a7c27896019362a1bc6ff46dbf2ab

SHA256
efaeebbecca08f7e645be1bfa626d362e827880a36af7c9e0e0d7f8fa5512352

SHA512
d2cbd664921c083b04a8ef41cc0a5229487eee01d32ea08a8fbe11ea511f1e18f1024179bd5bcd7ad77fe72ef9847834182e9f5b298a63dd4c099f7deb8f5835

Download Submit
C:\Users\Admin\Downloads\UYUu.exe

Filesize
233KB

MD5
d1f62ab1f4d55d400c2b1a738a1f5249

SHA1
cf41879e887fc695f65547ea494eed522526dce3

SHA256
d0a1af4b8cbabd9a4971966b4bc9b238688104af9814ec0e3ae1670da72aa075

SHA512
4fb5e080328fafa24d2d01d00dd94aae56b09b19965c9c953f05f522cdb8a90e09b45cc17108c67d0c8476f9e84cb47484ca44932e1a6ea5a192972e4fafcdce

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 337206.crdownload

Filesize
220KB

MD5
3ed3fb296a477156bc51aba43d825fc0

SHA1
9caa5c658b1a88fee149893d3a00b34a8bb8a1a6

SHA256
1898f2cae1e3824cb0f7fd5368171a33aba179e63501e480b4da9ea05ebf0423

SHA512
dc3d6e409cee4d54f48d1a25912243d07e2f800578c8e0e348ce515a047ecf5fa3089b46284e0956bbced345957a000eecdc082e6f3060971759d70a14c1c97e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 486891.crdownload

Filesize
1.4MB

MD5
63210f8f1dde6c40a7f3643ccf0ff313

SHA1
57edd72391d710d71bead504d44389d0462ccec9

SHA256
2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f

SHA512
87a89e8ab85be150a783a9f8d41797cfa12f86fdccb48f2180c0498bfd2b1040b730dee4665fe2c83b98d436453680226051b7f1532e1c0e0cda0cf702e80a11

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 540405.crdownload

Filesize
53KB

MD5
87ccd6f4ec0e6b706d65550f90b0e3c7

SHA1
213e6624bff6064c016b9cdc15d5365823c01f5f

SHA256
e79f164ccc75a5d5c032b4c5a96d6ad7604faffb28afe77bc29b9173fa3543e4

SHA512
a72403d462e2e2e181dbdabfcc02889f001387943571391befed491aaecba830b0869bdd4d82bca137bd4061bbbfb692871b1b4622c4a7d9f16792c60999c990

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 672175.crdownload

Filesize
390KB

MD5
5b7e6e352bacc93f7b80bc968b6ea493

SHA1
e686139d5ed8528117ba6ca68fe415e4fb02f2be

SHA256
63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a

SHA512
9d24af0cb00fb8a5e61e9d19cd603b5541a22ae6229c2acf498447e0e7d4145fee25c8ab9d5d5f18f554e6cbf8ca56b7ca3144e726d7dfd64076a42a25b3dfb6

Download Submit
C:\Users\Admin\Downloads\WMMu.exe

Filesize
198KB

MD5
54656f235081d8eda394b1b693c653da

SHA1
e26ba072cefd48443a20df05ce578523dc023334

SHA256
a8a442b4e284d13ef3d80de0fe4638c6dd43f9bd68f1e84b6997cb05daf376ac

SHA512
94d7cfca8fcaece27b84d8f319523ea8872e082f48f1ab1aa88946511ffcaee82e08b6361021e721cb770463947d244257e8889a7c26ef28e76651fbaab0ca6d

Download Submit
C:\Users\Admin\Downloads\WYka.exe

Filesize
198KB

MD5
d736c6ebcd0b02dec2b03f25f474ccc6

SHA1
f05e91b2093ef211acb15da5bdc67808465f67cb

SHA256
b787d0f37d105293f8a2609060d47d966009421b44af54369985a8ca11b20435

SHA512
4fbbe4f17fb80ea2fb7fde37e4464b9744560df5e00acaa1202d89b3383c7d79d24b25dac56872ae6cb48deb80a8826dfe5260c532192d8e089a4264f8dcb8c9

Download Submit
C:\Users\Admin\Downloads\YAEq.ico

Filesize
4KB

MD5
ee421bd295eb1a0d8c54f8586ccb18fa

SHA1
bc06850f3112289fce374241f7e9aff0a70ecb2f

SHA256
57e72b9591e318a17feb74efa1262e9222814ad872437094734295700f669563

SHA512
dfd36dff3742f39858e4a3e781e756f6d8480caa33b715ad1a8293f6ef436cdc84c3d26428230cdac8651c1ee7947b0e5bb3ac1e32c0b7bbb2bfed81375b5897

Download Submit
C:\Users\Admin\Downloads\YMwC.exe

Filesize
821KB

MD5
924cfc027ed70acdc245387d4add277d

SHA1
9cf0354f491978d6879d7589b178cbdcd2bd4638

SHA256
adf0f77295db5ba2764aadb5a00ac36a6f0fd3349b860672a75003e4e38d0349

SHA512
90cd4e50c3f3d5c3d7f0aea370446fd27d991622288a0875e6f37c588cb36633c91e9f04f82bb61dee75c790be1ccdbdfda9452f5db6392b26ee737da726fbeb

Download Submit
C:\Users\Admin\Downloads\YUMQ.exe

Filesize
1.2MB

MD5
b06e9a6ca72294aacb8589705179ebd4

SHA1
6823e4e35f4648caded7cb004de2188eabc26a45

SHA256
e8f1a341b2ba29ee92ee46f80663161cc5982e2a4420faed04cf7ae9237c2ec3

SHA512
54d0135bf715d34f9c22ff5ad093a59e145dcd24542d5909dc973c7ee537c457de5a2ceced061a342f578f9ed6e8caa40ffaba8288ff808cfc32bc4a394de968

Download Submit
C:\Users\Admin\Downloads\YkEE.exe

Filesize
342KB

MD5
a71accb078c78158147cb89c644f69a8

SHA1
0600c120a3d8270c4f2fc800538956482a54f359

SHA256
01bbee055191ae799572164ca17fb83fa3577453ac763095f8671368b4e3358e

SHA512
29f3cb1a511f9c33ecb5ac78acf06f29ac09dee392635892275946b6348261cbea8a294422d34798d07b43b34deb74420db0b3630a70a4538ba0debb28aefcc9

Download Submit
C:\Users\Admin\Downloads\YkIQ.exe

Filesize
194KB

MD5
44fa9f468b1a40ce6daebaf9a3029cda

SHA1
1d4b1bc9624ab917c4206f6ef2a65bc3c6d4d6e9

SHA256
82c42b630a6d56e28f607aa5f87c86a718b7d0f29d29cc22d18fbf4a153c4765

SHA512
623ad641039f268706b9d9bb32499f09eb11d37bcd49e4c7f7e2e4c9db53f86a014622dd2c41b1ebf291551db229e6823f9943810dc6840bdc7de7a130819f15

Download Submit
C:\Users\Admin\Downloads\YocI.exe

Filesize
189KB

MD5
b4fd396dbd9af8a3355c1c268d29f473

SHA1
512947c149c68655716a8da2ae15c5bef868ae8f

SHA256
c18f56ae626d1e40c4e317ac5c7a495a5fb135088666851d42aadceb29bb1f50

SHA512
a6d12645a762884d5a30a24287ec826f27a01006691ebd314a867dca841e1aa0a5d96ee8830e3016cbd29352745a526005e03080c14692573fa6910e87d21f05

Download Submit
C:\Users\Admin\Downloads\aUgE.exe

Filesize
873KB

MD5
3f190cebaf75e7ed060c10ae384f6a7b

SHA1
c67ba438878c39fa807d34a98783669649436f7c

SHA256
9d54696ffdcfe8b29810d3d23203915c13a6f08beae5c6f075504ecfd9e7dd09

SHA512
4a4f9b31bc7a4f1207e167b6838dcf1895fcd908d63ba9a14bb53460ce879eb3c459400b28f6d5b00c7c6f235093b3dc7b5da2b3def0b413ff77ed39e26b64e6

Download Submit
C:\Users\Admin\Downloads\akcs.exe

Filesize
199KB

MD5
1588cbcb3fb7b32e3f8cf02df61d2fb0

SHA1
c8c49cefb16efbc3b423abaa46cf8ac09f5300e0

SHA256
05472236cd82634587af64f9729b2d5d03c756fb84852dee9adfb696d2f71348

SHA512
74268c67cccf7cc3bf7090fbb23a4944f860e93267572ac32371267b377d2e5564b6db31221dfc654902dde66898f6233a1c258b323e383a811503d049251f76

Download Submit
C:\Users\Admin\Downloads\askU.exe

Filesize
253KB

MD5
3a150fa02371e8a2c702f86bc2aeac39

SHA1
8e30c2173bf11b19c183f16ad0634b2dce7f130d

SHA256
98a4b7dd85d921ab881efef0e14994ca0f8d71c3a64a289d0e49aed5b0132576

SHA512
16f4c29d70f3656eb08f656e3546f437652f434b24fbda7b6b6af520c1780ada0bc74373f43739e2fa6cc908e2e0f9a8f542d805926f77e565334f39814c7235

Download Submit
C:\Users\Admin\Downloads\assG.exe

Filesize
197KB

MD5
50e1262481aa6871d695fee646b8cf3d

SHA1
d623f31e9ab1890a3cc00b2cd94ff702849f486e

SHA256
00effa9b01f832d7cb06a0600d58e7dbf159bd68da0e1ca37f4dd9e842d8fda7

SHA512
238f6e5498154cf33a340a6096e80fc0f9ae0f074170e9c965108255cd86951aa1453783d77e61edc7c9b67a1c37cb28f4449d4e4138db9c58b1f51347f50551

Download Submit
C:\Users\Admin\Downloads\cIwS.exe

Filesize
199KB

MD5
fd25f46c5477f3e437418b23f2ad9d1f

SHA1
5805357808c3a22c2bf4184ee4b9b782d9c30fcd

SHA256
8ecc47dd0ca7d6b7ba05d94834905b8f23f623a34472a1a3d24978b409487b0e

SHA512
4b0280ef3c47e1c193d8e1fe27f21d3a72387180dcd9c6c361285d3ad8208b0c060e071a04fbceb24450854106b1d225aba533242fff46fe044d5a3377bc3bb3

Download Submit
C:\Users\Admin\Downloads\cQQa.exe

Filesize
206KB

MD5
c07eaaa7cb06f706199444071331a2f2

SHA1
f85bd902d2686015e7e1ce96ff13c6dc1c3e47d6

SHA256
0305b06ef6ccbab152d3717068534411c822995ce3cf667ec83f481f9d51975b

SHA512
5b39e6b9c3c5167d06818133b1c3b8423c94ccd10626b073fdaed673c492df3953bd0346c71fd56ccd7db97bf6cd3553cd58db4aff98769c03b347a082ae5678

Download Submit
C:\Users\Admin\Downloads\csYK.exe

Filesize
186KB

MD5
e7f8b2b7fad1a81af96e6e20f51312f3

SHA1
33d4c3993a8ddd755676947fcdaa727ccecabd14

SHA256
342896ce173153aad6c6a9bf2af1f18a58c0c41ad3e12e48ef42c83c5088925a

SHA512
144187f9e6ba9c0e37c1b387ad950187f69224d20a65575c69c57353bc293919c139679d437790eb9899b93fa8f279aeaeda42d39518b4fa479a500b9306ab28

Download Submit
C:\Users\Admin\Downloads\eEAG.exe

Filesize
189KB

MD5
2f493650ab404745e09cf82858dc5ae0

SHA1
82078d0d83874b9a7dda883e9ec78d64bea0a5b9

SHA256
074ef0afd8d19fd91052375da57c1f8b51361d63ce8c3e3b63fdbf0ab4b0890c

SHA512
359b96abace89235cf92dda5789cd2f9c9369c2c9045da218c684d5444c3d79c31550be7ccf2f3b287ee2df256cf194ee94aa03d83cbc836e226f47fc4cc2663

Download Submit
C:\Users\Admin\Downloads\ecoM.exe

Filesize
217KB

MD5
5a72263ddb179e83493225a6e5ec70aa

SHA1
4867cfb99ecc85eb842d995c1ddb560caeea688b

SHA256
e54eff60a43d7ffa82902c5c022f53311d0d85f56768b3c3c7d33b9f3281f53d

SHA512
6406c0c289cda6ff857d7ebcf672d20c3d91b1b64e1acfd73435a677fe57f236d32dd77790295818cb48a54d296898b386eed36e6037d7b4da71c366c70ec5f1

Download Submit
C:\Users\Admin\Downloads\gAsE.ico

Filesize
4KB

MD5
6edd371bd7a23ec01c6a00d53f8723d1

SHA1
7b649ce267a19686d2d07a6c3ee2ca852a549ee6

SHA256
0b945cd858463198a2319799f721202efb88f1b7273bc3726206f0bb272802f7

SHA512
65ccc2a9bdb09cac3293ea8ef68a2e63b30af122d1e4953ee5dc0db7250e56bcca0eb2b78809dbdedef0884fbac51416fc5b9420cb5d02d4d199573e25c1e1f8

Download Submit
C:\Users\Admin\Downloads\gccu.exe

Filesize
5.9MB

MD5
3416b2c305781a311d48d126b383ebd6

SHA1
63985e05f7d2b5c0e33c1d20fce016c1dff964ad

SHA256
5d8eb1807990ef96acf75d84c7cfcbeee961c451c0b3545981db603f5b771eed

SHA512
5aad0fbbc271f2682edf369a53ab682745b3e9b4664bcc1e580a7ef16ce8113a44f0c349a9ec034551054a5c8c7a3cf55abd095d793262c4b4da99ace58e6a85

Download Submit
C:\Users\Admin\Downloads\gcgm.exe

Filesize
185KB

MD5
579b792da633786acb74be3503749652

SHA1
1a7fd3968ad4fa3ccf6257191b7e577ed0ff6edd

SHA256
15d3fcc2859940f11bf0faed6c907fc19a56336cb916fdee6c4dc734044c786b

SHA512
b3e20d9b2f805dbb73602854353cebc9e18a8a84664cfb0e501a2582bdd21e6943ec2fe4642c3812af52c002c56d5b1a27ee3ae98ac77ba18c508efaa6abb3b3

Download Submit
C:\Users\Admin\Downloads\iQog.exe

Filesize
192KB

MD5
174dd58b2d010730f711a05c9ac37555

SHA1
9624710227a25461b6cfe93c99b10e0ae107e43d

SHA256
b9f38cbc785193e14dfbe5c244a3b59bd9221d28f2374c86e865e5818410170b

SHA512
2e3a32b9f1a50cb2339bddca75c5fbb9c551cf5e18bb947ec68b030778ededc9af3029f3f805a71faf5b14bd59d887805657256beb6db73af5f8538fa5dccd9e

Download Submit
C:\Users\Admin\Downloads\iowM.exe

Filesize
193KB

MD5
05b00542e416023b1931141791f991a4

SHA1
cb806b0fc2cc80a8c5acaaf814f07f2ac4b43f30

SHA256
71b15bb9126a11d89f18eeedbf0c274cffa6781ecc7dc173dfe99cf14f4c3106

SHA512
9fba7d7b54e4919512a76bfb34e4ccb3e89c6efc6d403163c1d03bbc2466d14fa9f4df29296009efd658f5a63dc7a3a1297b434d06c15d29e68cf0801dfe73a3

Download Submit
C:\Users\Admin\Downloads\iskm.exe

Filesize
332KB

MD5
c49500cf2e319f5a88a4bd4733d837fc

SHA1
1e4a78de249e685ea7d93bcd69ff6e7460df08de

SHA256
e8a891391770bcf252e865bcb082da9f2360f8f74084edfba58de51f9ad1759a

SHA512
ad8339e18c0af386dc42aea7e89c21d01f6bf9fa590f7114bb8318c868e7bd879bae542d8fa1f7d33a370185ea11075f26df17c1a4538789c784da483705a32d

Download Submit
C:\Users\Admin\Downloads\kIMm.exe

Filesize
197KB

MD5
607d142fdc3975be4ef8616d56654695

SHA1
5ba704dbdc02ecaf90ca7f1049f132a0a68f2c22

SHA256
7641772bbd086e457cd4a9b0f7f30630fe5643ec333eea7925c9b77e34670eb3

SHA512
8a7b4d64cef5a2be266b44e5350314baccd5d3288cb26f9de8ea11c64765d8b5cda5cccf08e9ecebd8c611d4be6f29b4cd286bbbe3aff978179fffad9dc5bfe2

Download Submit
C:\Users\Admin\Downloads\kQoy.exe

Filesize
187KB

MD5
5e7cc04adc26070ce25b1a40f584d936

SHA1
15828042f72a85d8fde784a8a10c0c5ccf52139c

SHA256
2f70e245fd8bea549fdc00b841b29f0bccd77e6fb8930681e04217dc29c8dce5

SHA512
d13091c1f925c8bba904d868398fa26014a3656c793cf91ef42664881a14a88d0d556054a6c55d29e49b10255fd08ded0b6b64e6af849a18ed5ee2d085cb691d

Download Submit
C:\Users\Admin\Downloads\kUkS.exe

Filesize
197KB

MD5
3982357aeab59b6a8ce1be4a7a2a0bf6

SHA1
faab26765f8e4fa8ae915b56795255e8f57e3899

SHA256
ce9840615f1095ab08525c4d5cc7416483195674c54768462a1cfdcd0abd1d0f

SHA512
bc51d2f9fff24dbae3309d8a999e9b785bb2eaabfb920758c6fc1d1ce5faadc9bb711b4fe57a7f44c3234e04dfe710b6fb983ea08ce8ab4bee59c6072539f972

Download Submit
C:\Users\Admin\Downloads\kckA.exe

Filesize
190KB

MD5
8c53da0fa4f2b4e69fb60d2dc84061e9

SHA1
f95ca70e02abf2705f300d1bb6939e3329c21a20

SHA256
fcf5f55a760f596ab0b1d9082d337119780319fdb837719c421ab3beac831416

SHA512
f5121138192162b25e65c6cef388950a57893c27213a5e025d05a4cf254f34605e875a74236786c005dd1c33691acbfdb801bd130f61b37760d7eed8c51d6a3b

Download Submit
C:\Users\Admin\Downloads\kgws.exe

Filesize
196KB

MD5
19abe6534c25c3e115bdd9112d665af8

SHA1
fe8aa3b92697d95a655e473e34e5167f765b2087

SHA256
3a38864bc909f672a11d0edceda0afc8e2f32ef34ac7387dba4db06a49f47fb3

SHA512
593bfe22962592629e070163a02b29f3d1349acf177a4c6954e8f29b60e9ad5b50cfc4584b42554a908c06a9ce8d6ca151127b9c536c4fdbea0a4c1f7f81a397

Download Submit
C:\Users\Admin\Downloads\koQc.exe

Filesize
196KB

MD5
56813e7bb24f0e2b9c96e6b92bd091ed

SHA1
bfbc5d01cc07f83f82bf7dc12b6bb22a515f95b3

SHA256
18d6c5eecb91b825637bd6d7ef22908b96200f89e36c1387a8baf7f408495343

SHA512
99e783354ef6ee1f1513d4e957e93e2c6ccb13f294fad04ae9d071ddf3892ad6eb278be2e0ab811bf35c084db783151af4a93ab0ace9d68df83a79553e91cffa

Download Submit
C:\Users\Admin\Downloads\kwco.exe

Filesize
196KB

MD5
0c5c12786dc811b074d2cdd78198ccdc

SHA1
fe8b5af5bdccf66c8cfabb4576f1fe6f75b53084

SHA256
ca60d3da8387657ee49da2e708de83deac788fdd6b7adf5055b58fed1498eb6e

SHA512
a44e32b14e10bf5c1851314003f6d9702df99b23bf89af3612b5b46782a96bca165a98e168b6882248654fa49881ae1a329ebc265abb92a5e67d346bac86f315

Download Submit
C:\Users\Admin\Downloads\kwko.exe

Filesize
1.8MB

MD5
18a5650b83ed6dd2c161603df9da7855

SHA1
894f133c9065089b05d6251b40559a30a4fe4853

SHA256
d1f974d44ab623010617a2581e57291f67b55c39c080d2488fd4d9eeb31d546f

SHA512
36c9b1a94b9145e0886899bd50d6983cb83cb89bdaa59722a3d6f4ab6dffa0d073b35c281d04dae27af44226ec95f0b549f568c78f8cd94e98f7297cf28c183b

Download Submit
C:\Users\Admin\Downloads\oMMY.exe

Filesize
201KB

MD5
716d8783ea4f7016ecc171a303846a39

SHA1
67065e135c6dfdc6b8122d4f8ce7835d611af92d

SHA256
378fe5c9d0dffaba9888cb37946e9cc3b51c7012925ac3f3b462b71ad2a6a096

SHA512
a0362e8fdff4e337a6a1b17edf136cfc21b81eec3bda2999840bdb30895ec6698195a49de28222479d581982ef02ac652eea897955379f35378db864029cae02

Download Submit
C:\Users\Admin\Downloads\ossS.exe

Filesize
208KB

MD5
0918477d00bdc3c27a653a74059174fc

SHA1
71397e0be5b90add40fdb030814bd28e863ab21e

SHA256
e3fc65bede8912deb395efab6c8e0b290a924df07c67a8b2a999781a2181fe37

SHA512
a41c85df4c72a263eac3e832f9c07a01fadca2203b92ca0c7506e317818d8d8ee1f79cb59547c5ec42ccb830f064758cd8b5a04ff2e14316e91c44b7e1c6ec51

Download Submit
C:\Users\Admin\Downloads\qIIi.exe

Filesize
203KB

MD5
a17563b40dc97b591c23ebd5f0092f49

SHA1
dc2d15bbdd9ce169d600f2c5e86064c8c9bd5540

SHA256
6d9c3ff7e8324396ac0f09f95e90cdb9cceb6b4e61bc7ce24f685f25220dcd57

SHA512
8f4d12db1c2bd504128c33a36f8424e9d57e5c6c5aa4e4634cb069958e735d840c1bd91990111047c9b8fbd550cc9de6022df5444009ce1d714235cb966a748b

Download Submit
C:\Users\Admin\Downloads\qQAk.exe

Filesize
196KB

MD5
ae03fe6bd52096a8d0e8fb763eed9b80

SHA1
a4d54a958dc2edb9b6f6cd4ee5a17a74b15fb7b3

SHA256
5540200ebf02453074c65b40d9e1004961451b1ada851fa7f575cbe1aa50c0e6

SHA512
c2ed9c1c489d97b2516740f85ada48eb5781f91541535098e975e4eb67b6feb49908718688884e5e4b28885dc95a9ddfc2ebe9ae1882675e97ebc78d19ebef84

Download Submit
C:\Users\Admin\Downloads\qYcI.exe

Filesize
185KB

MD5
ab93301e965f4692d10a23498acf6348

SHA1
24ec7d56c22d04a114717100966967faa80eea02

SHA256
410c9763cf8c7b51aa05917dc3a08481cda4ab1bb3c0a861647af6b80fa8b48a

SHA512
6c2ef1ea1e4b3a860f3d93df703e6645f91f2d223a9e6ae59b9508b1f96c90f9b5eea1871a3587fda5a332361270bf40827533a35c045119cfea60458bd9e491

Download Submit
C:\Users\Admin\Downloads\qYgO.exe

Filesize
215KB

MD5
20a7df2f8e61ed36382c5f338b2c6068

SHA1
908ffb66d6fc3a881d91fc55e8c38c06fc78e65a

SHA256
b6e769a64f799696d59808ced78a15c6e0a2b8df62e63ceac285d2cebd56d8a3

SHA512
68ea5f640cda8c6dc16badb3abe83e37907e9a74dd09949fbff23d3086242d7ff4885d82ef6fc7b99340b15d7937afdaa3a6bef8839cc293688d1a277c66646c

Download Submit
C:\Users\Admin\Downloads\qoYs.exe

Filesize
187KB

MD5
22604a40fcb9d3a20132ed590c2431c8

SHA1
8c884bbe44919b84291023f0aaf9eca6dc47605d

SHA256
6c02f3346bac3be1993dcb2f3d962b6dcb1ee2b422fea9c026ebc539e98ee334

SHA512
12929c02d8de442b209e08e26ca7eee41299fc234994edd5baacf7f6e19fc4ce263d83c010bdadd002a6a9f4e518c15acf4bd84122c9b2fb00e12e23814b1519

Download Submit
C:\Users\Admin\Downloads\qosm.exe

Filesize
1.6MB

MD5
3a9b6301112fe8f88479ad1df34b0b52

SHA1
211e9f54d63973fdc2f96eefcfc17b58ea261b2e

SHA256
091edc732255891c9f2d902276cd5dbb685289edc28504bfea1f9823a9bea1b0

SHA512
5e780e38d0a298997d54445757a3688fe95e9faa837af9cc679bf8999992e05fdbaf19e33d2cac9030a4a0fb495124161a31f8f49eae4670a25b571fa8e41a8f

Download Submit
C:\Users\Admin\Downloads\qsUG.ico

Filesize
4KB

MD5
ac4b56cc5c5e71c3bb226181418fd891

SHA1
e62149df7a7d31a7777cae68822e4d0eaba2199d

SHA256
701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3

SHA512
a8136ef9245c8a03a155d831ed9b9d5b126f160cdf3da3214850305d726d5d511145e0c83b817ca1ac7b10abccb47729624867d48fede0c46da06f4ac50cf998

Download Submit
C:\Users\Admin\Downloads\sYcy.exe

Filesize
759KB

MD5
2f3a57417c989999538e1fbc46195bb4

SHA1
2d145e8655d6b2b7049ead5e71d5a8ce812d9e94

SHA256
e7e50462f785f5294b78b2541035dea3290d8575e2f4cb346b7692c404ee8338

SHA512
c0a994938f42614597708d1c70e96628a1ae38c6328c4cf1dd1497fee8bbd4f4deda51791ba54b8feb796b349bd57daf57e8fce09ffdc94cfa14c5cdb528ab1d

Download Submit
C:\Users\Admin\Downloads\uYca.exe

Filesize
659KB

MD5
f03071438f53294b33252625a66aafd2

SHA1
ffc478c9175880736bc754dde001c625dcff4fec

SHA256
1ae2966751cb4d97de01723f23ac52402b587c044631bf889c53ba21d15929c8

SHA512
58ea71aa8f4de2c79586322c52b81a0aa7d84c547fdd357892c2ea70f4069fc38b27a720521f3fa5337e09deecf711ba6305136e228ae596bee24657f2f59e68

Download Submit
C:\Users\Admin\Downloads\uggY.exe

Filesize
186KB

MD5
00b1e4efab922203bb22539e6de4e2cd

SHA1
78d5347f00c16a3cb4d6793dc6a53d821c2a82ea

SHA256
0eaf1f716bb8daf0e0416cdf6eb0e845e9f73c728cf2df65c225e06a406d8f01

SHA512
59fd0ba95a9a7930a27c65e45ab8c88254dc310871d32098da935a3bbed557d3f2c6e3ea550dc58c7bb3f89032f3b2834c1836e15f8f95e44a807909c32a671f

Download Submit
C:\Users\Admin\Downloads\uoAi.ico

Filesize
4KB

MD5
ace522945d3d0ff3b6d96abef56e1427

SHA1
d71140c9657fd1b0d6e4ab8484b6cfe544616201

SHA256
daa05353be57bb7c4de23a63af8aac3f0c45fba8c1b40acac53e33240fbc25cd

SHA512
8e9c55fa909ff0222024218ff334fd6f3115eccc05c7224f8c63aa9e6f765ff4e90c43f26a7d8855a8a3c9b4183bd9919cb854b448c4055e9b98acef1186d83e

Download Submit
C:\Users\Admin\Downloads\wEkC.exe

Filesize
202KB

MD5
4584072b9b2cbbd35c8376361c756169

SHA1
7bd013b06a3ec0cb5b83f34f67b957784fed373d

SHA256
a49aff16558517e55d53c7e0e73e06465c54c3d00bb9f64f1d39f7628e7a4e5d

SHA512
910d7454a16687dec44e2c659a108982dc6ec9fe6f5b5966e21a18a353064496f64592a936b8c514a6e4e424436922c25a6f86cdb088574388b591d01b1b052d

Download Submit
C:\Users\Admin\Downloads\wYMQ.exe

Filesize
190KB

MD5
691dc5177b4aa618cf3503e59b4aaa78

SHA1
8e29f2b2c8c79abcda544401879eee3c47f58a90

SHA256
32614ceeb6c825222a52f53931603989d323dc5bae7146f07933c4335dc5cf2b

SHA512
1556530bf0342b6613de15a0e7fa8e36d554f8f8a31dcfafa4aa9466f7f21c2dfdee32340b589eaeb300b246e2b92d56e69ef433fc8f1ef219a0116516dcca1c

Download Submit
C:\Users\Admin\Downloads\wsku.exe

Filesize
499KB

MD5
a4200af93a9a56663a791f6184256e03

SHA1
675a6f52493d5b051dc4927d597d0689649c095e

SHA256
d0415a307650c80b38cdbfcdc7b46dfb8b7bc5173641ebbb0e3167f2f3127640

SHA512
edbe7d12c24eca03552798ed252dc8a5d6d26327be4b3127a3ef9fbfbe2d7986cbe772505f51091c41778293af792f5b7abcf34eac022b0fe07c8fc507b1b833

Download Submit
C:\Users\Admin\Downloads\yUIe.exe

Filesize
201KB

MD5
d407e4c38d22576cedb740b46ccf0197

SHA1
6a486320912fcb07dd917072a965ee53d378cdd3

SHA256
e6a9a8590238ca92148c47e7b9e677f987b2b2ae28d74366667d7d464e3a50d6

SHA512
3cd9fdf56a7933fcedfa2ba15b2f210c3cc653c859bc59f8a8795bebf7832e1cbb5fac7fb9e5573c89343993726247e9e9753986079a23ca5977e8468aeeb48a

Download Submit
C:\Users\Admin\Downloads\ycQK.exe

Filesize
227KB

MD5
b3128cf9cc20620a53c61d976e251fc1

SHA1
1e313acf41a2a4927bad0fb17f523bbe6f84f07b

SHA256
b2ffa3125c44fa3eb8d0f067216cb23359136f91df93a2aa558d19f627717f98

SHA512
8655603c0f51ab0e9585d56ba56b9eca6e3c6d7fd3ae2b2a121e4ac316ca10105067036c84a31fcb8c65e4c608e1f613ef4c726d0ddb9a7fcc32b0cb93186d91

Download Submit
C:\Users\Admin\Downloads\ygAC.exe

Filesize
968KB

MD5
6f8c11c5d08ae4b45e457a611a8f9f14

SHA1
7ee43c5873904ee22fdd0b88c5e847e66b4827eb

SHA256
f116283b9bd62eaa6faa310b5bf4c3e991cceb29c885685ce49e2f332074b07e

SHA512
29601fbabaf87571fd8babf48ce112cca3e832929d42542d4f0176d2a2bb88f00666d0627b87e311088942dcbf2d27c3ec0653ac034b0bc1fbafe267879ea9e0

Download Submit
C:\Users\Admin\Music\InstallStop.wma.exe

Filesize
610KB

MD5
c68b6db4cc11f0fb1e690186bbbd5711

SHA1
bdca2710090886a9893b358f7b362f66fa42f758

SHA256
94faa4d196431570bb3606563004dbedffbcd1a361fe61fe8223eb461c804695

SHA512
e68f1a599f05a54b5bc319155fcc924911fb8071aec5881d5d58ca444b8a6e198f8e1a5695952735be69951989724d0da8ec97dcbd66bb83cf68860968f3ae39

Download Submit
C:\Users\Admin\Music\ResumeUnregister.wma.exe

Filesize
901KB

MD5
d71f082f120b495c3c35e7e2847a7ad3

SHA1
470c8fced1fa96d46c4fa421738629a4b0e22017

SHA256
a35d4d4042e580bcde7da4d32af0c5aaca8acd8d9ef960d2f57cf77c0a25c5da

SHA512
c18354f14bd3b557efd6aff2e96a8b2ee5a955c7099987ca43ad67cd7d6a0842898fa74840ea986f08a6172d6355b464f2f48571cee435f071af21fc68a51312

Download Submit
C:\Users\Admin\Music\UnblockUnprotect.pdf.exe

Filesize
712KB

MD5
89929b6dc2a652926107b94aa8502272

SHA1
192ee4385eb325af778f229fde66d5767f8df25c

SHA256
0056178f0b5f72ec5f99801f05557fe8cd0e96ec18e7b06f16805a9a91fcb3c5

SHA512
21d61172d6a2bfd1e09fb62bc290a1926732bfa278b5e3129aded3a5c85a7efa68bdc964aef2bbbf669e139ec12617b816097eb84c5c45afec76a8e6590973cd

Download Submit
C:\Users\Admin\Pictures\LimitReset.bmp.exe

Filesize
453KB

MD5
be4b604b51ae73ac89797468dd730700

SHA1
4f31528feeda6abb5637af23fe5fcf54031caed7

SHA256
27a7fd38ec07af9949c97b945b5405a4382d944701897f56298d640eb7f44117

SHA512
62f8ee39da2856dbc26a4b944ac12c86bc19c82a6622e08e2587ac14c2e0a10b7a4ea3feea801c5bcec85ece11c439b9656accbc630c13c6e6b67f032084bcf2

Download Submit
C:\Windows\perfc.dat

Filesize
353KB

MD5
71b6a493388e7d0b40c83ce903bc6b04

SHA1
34f917aaba5684fbe56d3c57d48ef2a1aa7cf06d

SHA256
027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745

SHA512
072205eca5099d9269f358fe534b370ff21a4f12d7938d6d2e2713f69310f0698e53b8aff062849f0b2a521f68bee097c1840993825d2a5a3aa8cf4145911c6f

Download Submit
memory/448-539-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1124-639-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1124-621-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1524-551-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2124-638-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2124-662-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2268-702-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2276-563-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2652-634-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2652-661-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2960-724-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3408-576-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3448-633-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3448-622-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3480-648-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3936-620-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3936-610-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4008-675-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4008-663-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4372-590-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4372-601-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4960-2525-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4960-518-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4980-666-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4980-689-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5064-520-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5064-2530-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5092-728-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5092-743-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5144-416-0x00000000009F0000-0x0000000000A4E000-memory.dmp

Filesize
376KB

Download
memory/5144-414-0x00000000009F0000-0x0000000000A4E000-memory.dmp

Filesize
376KB

Download
memory/5144-405-0x00000000009F0000-0x0000000000A4E000-memory.dmp

Filesize
376KB

Download
memory/5144-413-0x00000000009F0000-0x0000000000A4E000-memory.dmp

Filesize
376KB

Download
memory/5144-427-0x00000000009F0000-0x0000000000A4E000-memory.dmp

Filesize
376KB

Download
memory/5160-241-0x00007FFE05F40000-0x00007FFE061F6000-memory.dmp

Filesize
2.7MB

Download
memory/5160-242-0x00007FFE00B20000-0x00007FFE01BD0000-memory.dmp

Filesize
16.7MB

Download
memory/5160-239-0x00007FF72C660000-0x00007FF72C758000-memory.dmp

Filesize
992KB

Download
memory/5160-240-0x00007FFE06200000-0x00007FFE06234000-memory.dmp

Filesize
208KB

Download
memory/5280-591-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5280-575-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5504-730-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5504-747-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5560-754-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5560-734-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5608-688-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5688-504-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5688-525-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5740-609-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5876-454-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5876-2502-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5876-466-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5876-727-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5876-301-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5876-345-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5876-299-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5876-812-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5876-298-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5876-297-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5876-2547-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5876-1024-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5876-357-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5876-435-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5876-2474-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5876-1889-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5888-694-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5888-715-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/6012-314-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/6012-333-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/6012-315-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/6028-718-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download