hxxps://github[.]com/Endermanch/MalwareDatabase

max time kernel
212s
max time network
215s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
19/08/2024, 00:44

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

10^/10

discovery evasion persistence ransomware spyware stealer trojan

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found

UAC bypass 3 TTPs 64 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Renames multiple (90) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 64 IoCs

pid	Process
5048	BwEUUcos.exe
4756	GIkIosEg.exe
1608	[email protected]
480	[email protected]
5040	[email protected]
2388	[email protected]
984	[email protected]
2440	[email protected]
2036	[email protected]
240	[email protected]
3180	[email protected]
2460	[email protected]
4824	[email protected]
2856	[email protected]
2212	[email protected]
4644	[email protected]
4912	[email protected]
2712	[email protected]
3964	[email protected]
2268	[email protected]
3852	[email protected]
4664	[email protected]
4540	[email protected]
440	[email protected]
4248	[email protected]
3856	[email protected]
3724	[email protected]
3480	[email protected]
3492	[email protected]
108	[email protected]
4912	[email protected]
3772	[email protected]
3104	[email protected]
2528	[email protected]
2268	[email protected]
704	[email protected]
3180	[email protected]
1844	[email protected]
4248	[email protected]
496	[email protected]
3772	[email protected]
4124	[email protected]
1484	[email protected]
3124	[email protected]
1608	[email protected]
4772	[email protected]
1844	[email protected]
4564	[email protected]
1564	[email protected]
4708	[email protected]
3444	[email protected]
4540	[email protected]
4812	[email protected]
4804	[email protected]
2316	[email protected]
508	[email protected]
4636	[email protected]
3044	[email protected]
404	[email protected]
1576	[email protected]
4820	[email protected]
3916	[email protected]
4700	[email protected]
444	[email protected]

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nUIsAIkc.exe = "C:\\ProgramData\\aqQkQQUc\\nUIsAIkc.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Run\BwEUUcos.exe = "C:\\Users\\Admin\\DEsAUwwg\\BwEUUcos.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GIkIosEg.exe = "C:\\ProgramData\\FkIMscoI\\GIkIosEg.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Run\BwEUUcos.exe = "C:\\Users\\Admin\\DEsAUwwg\\BwEUUcos.exe"	BwEUUcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GIkIosEg.exe = "C:\\ProgramData\\FkIMscoI\\GIkIosEg.exe"	GIkIosEg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Run\PqUsgAUQ.exe = "C:\\Users\\Admin\\XAkYsswg\\PqUsgAUQ.exe"	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
28	raw.githubusercontent.com

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ikEu.ico	BwEUUcos.exe
File created	C:\Windows\SysWOW64\qMMg.exe	BwEUUcos.exe
File created	C:\Windows\SysWOW64\Oksy.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\Wksy.exe	BwEUUcos.exe
File created	C:\Windows\SysWOW64\SogW.exe	BwEUUcos.exe
File created	C:\Windows\SysWOW64\kIck.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\EIsy.exe	BwEUUcos.exe
File created	C:\Windows\SysWOW64\WsEs.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\iQYm.exe	BwEUUcos.exe
File created	C:\Windows\SysWOW64\uYQe.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\cccu.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\ugoO.ico	BwEUUcos.exe
File created	C:\Windows\SysWOW64\cwIg.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\kAcO.ico	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\UAQO.ico	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\yMgU.ico	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\sUEQ.ico	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\skAO.ico	BwEUUcos.exe
File created	C:\Windows\SysWOW64\EcMo.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\IAEe.ico	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\uUoo.ico	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\CEIW.ico	BwEUUcos.exe
File created	C:\Windows\SysWOW64\SUoE.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\CAUY.ico	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\Iwgs.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\Cwky.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\awwO.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\oUcI.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\qscI.ico	BwEUUcos.exe
File created	C:\Windows\SysWOW64\Wksy.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\cUMk.exe	BwEUUcos.exe
File created	C:\Windows\SysWOW64\kYUy.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\KYck.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\EAIG.ico	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\egAK.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\uEQG.ico	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\eYgE.ico	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\oEUy.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\SEMk.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\AEsK.ico	BwEUUcos.exe
File created	C:\Windows\SysWOW64\yoAA.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\csco.ico	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\SwMY.ico	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\WYoe.exe	BwEUUcos.exe
File created	C:\Windows\SysWOW64\gIYa.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\kAMc.ico	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\ioIk.ico	BwEUUcos.exe
File created	C:\Windows\SysWOW64\GYQM.exe	BwEUUcos.exe
File created	C:\Windows\SysWOW64\Cwwu.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\Qgow.exe	BwEUUcos.exe
File created	C:\Windows\SysWOW64\iIwS.exe	BwEUUcos.exe
File created	C:\Windows\SysWOW64\gkga.exe	BwEUUcos.exe
File created	C:\Windows\SysWOW64\esEM.exe	BwEUUcos.exe
File created	C:\Windows\SysWOW64\SMAw.exe	BwEUUcos.exe
File created	C:\Windows\SysWOW64\Cgwu.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\sYUq.ico	BwEUUcos.exe
File created	C:\Windows\SysWOW64\kcwe.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\Csoc.ico	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\QsQg.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\sgQy.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\uIwG.exe	BwEUUcos.exe
File created	C:\Windows\SysWOW64\cYkG.exe	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\SEwM.ico	BwEUUcos.exe
File opened for modification	C:\Windows\SysWOW64\gEIM.exe	BwEUUcos.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3724	2332	WerFault.exe	803
3444	4612	WerFault.exe	802

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "135"	Process not Found
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	Process not Found

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
1692	reg.exe
4788	reg.exe
444	reg.exe
4476	reg.exe
4068	Process not Found
1784	reg.exe
440	Process not Found
3548	reg.exe
2028	reg.exe
3696	reg.exe
3124	reg.exe
4656	reg.exe
4364	Process not Found
4740	reg.exe
3340	reg.exe
1844	reg.exe
3584	reg.exe
2356	Process not Found
5100	reg.exe
3976	reg.exe
3884	reg.exe
4728	reg.exe
228	reg.exe
480	Process not Found
1780	reg.exe
2440	reg.exe
3556	reg.exe
3232	reg.exe
3248	reg.exe
2356	reg.exe
3920	reg.exe
2200	reg.exe
2944	reg.exe
1496	reg.exe
4916	reg.exe
4332	reg.exe
584	reg.exe
568	reg.exe
900	reg.exe
4816	Process not Found
3044	reg.exe
3444	reg.exe
1732	reg.exe
4616	Process not Found
696	Process not Found
1904	Process not Found
2440	Process not Found
4072	Process not Found
5116	Process not Found
3056	reg.exe
2904	reg.exe
2528	reg.exe
4616	reg.exe
2004	Process not Found
1564	reg.exe
1228	reg.exe
3368	reg.exe
3904	reg.exe
2684	reg.exe
924	reg.exe
2212	Process not Found
704	reg.exe
3436	reg.exe
4724	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\PolyRansom.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
2588	msedge.exe
2588	msedge.exe
336	msedge.exe
336	msedge.exe
1020	identity_helper.exe
1020	identity_helper.exe
4820	msedge.exe
4820	msedge.exe
4656	[email protected]
4656	[email protected]
4656	[email protected]
4656	[email protected]
1740	[email protected]
1740	[email protected]
1740	[email protected]
1740	[email protected]
240	[email protected]
240	[email protected]
240	[email protected]
240	[email protected]
1608	[email protected]
1608	[email protected]
1608	[email protected]
1608	[email protected]
480	[email protected]
480	[email protected]
480	[email protected]
480	[email protected]
5040	[email protected]
5040	[email protected]
5040	[email protected]
5040	[email protected]
2388	[email protected]
2388	[email protected]
2388	[email protected]
2388	[email protected]
984	[email protected]
984	[email protected]
984	[email protected]
984	[email protected]
2440	[email protected]
2440	[email protected]
2440	[email protected]
2440	[email protected]
2036	[email protected]
2036	[email protected]
2036	[email protected]
2036	[email protected]
240	[email protected]
240	[email protected]
240	[email protected]
240	[email protected]
3180	[email protected]
3180	[email protected]
3180	[email protected]
3180	[email protected]
2460	[email protected]
2460	[email protected]
2460	[email protected]
2460	[email protected]
4824	[email protected]
4824	[email protected]

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5048	BwEUUcos.exe
4756	GIkIosEg.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3916	taskmgr.exe
Token: SeSystemProfilePrivilege	3916	taskmgr.exe
Token: SeCreateGlobalPrivilege	3916	taskmgr.exe
Token: 33	3916	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3916	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe
3916	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2324	MiniSearchHost.exe
2388	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 5072	2588	msedge.exe	81
PID 2588 wrote to memory of 5072	2588	msedge.exe	81
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 1600	2588	msedge.exe	82
PID 2588 wrote to memory of 3412	2588	msedge.exe	83
PID 2588 wrote to memory of 3412	2588	msedge.exe	83
PID 2588 wrote to memory of 4888	2588	msedge.exe	84
PID 2588 wrote to memory of 4888	2588	msedge.exe	84
PID 2588 wrote to memory of 4888	2588	msedge.exe	84
PID 2588 wrote to memory of 4888	2588	msedge.exe	84
PID 2588 wrote to memory of 4888	2588	msedge.exe	84
PID 2588 wrote to memory of 4888	2588	msedge.exe	84
PID 2588 wrote to memory of 4888	2588	msedge.exe	84
PID 2588 wrote to memory of 4888	2588	msedge.exe	84
PID 2588 wrote to memory of 4888	2588	msedge.exe	84
PID 2588 wrote to memory of 4888	2588	msedge.exe	84
PID 2588 wrote to memory of 4888	2588	msedge.exe	84
PID 2588 wrote to memory of 4888	2588	msedge.exe	84
PID 2588 wrote to memory of 4888	2588	msedge.exe	84
PID 2588 wrote to memory of 4888	2588	msedge.exe	84
PID 2588 wrote to memory of 4888	2588	msedge.exe	84
PID 2588 wrote to memory of 4888	2588	msedge.exe	84
PID 2588 wrote to memory of 4888	2588	msedge.exe	84
PID 2588 wrote to memory of 4888	2588	msedge.exe	84
PID 2588 wrote to memory of 4888	2588	msedge.exe	84
PID 2588 wrote to memory of 4888	2588	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff96ee13cb8,0x7ff96ee13cc8,0x7ff96ee13cd8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,4640263736902338585,14023288931129115320,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,4640263736902338585,14023288931129115320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,4640263736902338585,14023288931129115320,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,4640263736902338585,14023288931129115320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,4640263736902338585,14023288931129115320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1960,4640263736902338585,14023288931129115320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,4640263736902338585,14023288931129115320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,4640263736902338585,14023288931129115320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,4640263736902338585,14023288931129115320,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,4640263736902338585,14023288931129115320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1960,4640263736902338585,14023288931129115320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3240 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,4640263736902338585,14023288931129115320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,4640263736902338585,14023288931129115320,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3604

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1040

C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4656
- C:\Users\Admin\DEsAUwwg\BwEUUcos.exe
  "C:\Users\Admin\DEsAUwwg\BwEUUcos.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5048
- C:\ProgramData\FkIMscoI\GIkIosEg.exe
  "C:\ProgramData\FkIMscoI\GIkIosEg.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
  2⤵
  PID:900
- - C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
    C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1740
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
      4⤵
      PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:240
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        6⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        8⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        10⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        12⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        14⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        16⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        18⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        20⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        22⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        24⤵
        
        PID:3040
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        25⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        26⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        27⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        28⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        29⤵
        Executes dropped EXE
        
        PID:2856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        30⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        31⤵
        Executes dropped EXE
        
        PID:2212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        32⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        33⤵
        Executes dropped EXE
        
        PID:4644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        34⤵
        
        PID:424
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        35⤵
        Executes dropped EXE
        
        PID:4912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        36⤵
        
        PID:496
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        37⤵
        Executes dropped EXE
        
        PID:2712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        38⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        39⤵
        Executes dropped EXE
        
        PID:3964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        40⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        41⤵
        Executes dropped EXE
        
        PID:2268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        42⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        43⤵
        Executes dropped EXE
        
        PID:3852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        44⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        45⤵
        Executes dropped EXE
        
        PID:4664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        46⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        47⤵
        Executes dropped EXE
        
        PID:4540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        48⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        49⤵
        Executes dropped EXE
        
        PID:440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        50⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        51⤵
        Executes dropped EXE
        
        PID:4248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        52⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        53⤵
        Executes dropped EXE
        
        PID:3856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        54⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        55⤵
        Executes dropped EXE
        
        PID:3724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        56⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        57⤵
        Executes dropped EXE
        
        PID:3480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        58⤵
        
        PID:3580
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        59⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        59⤵
        Executes dropped EXE
        
        PID:3492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        60⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        61⤵
        Executes dropped EXE
        
        PID:108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        62⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        63⤵
        Executes dropped EXE
        
        PID:4912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        64⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        65⤵
        Executes dropped EXE
        
        PID:3772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        66⤵
        
        PID:1040
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        67⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        67⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        68⤵
        
        PID:3480
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        69⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        69⤵
        Executes dropped EXE
        
        PID:2528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        70⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        71⤵
        Executes dropped EXE
        
        PID:2268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        72⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        73⤵
        Executes dropped EXE
        
        PID:704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        74⤵
        
        PID:568
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        75⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        75⤵
        Executes dropped EXE
        
        PID:3180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        76⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        77⤵
        Executes dropped EXE
        
        PID:1844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        78⤵
        
        PID:4820
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        79⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        79⤵
        Executes dropped EXE
        
        PID:4248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        80⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        81⤵
        Executes dropped EXE
        
        PID:496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        82⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        83⤵
        Executes dropped EXE
        
        PID:3772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        84⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        85⤵
        Executes dropped EXE
        
        PID:4124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        86⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        87⤵
        Executes dropped EXE
        
        PID:1484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        89⤵
        Executes dropped EXE
        
        PID:3124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        90⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        91⤵
        Executes dropped EXE
        
        PID:1608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        92⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        93⤵
        Executes dropped EXE
        
        PID:4772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        94⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        95⤵
        Executes dropped EXE
        
        PID:1844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        96⤵
        
        PID:4816
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        97⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        97⤵
        Executes dropped EXE
        
        PID:4564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        98⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        99⤵
        Executes dropped EXE
        
        PID:1564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        100⤵
        
        PID:2440
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        101⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        101⤵
        Executes dropped EXE
        
        PID:4708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        102⤵
        
        PID:108
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        103⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        103⤵
        Executes dropped EXE
        
        PID:3444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        104⤵
        
        PID:2320
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        105⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        105⤵
        Executes dropped EXE
        
        PID:4540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        106⤵
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        107⤵
        Executes dropped EXE
        
        PID:4812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        108⤵
        
        PID:2364
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        109⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        109⤵
        Executes dropped EXE
        
        PID:4804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        110⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        111⤵
        Executes dropped EXE
        
        PID:2316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        112⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        113⤵
        Executes dropped EXE
        
        PID:508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        114⤵
        
        PID:1692
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        115⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        115⤵
        Executes dropped EXE
        
        PID:4636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        116⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        117⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:3044
        
        C:\Users\Admin\XAkYsswg\PqUsgAUQ.exe
        
        "C:\Users\Admin\XAkYsswg\PqUsgAUQ.exe"
        118⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 240
        119⤵
        Program crash
        
        PID:3444
        
        C:\ProgramData\aqQkQQUc\nUIsAIkc.exe
        
        "C:\ProgramData\aqQkQQUc\nUIsAIkc.exe"
        118⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 236
        119⤵
        Program crash
        
        PID:3724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        118⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        119⤵
        Executes dropped EXE
        
        PID:404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        120⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        121⤵
        Executes dropped EXE
        
        PID:1576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        122⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        123⤵
        Executes dropped EXE
        
        PID:4820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        124⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        125⤵
        Executes dropped EXE
        
        PID:3916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        126⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        127⤵
        Executes dropped EXE
        
        PID:4700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        128⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        129⤵
        Executes dropped EXE
        
        PID:444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        130⤵
        
        PID:2356
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        131⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        131⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        132⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        133⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        134⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        135⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        136⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        137⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        138⤵
        
        PID:1704
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        139⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        139⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        140⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        141⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        142⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        143⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        144⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        145⤵
        
        PID:428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        146⤵
        
        PID:2272
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        147⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        147⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        148⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        149⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        151⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        152⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        153⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        154⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        155⤵
        
        PID:440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        156⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        157⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        158⤵
        
        PID:2316
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        159⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        159⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        160⤵
        
        PID:3676
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        161⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        161⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        162⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        163⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        164⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        165⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        166⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        167⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        168⤵
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        169⤵
        System Location Discovery: System Language Discovery
        
        PID:4616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        170⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        171⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        172⤵
        
        PID:1384
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        173⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        173⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        174⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        175⤵
        
        PID:228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        176⤵
        
        PID:2160
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        177⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        177⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        178⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        179⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        180⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        181⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        182⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        183⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        184⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        185⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        186⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        187⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        188⤵
        
        PID:2324
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        189⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        189⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        190⤵
        
        PID:4404
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        191⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        191⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        192⤵
        System Location Discovery: System Language Discovery
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        193⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        194⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        195⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        196⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        197⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        198⤵
        
        PID:4440
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        199⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        199⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        200⤵
        System Location Discovery: System Language Discovery
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        201⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        203⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        204⤵
        
        PID:4404
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        205⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        205⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        206⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        207⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        208⤵
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        209⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        210⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        211⤵
        
        PID:576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        212⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        213⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        214⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        215⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        216⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        217⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        218⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        219⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        220⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        221⤵
        
        PID:424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        222⤵
        
        PID:5020
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        223⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        223⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        224⤵
        
        PID:900
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        225⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        225⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        226⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        227⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        228⤵
        
        PID:428
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        229⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        230⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        231⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        232⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        233⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        234⤵
        System Location Discovery: System Language Discovery
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        235⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        236⤵
        
        PID:4344
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        237⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        237⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        238⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        239⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        240⤵
        System Location Discovery: System Language Discovery
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        241⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        242⤵
        
        PID:4692
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        243⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        243⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        244⤵
        
        PID:3032
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        245⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        245⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        246⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        247⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        248⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        249⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        250⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        248⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        248⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        248⤵
        UAC bypass
        
        PID:2164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cOUkMUAc.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        248⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        249⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        246⤵
        Modifies visibility of file extensions in Explorer
        
        PID:4544
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        247⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        246⤵
        Modifies registry key
        
        PID:2356
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        246⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tOQAccgY.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        246⤵
        
        PID:5020
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        247⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        247⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        244⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:924
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        244⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        244⤵
        
        PID:496
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        245⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tQoAQQIQ.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        244⤵
        
        PID:3076
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        245⤵
        
        PID:228
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        245⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        242⤵
        Modifies visibility of file extensions in Explorer
        
        PID:900
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        243⤵
        
        PID:428
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        242⤵
        
        PID:1836
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        243⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        242⤵
        
        PID:3548
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        243⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nosEEYsk.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        242⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        243⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        240⤵
        
        PID:3044
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        241⤵
        
        PID:404
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        240⤵
        Modifies registry key
        
        PID:4616
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        240⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MQcwwoYA.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        240⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        241⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        238⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        238⤵
        
        PID:428
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        239⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        238⤵
        UAC bypass
        
        PID:2332
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        239⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wiwYgIUc.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        238⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        239⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        236⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        236⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        236⤵
        UAC bypass
        
        PID:3972
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        237⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OOkUEMIE.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        236⤵
        
        PID:696
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        237⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        234⤵
        Modifies visibility of file extensions in Explorer
        
        PID:2036
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        234⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        234⤵
        
        PID:444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PYEQcIUo.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        234⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        235⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        232⤵
        Modifies visibility of file extensions in Explorer
        
        PID:5116
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        233⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        232⤵
        
        PID:2992
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        233⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        232⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lcgIQokk.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        232⤵
        
        PID:3904
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        233⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        233⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        230⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:2684
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        230⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        230⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hQwkgYYI.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        230⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        231⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        228⤵
        Modifies visibility of file extensions in Explorer
        
        PID:3056
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        228⤵
        Modifies registry key
        
        PID:3248
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        228⤵
        
        PID:4612
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        229⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eiMgkkQU.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        228⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        229⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        226⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        226⤵
        
        PID:508
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        226⤵
        UAC bypass
        
        PID:1080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AEQsYUgw.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        226⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        227⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        224⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        224⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        224⤵
        UAC bypass
        
        PID:3040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OGQQgkcg.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        224⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        225⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        222⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        
        PID:3248
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        222⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        222⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        
        PID:4544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ncIsYkEE.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        222⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        223⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        220⤵
        Modifies visibility of file extensions in Explorer
        
        PID:3384
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        220⤵
        
        PID:500
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        220⤵
        UAC bypass
        
        PID:4804
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        221⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZwggoUUA.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        220⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        221⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        218⤵
        
        PID:704
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        218⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        218⤵
        UAC bypass
        
        PID:5020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xYcUMgIw.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        218⤵
        
        PID:428
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        219⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        219⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        216⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        216⤵
        
        PID:696
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        216⤵
        UAC bypass
        
        PID:3056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pYIkwkUs.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        216⤵
        
        PID:4068
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        217⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        217⤵
        System Location Discovery: System Language Discovery
        
        PID:1736
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        214⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        214⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        214⤵
        UAC bypass
        
        PID:228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mykUcMIw.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        214⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        215⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        212⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4476
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        212⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        212⤵
        
        PID:3044
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        213⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IeMQsoEs.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        212⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        213⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        210⤵
        
        PID:2908
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        211⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        210⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4656
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        211⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        210⤵
        System Location Discovery: System Language Discovery
        
        PID:4916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qsgAYgkw.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        210⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        211⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        208⤵
        System Location Discovery: System Language Discovery
        
        PID:2116
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        209⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        208⤵
        System Location Discovery: System Language Discovery
        
        PID:4852
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        208⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RWgsMcYQ.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        208⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        209⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        206⤵
        Modifies visibility of file extensions in Explorer
        
        PID:3040
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        207⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        206⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        206⤵
        UAC bypass
        
        PID:1668
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        207⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jAIYgogM.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        206⤵
        System Location Discovery: System Language Discovery
        
        PID:4740
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        207⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        207⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        204⤵
        Modifies visibility of file extensions in Explorer
        
        PID:3972
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        204⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        204⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LMcwssks.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        204⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        205⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        202⤵
        
        PID:3188
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        203⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        202⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        202⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PogUooEY.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        202⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        203⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        200⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1732
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        200⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        200⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OKQwAQUU.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        200⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        201⤵
        
        PID:984
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        198⤵
        
        PID:3404
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        199⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        198⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        198⤵
        UAC bypass
        
        PID:1532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WAAsoQYE.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        198⤵
        
        PID:244
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        199⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        196⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        196⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        196⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GGQssUww.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        196⤵
        
        PID:1488
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        197⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        197⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        194⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        194⤵
        System Location Discovery: System Language Discovery
        
        PID:4808
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        195⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        194⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uoYYUoEg.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        194⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        195⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        192⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        192⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        192⤵
        
        PID:2956
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        193⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\licgYwoc.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        192⤵
        
        PID:404
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        193⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        190⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        190⤵
        
        PID:5044
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        191⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        190⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vAAYYQYY.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        190⤵
        
        PID:900
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        191⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        188⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        188⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        188⤵
        Modifies registry key
        
        PID:2944
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        189⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vkwoIQAs.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        188⤵
        
        PID:3436
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        189⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        189⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        186⤵
        
        PID:4788
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        187⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        186⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        186⤵
        
        PID:480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cQsswwgs.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        186⤵
        
        PID:4424
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        187⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        187⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        184⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        184⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        184⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ycUgAwAo.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        184⤵
        
        PID:424
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        185⤵
        
        PID:440
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        185⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        182⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        182⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        182⤵
        UAC bypass
        Modifies registry key
        
        PID:1844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\csEkggoE.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        182⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        183⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        180⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        
        PID:3180
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        180⤵
        Modifies registry key
        
        PID:3696
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        180⤵
        UAC bypass
        
        PID:3552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OSYowIYo.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        180⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        181⤵
        
        PID:428
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        178⤵
        System Location Discovery: System Language Discovery
        
        PID:704
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        179⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        178⤵
        
        PID:1672
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        179⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        178⤵
        UAC bypass
        
        PID:3056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nCAsAQwc.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        178⤵
        
        PID:4336
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        179⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        179⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        176⤵
        Modifies visibility of file extensions in Explorer
        
        PID:2272
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        176⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        176⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        
        PID:3492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vUgUEokc.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        176⤵
        
        PID:428
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:1580
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        174⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        
        PID:3392
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        175⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        174⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        174⤵
        
        PID:1692
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        175⤵
        
        PID:680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nAoIYEcs.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        174⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        175⤵
        System Location Discovery: System Language Discovery
        
        PID:2244
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        172⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        172⤵
        
        PID:500
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        173⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        172⤵
        UAC bypass
        
        PID:584
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        173⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fGsYkAUc.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        172⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        173⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        170⤵
        Modifies visibility of file extensions in Explorer
        
        PID:3676
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        171⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        170⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        170⤵
        Modifies registry key
        
        PID:900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YSwQUEck.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        170⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        171⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        168⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3340
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        168⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        168⤵
        UAC bypass
        Modifies registry key
        
        PID:3232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uuAgIkMU.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        168⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        169⤵
        System Location Discovery: System Language Discovery
        
        PID:1836
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        166⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        166⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        166⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oAEMkMIQ.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        166⤵
        
        PID:3248
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        167⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        167⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        164⤵
        Modifies visibility of file extensions in Explorer
        
        PID:2332
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        164⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        164⤵
        Modifies registry key
        
        PID:3436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MAAQwIkw.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        164⤵
        
        PID:228
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        165⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        162⤵
        
        PID:3188
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        163⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        162⤵
        
        PID:5020
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        163⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        162⤵
        UAC bypass
        
        PID:2320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lqYEskYk.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        162⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        163⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        160⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        160⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        160⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        
        PID:1064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hwoEkEUQ.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        160⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        161⤵
        
        PID:480
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        158⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        158⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        158⤵
        UAC bypass
        
        PID:4636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HiMgEMIg.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        158⤵
        
        PID:4580
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        159⤵
        
        PID:404
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        159⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        156⤵
        Modifies registry key
        
        PID:4332
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        156⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        156⤵
        System Location Discovery: System Language Discovery
        
        PID:3056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nAUMUckA.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        156⤵
        
        PID:480
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        157⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        154⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        154⤵
        Modifies registry key
        
        PID:704
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        154⤵
        System Location Discovery: System Language Discovery
        
        PID:4820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ISQAAswo.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        154⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        155⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        152⤵
        
        PID:2112
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        153⤵
        
        PID:508
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        152⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        152⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yUMAsEoc.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        152⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        153⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        150⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        150⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        150⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        
        PID:4580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AsIMwwsQ.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        150⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        151⤵
        
        PID:480
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        148⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        
        PID:2856
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        148⤵
        
        PID:984
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        148⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UIgQwkQc.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        148⤵
        
        PID:704
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        149⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        146⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:3840
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        146⤵
        
        PID:4908
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        147⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LEscAwoE.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        146⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        147⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        144⤵
        
        PID:984
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        144⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        144⤵
        UAC bypass
        
        PID:5040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hgIscccw.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        144⤵
        
        PID:4764
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        145⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        145⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        142⤵
        
        PID:444
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:1216
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        143⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XEcMgssA.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        142⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        143⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        140⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1904
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        141⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        140⤵
        
        PID:2160
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        141⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        140⤵
        
        PID:3148
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        141⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WuUAEIgo.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        140⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        141⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        138⤵
        Modifies visibility of file extensions in Explorer
        
        PID:4444
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        138⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        138⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qikEAUcA.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        138⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        139⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        136⤵
        Modifies visibility of file extensions in Explorer
        
        PID:2316
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        137⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        136⤵
        Modifies registry key
        
        PID:3444
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        136⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MUoQQkss.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        136⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        137⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        134⤵
        Modifies visibility of file extensions in Explorer
        
        PID:2272
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        135⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        134⤵
        Modifies registry key
        
        PID:444
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        134⤵
        UAC bypass
        
        PID:2036
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        135⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xoAwcUIg.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        134⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        135⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        132⤵
        Modifies visibility of file extensions in Explorer
        
        PID:3180
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        132⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        132⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XyosgYQY.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        132⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        133⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        130⤵
        Modifies visibility of file extensions in Explorer
        
        PID:3488
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        130⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        130⤵
        UAC bypass
        
        PID:4816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\recMcEIE.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        130⤵
        
        PID:3340
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        131⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        131⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        128⤵
        
        PID:4332
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        129⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        128⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        128⤵
        
        PID:1736
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        129⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pGcAsYYw.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        128⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        129⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        126⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1084
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        126⤵
        Modifies registry key
        
        PID:3904
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        126⤵
        Modifies registry key
        
        PID:2528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uMUkIYUQ.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        126⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        127⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        124⤵
        Modifies registry key
        
        PID:2904
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        124⤵
        
        PID:4104
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        125⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        124⤵
        UAC bypass
        
        PID:3248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QWcAYMsU.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        124⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        125⤵
        
        PID:108
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        122⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        122⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        122⤵
        UAC bypass
        
        PID:3124
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        123⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YEoAYQww.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        122⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        123⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        120⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        120⤵
        Modifies registry key
        
        PID:3368
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        120⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wAkoYQAw.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        120⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        121⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        118⤵
        Modifies visibility of file extensions in Explorer
        
        PID:5032
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        118⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        118⤵
        UAC bypass
        
        PID:2268
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        119⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DWEUcksE.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        118⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        119⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        116⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        116⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        116⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jYsoQskE.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        116⤵
        
        PID:956
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        117⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        117⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        114⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        114⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        114⤵
        UAC bypass
        
        PID:1528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vOgMQsgo.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        114⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        115⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        112⤵
        Modifies visibility of file extensions in Explorer
        
        PID:2332
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        112⤵
        Modifies registry key
        
        PID:3556
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        113⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        112⤵
        
        PID:332
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        113⤵
        
        PID:404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wMYEwIMs.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        112⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        113⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        110⤵
        
        PID:448
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        110⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        110⤵
        UAC bypass
        
        PID:3032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UsUEQAAk.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        110⤵
        
        PID:4620
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        111⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        111⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        108⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4788
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        108⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        108⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ccgQIogs.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        108⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        109⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        106⤵
        
        PID:5020
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        107⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        106⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        106⤵
        Modifies registry key
        
        PID:3056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EicoIsIw.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        106⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        107⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        104⤵
        Modifies visibility of file extensions in Explorer
        
        PID:3232
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        104⤵
        Modifies registry key
        
        PID:2028
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        104⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DmgYIYco.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        104⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        105⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        102⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1060
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        102⤵
        
        PID:404
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        102⤵
        UAC bypass
        
        PID:4732
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        103⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PMQAMkoE.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        102⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        103⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        100⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1176
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        100⤵
        
        PID:2868
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        101⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        100⤵
        UAC bypass
        
        PID:4868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Picwoskg.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        100⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        101⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        98⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        98⤵
        
        PID:568
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        98⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nWckAMMM.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        98⤵
        
        PID:1080
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        99⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        99⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        96⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        96⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        96⤵
        UAC bypass
        
        PID:4728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gYkMIoIw.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        96⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        97⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        94⤵
        Modifies visibility of file extensions in Explorer
        
        PID:240
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        94⤵
        Modifies registry key
        
        PID:2440
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        95⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        94⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YWgEgcoQ.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        94⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        95⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        92⤵
        
        PID:1384
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        93⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        92⤵
        Modifies registry key
        
        PID:568
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        92⤵
        
        PID:980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugYkQcsI.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        92⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        93⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        90⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        90⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        90⤵
        UAC bypass
        
        PID:440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NCwsoYcE.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        90⤵
        
        PID:4664
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        91⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        91⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        88⤵
        Modifies visibility of file extensions in Explorer
        
        PID:3232
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        88⤵
        Modifies registry key
        
        PID:2200
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        88⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DsoQIkcw.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        88⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        89⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        86⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        86⤵
        
        PID:568
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        86⤵
        Modifies registry key
        
        PID:4740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VswQIIEE.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        86⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        87⤵
        
        PID:404
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        84⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        84⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JwEkskco.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        84⤵
        
        PID:900
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        85⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        82⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        82⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        82⤵
        UAC bypass
        
        PID:4764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WKAEMUUc.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        82⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        83⤵
        
        PID:984
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        80⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        
        PID:3556
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        81⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        80⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        80⤵
        UAC bypass
        
        PID:5040
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        81⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UyYksksc.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        80⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        81⤵
        
        PID:428
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        78⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        78⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        78⤵
        UAC bypass
        
        PID:3696
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        79⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wKAkckMo.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        78⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        79⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        76⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        76⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        76⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iqsgsUsg.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        76⤵
        
        PID:332
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        77⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        74⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        74⤵
        
        PID:4896
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        75⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:4772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FucYkUQA.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        74⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        75⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        72⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        72⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        72⤵
        UAC bypass
        
        PID:2356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ROQYcUII.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        72⤵
        
        PID:4652
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        73⤵
        
        PID:108
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        73⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        70⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        70⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        70⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NYkwQAQs.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        70⤵
        
        PID:4708
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        71⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        71⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        68⤵
        Modifies visibility of file extensions in Explorer
        
        PID:3068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        68⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        68⤵
        
        PID:3392
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        69⤵
        
        PID:500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AIEwYIAY.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        68⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        69⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        66⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        66⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        66⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qKMMEoYA.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        66⤵
        
        PID:2348
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        67⤵
        
        PID:228
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        67⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        64⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4916
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        64⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        64⤵
        UAC bypass
        
        PID:4868
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        65⤵
        
        PID:440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yEYwsAwE.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        64⤵
        System Location Discovery: System Language Discovery
        
        PID:4740
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        65⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        62⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:3044
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        62⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        62⤵
        Modifies registry key
        
        PID:3884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iAwwUgIg.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        62⤵
        
        PID:500
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        63⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        60⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1060
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        60⤵
        
        PID:332
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        60⤵
        
        PID:3464
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        61⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FSAscoIs.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        60⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        61⤵
        
        PID:228
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        58⤵
        
        PID:4580
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        59⤵
        
        PID:480
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        58⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        58⤵
        
        PID:984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XYEIIAsk.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        58⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        59⤵
        System Location Discovery: System Language Discovery
        
        PID:404
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        56⤵
        
        PID:4804
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        57⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        56⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        56⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NOoEkYAk.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        56⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        57⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        54⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        54⤵
        Modifies registry key
        
        PID:1692
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        55⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        54⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GMYUUMsk.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        54⤵
        
        PID:108
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        55⤵
        
        PID:508
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        52⤵
        Modifies registry key
        
        PID:3976
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        52⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        52⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OekQUoIY.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        52⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        53⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        50⤵
        
        PID:4740
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        51⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        50⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        50⤵
        UAC bypass
        
        PID:4764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GuQEcIcI.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        50⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        51⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        48⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        48⤵
        Modifies registry key
        
        PID:3548
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        48⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MuAwsQAs.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        48⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        49⤵
        System Location Discovery: System Language Discovery
        
        PID:3488
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        46⤵
        Modifies visibility of file extensions in Explorer
        
        PID:508
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        46⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        46⤵
        UAC bypass
        
        PID:332
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        47⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tkYIEcAY.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        46⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        47⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        44⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        44⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        44⤵
        UAC bypass
        
        PID:2264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vsIksckA.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        44⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        45⤵
        
        PID:704
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        42⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        42⤵
        Modifies registry key
        
        PID:4724
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        42⤵
        UAC bypass
        
        PID:4612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XuIMskow.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        42⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        43⤵
        System Location Discovery: System Language Discovery
        
        PID:480
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        40⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        40⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        40⤵
        
        PID:3488
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        41⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iIIMAowk.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        40⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        41⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        38⤵
        Modifies registry key
        
        PID:3920
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        38⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        38⤵
        UAC bypass
        
        PID:3056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IuUgwgwE.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        38⤵
        System Location Discovery: System Language Discovery
        
        PID:1040
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        39⤵
        System Location Discovery: System Language Discovery
        
        PID:4908
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        36⤵
        
        PID:448
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        37⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        36⤵
        
        PID:228
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        36⤵
        
        PID:2320
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        37⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YkksYwcY.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        36⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        37⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        34⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1844
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        34⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        34⤵
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\McoQkUMc.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        34⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        35⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        32⤵
        Modifies visibility of file extensions in Explorer
        
        PID:2904
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        32⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        32⤵
        UAC bypass
        
        PID:3856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIUAcwQk.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        32⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        33⤵
        
        PID:568
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        30⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1476
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        31⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        30⤵
        Modifies registry key
        
        PID:5100
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        30⤵
        UAC bypass
        Modifies registry key
        
        PID:1496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JeIYEYQo.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        30⤵
        
        PID:448
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        31⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        28⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        28⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:584
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        28⤵
        UAC bypass
        
        PID:332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DWoYEEUo.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        28⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        29⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        26⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        26⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        26⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RoocYEUI.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        26⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        27⤵
        System Location Discovery: System Language Discovery
        
        PID:496
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        24⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:4728
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        24⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        24⤵
        UAC bypass
        
        PID:3536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CAcUIggg.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:3184
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        25⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        22⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1228
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        22⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        22⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YCQkoIEU.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        22⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:3480
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        20⤵
        Modifies visibility of file extensions in Explorer
        
        PID:1692
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        20⤵
        Modifies registry key
        
        PID:1564
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        20⤵
        
        PID:3972
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        21⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kgogQAgU.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        20⤵
        
        PID:496
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        21⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        18⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        18⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        18⤵
        
        PID:404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\caIMYQMo.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        18⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        19⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        16⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1780
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        16⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        16⤵
        UAC bypass
        Modifies registry key
        
        PID:3584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HoEccIgA.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        16⤵
        
        PID:584
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:424
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        14⤵
        Modifies visibility of file extensions in Explorer
        
        PID:2112
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        14⤵
        
        PID:480
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        15⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        14⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fqMAkEoE.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        14⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        15⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        12⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        12⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        12⤵
        UAC bypass
        
        PID:3184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lIwQwckE.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        12⤵
        
        PID:980
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        13⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        10⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        10⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        10⤵
        UAC bypass
        
        PID:3756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GgwYMMAo.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        10⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        11⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        8⤵
        Modifies visibility of file extensions in Explorer
        
        PID:3124
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        8⤵
        Modifies registry key
        
        PID:1784
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        8⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MscwIwYQ.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        8⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        9⤵
        
        PID:3016
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        6⤵
        
        PID:1484
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        6⤵
        
        PID:1080
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        6⤵
        
        PID:2212
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OWYIEsQk.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        6⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        7⤵
        
        PID:4824
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:3124
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      PID:3444
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      UAC bypass
      PID:3232
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yuYgswEI.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
      4⤵
      PID:3724
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        
        PID:4916
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:3388
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:4908
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - UAC bypass
  PID:3884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tIEYsUUM.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
  2⤵
  PID:3852
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:4336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4612 -ip 4612
  2⤵
  PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2332 -ip 2332
  2⤵
  PID:2944

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3916

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2324

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\FkIMscoI\GIkIosEg.exe

Filesize
193KB

MD5
f61b542649314ac1610e2f3767e6e8c0

SHA1
2a81e3b308bb28a24f7c1ec377d717c468666cb0

SHA256
c32a92df9e2d3266fd88b8fe3edb74d22f27ed5ad14afbd7857655eb5387a4a9

SHA512
3086eece150d8da7ed08e5ff4f5b12ad838de0ac45be8e453bdd0bd958efec3a547a7f52df34a768bcdd20a7ad0c2eb8fec0c20b4aa341b1595e33abe2753fc0

Download Submit
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.exe

Filesize
313KB

MD5
6a6faaa0f498814337820cc276e0d815

SHA1
0b35c8700aa832b48870884f2ca6fa585631ab23

SHA256
656b669f96c10e176ba056df91f8966d9c4a79a9367d26463881cd766cf3e527

SHA512
2c30c1ff63f1444a952fc975535e2c247770ead6df1ddd7d6e279ef10a49f9346d889a1ff7595ad83a8bb0fffff04572bd50af6954cc86302817c5c67592c59e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c3889d3f0d2246f800c495aec7c3f7c

SHA1
dd38e6bf74617bfcf9d6cceff2f746a094114220

SHA256
0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4

SHA512
2d6cb23e2977c0890f69751a96daeb71e0f12089625f32b34b032615435408f21047b90c19de09f83ef99957681440fdc0c985e079bb196371881b5fdca68a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c4a10f6df4922438ca68ada540730100

SHA1
4c7bfbe3e2358a28bf5b024c4be485fa6773629e

SHA256
f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02

SHA512
b4d407341989e0bbbe0cdd64f7757bea17f0141a89104301dd7ffe45e7511d3ea27c53306381a29c24df68bdb9677eb8c07d4d88874d86aba41bb6f0ce7a942c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b9fb5bff9b64bfda6b3e81cd05ee757d

SHA1
7368fae84ea7cabcf3ab0f33add36f7bb8aef249

SHA256
1e4a99cbbc5e87a776c356ab734dade47a3c21eda109a3dfa9f276c294b274ba

SHA512
80025c909f02e0287f5d06146586961892855ae12075af57313616d4b72aca7efdb431b4ab6d522c2622ff2e9c1a9a389ba112a64f48bf9bbf8e4548960761bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
46fa4f5f7344089589d117bd7599b3a9

SHA1
b6cc1fe19e527d4a372c97e4d195ed94eee40030

SHA256
223280d95a13f1af6af06459bbf230874500c212a2e16f63914eff3f22e8b57a

SHA512
6b680aedde7e806802652aab9ab31cb21438bc8756b063955e6f03bbbdf1273f7d47c40ec1a19fe27537afeb8d6cc219a246d31f7c6822b481649fe296e2a45c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
57a43bfde031db1988a491c710d3f2e4

SHA1
961f2485e24b2be22da373bee5dcd56938b2102c

SHA256
1868ed3c79e38cfbb1b9a29d80aeee6dc9882d054367dd2370848f71c3eff27e

SHA512
6e88c1b6c9e16d357124f89ed792349f1f5058ba8d66315b1a4055792d427db1ac4ddda015a281e87c4f5cf4ca06475fdaaac59905ff9bc8c8d8bb643720a39c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f5cc0e50dcc3a81c3203e3d6b93794f

SHA1
64719cbb9b74f9d3fe9a1f08c219e821767cfd6c

SHA256
3ae144cf2982de879b68489f6ed25b6aaacd11286bab0086219916314c7d3ca5

SHA512
774dd3461e68c1307b5e784bf6a79dead767056052637a3f4f5eb89f6ce00529ccf8491dac6e26c7d325c1353ef3f2c131f0c4b9126477e0563581ef32084af1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eb4be727b4073445e23be00be496bf9f

SHA1
b568122d43881a1eb66860fe4a8db378b8990bb9

SHA256
e18dfffe8b719e029eb1f559242c20352ed11ee6c49f736e41e932842e6b9e86

SHA512
dc0be10f9f2f6d0984deaddfcabd0faba6684d7f923c30df3a90ac68038b394fef922b36a67744492d8402c33bc0d97e0695aa8fa77b373b40881c9f432ae13e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
625852ecab0cef6853d7e69f693544be

SHA1
363d364dea4d1b816db7b46166930aa201bafe14

SHA256
92e7c7ff787a7d951f92f69b3ab1c0d0133aef92ad83565bc44d2be20eaeb8e3

SHA512
3564a60edc9b173c4b64e71b9f5f20f0cac61a15e65f9700fdfc1c65d5c4b780c51e5710f372ab253aacd1952dc6db7aedeb62ea6ccef1997e4895db59a3ea57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0dde48fb7072402745fbe32b301f6524

SHA1
dca4ed76c0ec28b4d8f2162748b64e9b511560bc

SHA256
7ebc5ef336e8e730854f9204fe854548fd67ed9c2c3c0559fcd5837e7ce4acd9

SHA512
d959ab00c08fac5f1c948f2d5165a42e6c16db0c5c5220aeda663535d50ae929fd9b4af92e15cfa1941dd41bd6fa321982ca53c60617bd3521a5069a510bc099

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582d35.TMP

Filesize
1KB

MD5
99d362824a6356f16375f6e111363d96

SHA1
0646dcdab30c5d03ec12a2b8bdc61d1246a675da

SHA256
8739bbac3c1ec55b3e22e184a8d9ad10949e1188ae6b29af84a8271f34cfa23b

SHA512
c6bba0b4ddd48d4212f33011ce5a8da623bb406cd3b1d7138e3f4fe6562b64d1ad420f9b22af9dc88b0ea53399b7a9ae7bd423e2eac9ef03dfff1a435a4bbbb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a843045b4edfb0b5825d9fc34ee78aaa

SHA1
61e1e038cad5ea8f2c9f32d491bb1cb66471c006

SHA256
499919647390946f062f61cf1bd100123d5726f5728680a05ec23db77d4a4628

SHA512
3da42616461f5f356a299b0bf2261914d55c7b465a541cf5cea8bd2e5cbdacf0fcabc5daee8a342033bba60ca7bcdcda59f6b1a3aba101f0f72418abadf4a40c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
df960dc8e9726fa5c98d9bda7be330c0

SHA1
0dacef9de523ee98722956604a836c04b3456d17

SHA256
e8dfccc43e6a6099bdcae41774a749b63cb72af91e258e205e20867aad9e3e74

SHA512
81417aede7376a17ef087e677b6d4ab9c9ac232e4ecfa76ce16437d068d226b54e7dbfd991055adc3a0a91fdb7dc4694b27d9428c03b4c8610a60ee6f5bd21a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8ddc2c874affb47074977e898afb7425

SHA1
1c2caa1ebd27b59d75774c2107331e510fb31f2c

SHA256
e3fda2df1ff4b9455bff622ee10088201b72874122ec9e7eadbf052f60b5c35f

SHA512
8d92e024802bac90d6bc20aa00ff1b2ba5cc581b88fdb3803b31704814beb47238451cc534f516b056de7b669ca9b816dc5fde4db09db6fa5abb89ef5d14d3de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fddbe1be207110d4ef996d69c826901e

SHA1
69399fb3350634570474e3b20f334b588007dc59

SHA256
1f7538e6635cc9dbf27010bd70680754e975ef9a77930c8e3b1bbbec49963469

SHA512
87a476f22a28dfea6cb3c32c021edffa50b5a418cc39f21bfc9685bf037fa3bab554e6b778e1c2a2ca5da4312006e501f8dc53f0ebfab2ad15f949fe5bced022

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png.exe

Filesize
194KB

MD5
284cd7c0d9dd12505d48d940aa4d93ad

SHA1
54c3f718c1f7ec7d0683920e5bc57db620f4272e

SHA256
979137f79f9fe8a85889ca31114b2c0eb111cea5b607fbccf29c1ce43ca08694

SHA512
8db807f03054f4aee20483f2a191572fb8f832612581b4b374af47214d8ca2b42e2e6fc61b2f7a287abd6cd899110cf3d157b89e9ba25064f857ae9a2283cd80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png.exe

Filesize
188KB

MD5
b37aa8ea4f13e7327c64e42a2dd63fc0

SHA1
3236b2c1d980a8b85600b8ccf94b5935ef4f2f66

SHA256
7fd2d682809661bc019e4aaadfc9f873d98f756ddb6cee22b9961f67027eecbb

SHA512
f7d398033201c22a8fcda63120ae54a89be861801b2e7542a91e1591eac0c281cb81da1f3295399c73f8cd82ca9e3acf211927c1734265b1e204013ac19e83e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png.exe

Filesize
202KB

MD5
5681bbfa8deb7fc21be9c34e4ff43082

SHA1
9fe8e938c09c627e6792d690ea3f1ce7d1681575

SHA256
705f8fc35bcb3c0935798097da81a20e9f880254f291b0142f92f61836fe82f3

SHA512
70ffc52590e66077b4715bef508fd6be08251b26d868d02a4014669ca77df5faadc92312af096d00a0efca9132f1cf6de3d572a12ab378248bea4033db4a41bf

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
d12e797f18cb79137ad12b5e5139e1b8

SHA1
f15fb437b1be86b714e278ce927b315fa0e16ea3

SHA256
afb0f4a0229174f8118ab512b569fdb9eb3ebb0389cb11c9f4a0a2aa88ec258b

SHA512
f6e8f99bcd0ecff7683c8e56fa2ffa3fdff16d6c17a2066b36bc3d78e2838130b5b23059a239b29a7ebdd0b5ca36b3f9cf388945bf1aad50a3f91cb8091223cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom

Filesize
25KB

MD5
2fc0e096bf2f094cca883de93802abb6

SHA1
a4b51b3b4c645a8c082440a6abbc641c5d4ec986

SHA256
14695f6259685d72bf20db399b419153031fa35277727ab9b2259bf44a8f8ae3

SHA512
7418892efe2f3c2ff245c0b84708922a9374324116a525fa16f7c4bca03b267db123ad7757acf8e0ba15d4ea623908d6a14424088a542125c7a6394970dd8978

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]

Filesize
220KB

MD5
3ed3fb296a477156bc51aba43d825fc0

SHA1
9caa5c658b1a88fee149893d3a00b34a8bb8a1a6

SHA256
1898f2cae1e3824cb0f7fd5368171a33aba179e63501e480b4da9ea05ebf0423

SHA512
dc3d6e409cee4d54f48d1a25912243d07e2f800578c8e0e348ce515a047ecf5fa3089b46284e0956bbced345957a000eecdc082e6f3060971759d70a14c1c97e

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tIEYsUUM.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\DEsAUwwg\BwEUUcos.exe

Filesize
186KB

MD5
3f2696f7a2b1bf5eb2ea2ac9c110ef7f

SHA1
b20842a0cc0ae6bface7641b9c9a83f5aa88a8de

SHA256
f11afbf51a25c5b6a4bbc06de8788d3e7d08edd65a8d189607d906cbd5949490

SHA512
f25c0fdd7926124c3f22c370e4eab1b2b44abcf016635433fccc75ffaabea7ca4dec7223ea6ca831d0b192572c252c9a8cb6dbfafaf936fb669cb1af12d940f9

Download Submit
C:\Users\Admin\Downloads\PolyRansom.zip

Filesize
130KB

MD5
7a5ab2552c085f01a4d3c5f9d7718b99

SHA1
e148ca4cce695c19585b7815936f8e05be22eb77

SHA256
ed8d4bb55444595fabb8172ee24fa2707ab401324f6f4d6b30a3cf04a51212d4

SHA512
33a0fe5830e669d9fafbc6dbe1c8d1bd13730552fba5798530eeb652bb37dcbc614555187e2cfd055f3520e5265fc4b1409de88dccd4ba9fe1e12d3c793ef632

Download Submit
C:\Users\Admin\Downloads\PolyRansom.zip:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Pictures\ProtectRegister.bmp.exe

Filesize
433KB

MD5
a6c7d40fccf4daacd948cd646efcd8b5

SHA1
84f95ca47e3936697ac72129fe925d34f461f6bd

SHA256
8402e46f9e11ef80482937673a6aa9565e51c65dd12a568e42a4ba0fda3ca9d9

SHA512
a23f34049c1b6155048c13e8c6fb073bdda29b2d039a3b4ce6f52c22891c1ce1b3347d6c66355b6032631fed918db1e3a2ca9b74edca71873886753c7ac45bb9

Download Submit
C:\Users\Admin\Pictures\SyncEdit.bmp.exe

Filesize
532KB

MD5
29305c8c8e4425fb17d4be00411d5543

SHA1
18dd9944d3835f05b4d17f194462a69fd75540d7

SHA256
884b7319f026d55a26ccc90f9c150b3136c3b4bbfddea1ef961f36cb85d1c067

SHA512
536bd59183db9e9ec93fd1597780ec0dc24379526533b37a7f62d007548c1b59b80e79e93f3bd577d16879af3ef3f2b22b73c8eb7f523d3c9425721eb2751852

Download Submit
C:\Users\Admin\Pictures\UnlockSync.jpg.exe

Filesize
330KB

MD5
513a3a0911914c2a61655904cddcbdce

SHA1
85b95068ff0385da9ff762f8af4cb2755609ba48

SHA256
efc36437aa6d02b1b95b15a878ab2caf09c12152b00c68877338d1e66e3a7ea0

SHA512
06811c568ec069e8eeadc8464d7d01ae32bcf3d88f04776a8ae83532ac99f63c7437b8bbccfd4b3bd188956d8bfa3fa8399423216faee4f80ec54f73e458b608

Download Submit
C:\Windows\SysWOW64\AUQq.exe

Filesize
182KB

MD5
a5b933174074154a46df43d5996e3e8b

SHA1
9bc65d4e7c6f47cb81dc0e2c4c0cf19856734bb7

SHA256
c79550c1d263286f5f92568fab9c9058032c405142353ce6d88486ac3e6d0bed

SHA512
d38dff4e9312d426502c73ef2d46f7d8694f888b61ff5bf91c465829f7bfe0ea6d9568ab34a7afd7658b649d80779083492c7576332b0c4b60f13ab5f70a1a15

Download Submit
C:\Windows\SysWOW64\AgYa.exe

Filesize
788KB

MD5
e7878fa5f2b10839874342e3ddfc1cb9

SHA1
01614a3e92126e58034c1feb416a28fd09081359

SHA256
e526dd490fa6a60db5a60bd1438ffc1340b5b4a5e163dc799776a6b82bfb3528

SHA512
508b03000cc4de2caaf84e616a60be52872e55dda84b7e4767bc1a572433965caa556a6b86bc3332fcc27944655187554a373357bc16432bc03d47005a57db69

Download Submit
C:\Windows\SysWOW64\AggM.exe

Filesize
627KB

MD5
718bed5706d49d66caee80b04ae7028c

SHA1
4ecafcfaf25a961d260cd88260aa99f67166dfbf

SHA256
5345e2e8ef33f5e6443bd6c914d6cc3325ac4f272046e0edc40d2ed6a0dc0759

SHA512
249ffb0c4a089fb966e8d99b0f491a2b3a505fc7fec463aae56ab9d103054e042dd3acf70f61879784c8d2933fdd9a51ec0b89bf3582aba9bb78ae0373784cf1

Download Submit
C:\Windows\SysWOW64\AsIe.exe

Filesize
310KB

MD5
193f611fe8850c136ee24ac0db3f1eb0

SHA1
67dd9c8b59be0b8e2c6e7a78987ceceac4f6d276

SHA256
32d634ef9d4e8331280e35593d60e0358f6a6421c1a4679f470cd79fb648a1fd

SHA512
97f1371bcf84bd35b9c891cdc9aebdbdc82ea8ac6cc27de69d83cef7edecaf6f2489dcb1fe25510c3b356a44f26a0feb653a24d53a58bb00e91b8eaeb41ccf78

Download Submit
C:\Windows\SysWOW64\CEsq.exe

Filesize
202KB

MD5
80b4fd4dcd9c4074e1b8b897903b9948

SHA1
1799f5658d2f72b3f7209192eb564ca25f3f4e2b

SHA256
599c9213d5cd1b083a7cbf844f70ea4b86173925ff9da94f8c96661108cee630

SHA512
913c797be134da2bb4be382c0ab0fa6c4fafb555517d4ac17658e2d45243df0510d1abb5c6635b9acde0826f95666ef75780456ed1aac8ed4c27ca3f80f65f9f

Download Submit
C:\Windows\SysWOW64\CQIM.exe

Filesize
181KB

MD5
12b2d5a71c81621785ed6a99f6cc29a3

SHA1
c193a8308c5562d5f7bec700ac30f18273ddd81e

SHA256
c48cf97cd2cab3f93eda13d35158c34ee4d48df93d5102b5e554cf7ec2b3ee9f

SHA512
c2b2c75c630269763528be6cf963c9ccbb022188f076cf6bd3b1f329d9c96ee089e8e42c8118bab41d3b6928ce4c982f1665e2e475494a2b7777b92a261b0b46

Download Submit
C:\Windows\SysWOW64\CkYy.exe

Filesize
190KB

MD5
43e6e23f7ffeccd5d71c3c7b13b7de64

SHA1
a5c1539d5d736a10e055777856bab9fc4f8c3362

SHA256
b77a4ea585fa9003febb0d703fa26b746303a36622ab682a6b3a65795232f909

SHA512
8ec1572040167828b7f6a69cc37009a299c089f741e6840ad094c2799ad39e2c7d67d7a5f10740a366dd9adc7632ebf6af9744de0eba899d371781ac2f9ca6a6

Download Submit
C:\Windows\SysWOW64\CwYa.exe

Filesize
203KB

MD5
a5016e3b5fee41f405857cc90e2f791b

SHA1
91f90fc32c84d71439c1ab875c23783d764115c4

SHA256
22467681bbe5b306aa8cca0f9e4469481d1b4647c29b8eb432ccd1c309a9e9b0

SHA512
bba8b4be70ef1c048bb6cc2c4d049208ab3efe6f15fd4312dd7dbbe9cf9a7444ae54a2c40c0bada9fe5c81fafa6205d5fbe15f14f06a2e14305ccfa33630e2b0

Download Submit
C:\Windows\SysWOW64\Cwky.exe

Filesize
191KB

MD5
408f54b449226ae7c7bf3f292dbf2321

SHA1
67d9ec070c367b2ca43b9903536d997f9f62fc1d

SHA256
5cc92f34f221451fa5befb96a96b1abcb0532b40b8a6645a00e2250cd6862e29

SHA512
a92467f7b59bb0c8cf7fc5f74cb81171f87878274c3eb386f13157b2f3c375b7e6fc6e60d64ca864d5682a6d93bf1dfb027d1cb4d50dc4fc6bebddd0b99eb71d

Download Submit
C:\Windows\SysWOW64\Cwwu.exe

Filesize
2.0MB

MD5
b6619437d6870d5c2aa7e1c343f6c56d

SHA1
718fb67f9275ce835439a3723b5ecd4daac28408

SHA256
f78ab192bdebf493dec65df5ee0fe1de8ea1374bbd112f11ddb1e6a3ae3e050f

SHA512
c5c1b42d802f28e5ee571e24e3282ef4f1f6d75f808e861d9c929ff04a46089891c30172a29c43363520d7617bb8ac7c98f12d2629f63da0fc76d0cad71fea29

Download Submit
C:\Windows\SysWOW64\EIsy.exe

Filesize
195KB

MD5
d23dd8afaa28a98bbdbc430fa40b0eae

SHA1
23609968730f8b5b80f9900909cc91cbab1b9a96

SHA256
7b0465a2a7c8a89bba65195f259ed0be6b3a0bea08767b140501548591c7150d

SHA512
83aa9a950a9ae0dda0de78fe090200722e7acfa8ee9fd24674fb1d6d79dad46e61b0f62e0ac0464f8b4bd93505112d74083fe73502ecdb4853c7b9efa579013c

Download Submit
C:\Windows\SysWOW64\EQYq.exe

Filesize
400KB

MD5
ef4657017e6b6b60759d72d53009daab

SHA1
5274eb2622ed58f534f05e2c3d2e4b3597888292

SHA256
f435a230fe9a1a8377b23e851fc61733eadbbc1562882bba776a94c0746916d1

SHA512
0966e9e13901cac4c94f611b44a3215e531e61df81b5ebf7fdb7c972023d82a608c239734ac73ea489842f6b18227ce014076470b39f958f93377359c4fd76f5

Download Submit
C:\Windows\SysWOW64\EcMo.exe

Filesize
200KB

MD5
8635db368357747c7a65b090837fd98f

SHA1
f9a129832a91790c5ebef8df904d45f73f52034d

SHA256
3d24cd40558dcfc3838b91bacb82721a29c97aafd24f5f52edd7852205005823

SHA512
2993779b433e355a38f4c25ca053c1c85f371d69ec192d55e865f16914b5462222c9b3d50182902e1d58b883c001248f94699ad0485842c5ccae316815cdf769

Download Submit
C:\Windows\SysWOW64\GYQM.exe

Filesize
202KB

MD5
cb027d9246275e01aa1fefe8be8ef0ed

SHA1
036225769691ca3ce88b43c6e9a3cb1d182d2360

SHA256
5eeb72355f1d5ee2a50867936f1601797ce1a1f42652ca96c48354a202a376c8

SHA512
e6bd7687694edbce1620f6c806f4e0bd95499b96871246931431f8eb512813596a92edc5ce15539eba7895c6668d6de7c1cd11a19559d6b738749f86eb788984

Download Submit
C:\Windows\SysWOW64\GsoA.exe

Filesize
637KB

MD5
464127ff4376b66b4bf9bcae75a94edf

SHA1
292aa2f746697e5694768fb0b7648ef444154694

SHA256
cd0cd581f51370c376825a1536dc4a0898510921dabebfc99ec389590d9bfffc

SHA512
d5cb9e018c94faafab0fd491a8a217faa99b6aa057e2d52200e744c632cc2606889abb1e1479f3904802c82f3f234db547dbdf01534384bad323b903185ad836

Download Submit
C:\Windows\SysWOW64\IcsM.exe

Filesize
553KB

MD5
754bd5301c442fa3269b1f2488b3c8a3

SHA1
fa5cf0f40703ed6c8e4cd17d73ef2a7d790f7b37

SHA256
371dbaff08dcd6426b80e9b0ca4495fd4a8d9edab003dd456295a145e22bf059

SHA512
9a1dda90689291bc63a590d3be892601b41805acbcb0cef19d38ef8efa45de909d6398be28b94f69692d040ee86bd1175cf3d78529d4c6140671eadc1c8a41f2

Download Submit
C:\Windows\SysWOW64\Iwgs.exe

Filesize
209KB

MD5
f2cd52a3e9c382b9e0fe63e402c06665

SHA1
65388b4231de81513c7868d1c5835306fa05e42a

SHA256
23e94eb336dc4bd6174d6993c480108e06c6b748ff86e8b63bb54eb5a965352f

SHA512
464bf1e3a6bd437913bf53c342b3a01cfa98039efb10f7e6eac70362572d7aa041be48b105ccfa52bacc368e4601acb2054dbc52510e0b2b215935e6a86b22b3

Download Submit
C:\Windows\SysWOW64\KAsk.exe

Filesize
596KB

MD5
4618bbdaac5df61479d42e47794e5e1d

SHA1
94efd4cf126b6149615693cc375ac426ac2215cf

SHA256
caeef3fd1cf13390f9fd8673b41868b97cdacd4e00048a7b874fa19d943b698d

SHA512
7910204c274ece1396010ae3229bbe3f259f72822a18ac1828c09732e1bddc641359636fb324b62d5c4a46b0d663e0d0321a51f798832ee97c446e5af2205ccc

Download Submit
C:\Windows\SysWOW64\KMAe.exe

Filesize
180KB

MD5
0f19b4c8d6901a0e0cb0eefeae4d10e5

SHA1
bedc5162d70cde9822d78fac22c354a73fb44881

SHA256
3d7008c660bd2db4a5ac113bc28eb765dfba1e5f02eed2612ef6d820b542288d

SHA512
65eb7b3ec055135f677c53b24834724477c28d853eb37c8ea2ac71f2d21bc59503aa028db9cc9b77a64c3004b2bdbc90424dd40e97f990aae3c83886cdcd3606

Download Submit
C:\Windows\SysWOW64\KUcs.exe

Filesize
197KB

MD5
133982158bc2862728fabeef8b7fc426

SHA1
eba50f66094733e641fb842c1163025dd12f47b0

SHA256
0d0ce754882fa5cd63ce0875c2698f0d17e61138aee16858866524d7652cd0a8

SHA512
fd0de4575a8b0b6d80b8148a50a2ff67634d45a6a95c99b6da9fc04dc8773e1b6b21a4f637a5c4d756b9c5da3fdd584e254907a954a874ec85148f42f2ff9ca6

Download Submit
C:\Windows\SysWOW64\KYck.exe

Filesize
205KB

MD5
c7c19b7b8c45484053d2b7c5b7d5bc28

SHA1
0a513ccd58197183fac93a8f60352135a1fa338d

SHA256
86eb1d851835aa19c572bc1245371a193596c78b283f62666cc97b20dbe3be88

SHA512
c9850c0364c1c10d320e7ad440302a9eebd15f0bfb3cc991eba18ff8760bf473b8b8a3a40f553c1b74c75eaefc82fd6df09800a77577fbacce1ecebabc9a6062

Download Submit
C:\Windows\SysWOW64\MIcq.exe

Filesize
204KB

MD5
0983df826d11fe5893d67d756fedd2d7

SHA1
31a3b2aaf5426e092049e225064a8f963b102c17

SHA256
21e22c4fc9fb009226b68aeabcff371de6f7dba8777ddbcade5200ed6bf93996

SHA512
80ac460b0ca10d17986e61fc68446d503876dcf455841041cd25fc1073776613f1e876009aa194705107509090431b35ad25a3cf0f68a224157b78ea0971a6d0

Download Submit
C:\Windows\SysWOW64\Msoa.exe

Filesize
194KB

MD5
ec5205b8084f8a87eef8e56622cefcfe

SHA1
e4a440250a2ba2d8d46274584cdde4592194cf33

SHA256
6d59af022af61e5f9dea939f29746133961a75e6c142e038870b403c4fd260bb

SHA512
24fdaf704323aeb7aaa077f87827942d24b9097c3b4cb418308257363957aeff8510b8a47004a953247132843df8e2e99f728a74f7273b3c84a0a1c5770bd68d

Download Submit
C:\Windows\SysWOW64\Oksy.exe

Filesize
210KB

MD5
be357b4fbe9e6e941e36ea9d7d9a1ccc

SHA1
6b9444c32985a2a4644da7553476abf541165ce4

SHA256
67a83aec8bc5f9ba4c9c7ee16cfbbae5e210b6a407f1ce7bf0f1046caed0a943

SHA512
5e0168746a7eac8a388ebd138b3b57d62b7aacaa6f9b0fda114bd1b4ce158f777174e81250cd8795e7c7fa4a03ee2f5132abb0a4cd0b9bdcc7428f915c26cd2f

Download Submit
C:\Windows\SysWOW64\QwgQ.exe

Filesize
518KB

MD5
a975e34dec45af229fb5bdf5e6eb8daa

SHA1
29d1e8c946452a3863e5b55db38c6c998a8e7303

SHA256
123ffe1fe5d62a55cf5ad171eb5999f1877887796272dfe86f11e35f20b1fbf5

SHA512
60cc7003336f95001e67cf8a9e8c1497c3c72e9fe826f638eee49f90529edeef80447d4f56a2e184d7ec8c7e9afa7736dc9761193814d956409cecc702d576c9

Download Submit
C:\Windows\SysWOW64\SEME.exe

Filesize
824KB

MD5
90e4262bad1a6a8345cabeab5adad581

SHA1
947c6b093a000e69c5f79a079cf660610f19612e

SHA256
2f2687f57d5f5b7b0b3ef731be3cee481f37134266e13a55e318a976d4725443

SHA512
b8dc33a09943442d2ea19274391e4c7d26f5c964e059e59bf10801e2eba284e6cc958209a18c0100cd2e9eb650ce268b9959eeeb70f66e896f4090c240ccee53

Download Submit
C:\Windows\SysWOW64\SEMk.exe

Filesize
228KB

MD5
946c08f483e8edf3200fc1910247b311

SHA1
1912215ce302be76cf0dcf8e9e00d16f7e4d8298

SHA256
d2d38a90f1f0046a999e1628645beac4eeacf40d18b16d1b58bec3f03358fd02

SHA512
8c17378e6a00b62045f63d0480336b0dd0933f791d55bce57648120452736faa0547991ab96596f23001a21beaf8680a653723c8f8506c3b5d26acd6664a0b34

Download Submit
C:\Windows\SysWOW64\SEwM.ico

Filesize
4KB

MD5
34460862c89281546603585eba87f992

SHA1
c00e6558b839be12b54316e87116042454cccbd2

SHA256
bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620

SHA512
b21fbe3ba5b0a15dfe6d5797dd72fdfed7798748b1acc8846251ff1f58e164380a0bb2ff40a110f2b86fc6ba76abbb8cbe7a148eff697ef39a5dc4d1448bfe67

Download Submit
C:\Windows\SysWOW64\SIUc.exe

Filesize
686KB

MD5
c039124c641e1584cc6364c09cd010a1

SHA1
b869c8cd5cd1f7ef1d13c0042ae89179dc37f47f

SHA256
4df31ae7f486e7ab31330487d0dc45da267d766464968921d2975d9266cb369b

SHA512
0b4b68777d1c9e827c697d19cb40220a8825e306b07eba4b649336a711294c9c213dc18240e4637ddf8e44fe24c56fbeccde3ead7dfc8193a9c4a04617312416

Download Submit
C:\Windows\SysWOW64\SMAw.exe

Filesize
203KB

MD5
81f22658200cec700ddbe2504ebb6fd5

SHA1
e52eb2ce7b9a55c51c22bf08c56988c6e1a49773

SHA256
3addfa7165acd6f9b8b67ff22cfc2a14432a07b1b32fefd402443b8a427f229a

SHA512
04b98d24bb2b6f8bdc105456315e63488d88e7cea80c6314c28ef6d081b0282d8175c0dc38386529f4146574bda90f79f673538ff47614ecbf8452c92f26ff48

Download Submit
C:\Windows\SysWOW64\SUoE.exe

Filesize
209KB

MD5
074b079e422e217fb919e4281b665986

SHA1
61f28e00ad7863ff5e285fdcb6e0fe16dca2b918

SHA256
a7f4eaaca6777aa4d7d1d2ec383a81435a8d5bf7395f970ec0bf3d5448a55c15

SHA512
69ff0fd43fbb0f5425783bae4d0e4943e3d627d2e70fba56fa8f28b10f9893386f77a6318b3f5650fffd6053a9e6f1deff71cd8f1013b986c576de38a2540fd9

Download Submit
C:\Windows\SysWOW64\SogW.exe

Filesize
315KB

MD5
c25f68835056da9d552290d06cccd311

SHA1
bbde8e0e634f8accbd9ea04b3853c47f5c6af9be

SHA256
4f3fa7d0f3451ab7704871d085187ab2c6ed6ada62d2926f5d66a35bebb0ebe9

SHA512
3121f7b5f6d9c0b4fc6f4b3c0924303ced5cc4a531d419b1d78bbc5d7f0bfc42b5589be33760b7fb03f45a6f8c7afae5d48f0ce300011a74741993e2d9f07493

Download Submit
C:\Windows\SysWOW64\SwAa.exe

Filesize
822KB

MD5
ac2c0b6faca4224043f928ff401d1bf2

SHA1
64e4dc4e150dc0161e184bce29c57a3830cfd4ae

SHA256
c3e02d1847eb602df481b6cc534fa79dc5cd3ec280786f0f1b30468df742c3bb

SHA512
3c0f67665b3458594ae939a73e5034f2ccb44e34d782c82ca82bfb3e99d03174d38a8ce77fe1b92bd6ac34696f6cce71b5dfe79533eb3567ff5c04a8dbad77bf

Download Submit
C:\Windows\SysWOW64\UEQW.exe

Filesize
647KB

MD5
ee867a19514501303ed2134e6349f1d7

SHA1
a7538a9c4257c65a36ef422d7eb23410749cdd0d

SHA256
7094b62e3a1e137470a01b7cb133f79cf606a7bcca2466465d3f3cee47eda9cd

SHA512
0248f6c828a50e18b406919e057e6354ff572c8b3c96fe9008156874ee4b174c8bb3ed915862549c0a40b3ec526d3512e2812261e6db8578ca42e09548c9696a

Download Submit
C:\Windows\SysWOW64\UUIG.exe

Filesize
203KB

MD5
fbd5a7d09786138ff4ae941118c3a753

SHA1
37b15a2ff1178a6ab7769a63dceb69dae1c294af

SHA256
d09449f31f1c402e185999efd01ea9e852f7206ade3d48c2d7ab8d86682fcfbd

SHA512
a762e2ad262bdfd127f7b7df2781efa77690787c099f971e3bd0dd1108de9b9b522a031f20a05b91f2e30fa6504a1082b27f380c22fd53c4389440837086d3e2

Download Submit
C:\Windows\SysWOW64\UoYk.exe

Filesize
192KB

MD5
b66071346e95614293ec330ae7179dcd

SHA1
6645ec51c0b0416b6b082fce563c643af553e22e

SHA256
b1edad1d1e9c53f3e1bc438d26e6a13a0ddba93a07d172a94ee796f6c0d3ab1d

SHA512
04e98cd07096c19e33d88d0e8b83f1d7eb3d6ce2b7f7318240af4a94af9dff72542d04dc36ebd3fb6deb6e0383e859e83272c5d7a366bff534df07f43bc0fc1b

Download Submit
C:\Windows\SysWOW64\UsEW.ico

Filesize
4KB

MD5
9af98ac11e0ef05c4c1b9f50e0764888

SHA1
0b15f3f188a4d2e6daec528802f291805fad3f58

SHA256
c3d81c0590da8903a57fb655949bf75919e678a2ef9e373105737cf2c6819e62

SHA512
35217ccd4c48a4468612dd284b8b235ec6b2b42b3148fa506d982870e397569d27fcd443c82f33b1f7f04c5a45de5bf455351425dae5788774e0654d16c9c7e1

Download Submit
C:\Windows\SysWOW64\UwgQ.exe

Filesize
192KB

MD5
d25d706c756f2f81d27d6c9967987ef2

SHA1
cacdf8779f6ad090e8f9b3170794ea15672440aa

SHA256
65969003cc729d9852088207d1314b536ba9507fe0b0a21dbaae7a8f1e1b88c1

SHA512
74f1fe028ecb5cb303b6e639fd7d803fc8bc87441403f35a335b342cec9ad25a15f5ac5829b91b7d87e0e2363fc42a04aebf5eddeae640fab3b8085b5a553499

Download Submit
C:\Windows\SysWOW64\WgoS.exe

Filesize
205KB

MD5
0a1c360532b53de118ea558dd7cff4f5

SHA1
f712c9e762442bf811d69d53472a318153705fff

SHA256
255946a4e037f61c0bfdc3c13aa0f88bad68585d28d2410e2e3dc12c13e1cbff

SHA512
e48e65c88fb1d8808b6598cc9f3a7c61644c8d6cfafca48293825a861ab6c4a1b231ead0c1a6df70acfb589005a5fb776675cac73d9934e82d047f2b3610a5ec

Download Submit
C:\Windows\SysWOW64\Wksy.exe

Filesize
728KB

MD5
d7857776a845ad675b7adf5f7767d7b1

SHA1
2469d2d1662450d0f849c85fe902feda48fedcb9

SHA256
dddc53f42c4ca641efc5bea7c31ecba2572c25d257b518977964be99de21ffe7

SHA512
379a605eeb1480adec543fd16bc7596ec99b982746beb68a3ab0219ae49fa7dc8a97567088b3f0773fd8c719c5e9fd68bbc5a3d7c4d2f58ff21147bd2d00bd31

Download Submit
C:\Windows\SysWOW64\WoUC.exe

Filesize
625KB

MD5
298880a6f54b0ef41dca82e2f0c439db

SHA1
95f1a4105a304a9a136afeb65fab6b06b900932d

SHA256
b448d279a8a35d49457bedad88d4d13dca75a064c3daa7cc056b6fe059956b14

SHA512
9b8e78f072aaa845842a05bb42a3f615e059c84f609e7b01b597b323d0b8e2891a8b36aa6c10e7609ea9224adee3eb7d3de34942e9f9cc184886eab488198821

Download Submit
C:\Windows\SysWOW64\WsEs.exe

Filesize
213KB

MD5
be67b6d06d5f6da23829e077aea57d2b

SHA1
45e3015e6bb2790964bb465e6dda56ecbde0d8f6

SHA256
573edfa4883d226d3822039302d154531e7d10d4e5953b5196a58913d7cd0c84

SHA512
d95d04904b21dbfa14b28f8730b1f3c29ecb7250fb65e4982446e091e923ff491042f6c2cd831072250a99d972ae649cd902c99aa91623ddf900f5f16efd0fea

Download Submit
C:\Windows\SysWOW64\YEsA.exe

Filesize
245KB

MD5
83193192efff6a6e9394033bc828c552

SHA1
aa83a92a0f3054126fa2dc585fbda0cb0b2adca2

SHA256
7e63ab84de82d07b59a5af331852108e71226f1ecbd8458c962cc9dda2888543

SHA512
538925ea1059fba6d967d272bebe2890b7445e97e2886184f1c4c61b13f8133ae1acff337f47095be9dcd46064ebfa7b3572ea730a599a1cba9c5781bfbbbd99

Download Submit
C:\Windows\SysWOW64\aAko.exe

Filesize
183KB

MD5
a38c3a33cd9e14cc880ee9ab704c41eb

SHA1
a11a8d4ef2aecabc3f4f9fdf5c5c8f3c456264a5

SHA256
f744b39fba9993ec062cf7a225e70202df8d20b637900388b4b4fc3f0ed166a0

SHA512
bdff540f89e5d998937c842c8d4fa470cc345c41573777d0610b9393fccb912cfcd396e08aecb11219495aa3adc07dbe0bb1c8d7af2c9225176f46035d418631

Download Submit
C:\Windows\SysWOW64\aYwa.exe

Filesize
1.2MB

MD5
8eb4790c10bc6dc60ee5842e3b9c55e4

SHA1
9b40302015a11994c03bb04dd2f9ae645f50d5db

SHA256
aa62257be023e1e7219167b01123bcc9efec199f7723e85634a593e400610756

SHA512
3db690a07c03bccacd93d9e039118f4cdca02b17d5493e0ba90c182910367e50c14066f44bb223330e338732147817771e1495d3c46eaf9f6d5459c04ca5c523

Download Submit
C:\Windows\SysWOW64\assM.exe

Filesize
661KB

MD5
23d5a09048bc615a2fe66efffca266e0

SHA1
d94a37dd998b74e4609ae1af94ec68ebe5d9d422

SHA256
0e6f9d99e0d3c699054cb92a21a6cfa0552f96cdfc9cfd8ed38795b076781b31

SHA512
3aeb1dfb07013e94a1361aa4086b276513c0fcc0049e2bcce505a888df683a281b06c01890a38f91f53b9bde42d32fde71a90cceb69dfa9c0074d9d1b3f93a09

Download Submit
C:\Windows\SysWOW64\awMI.exe

Filesize
185KB

MD5
d1f0de865fdf9c9118d312e228243a07

SHA1
a463b284f1884b6d2cb4bf1f4cac3c17b3f6c121

SHA256
a66fc117ab0f086f16290d571074755d42e1b656e6ab7d7db55a3d6413e9eedb

SHA512
1722ac37b96cf1efabc92fb5837e2e663ff4b1ebcb3381df00b4e5e4652889285c36baafd9656c68360f4213e8cc9cae6ecbd6bb324fde42d0e3e6763ae2691e

Download Submit
C:\Windows\SysWOW64\awwO.exe

Filesize
186KB

MD5
8ebd144f6f160000d46158cc5c8d339a

SHA1
9e7a42d94d5f5674fa8542452c9283cdaba41e71

SHA256
e519291565a3a1487c900785eb7c06a146440a634245ed20be97709c578a7a07

SHA512
1b0632c06c3af740fe0ffd22950bf7bc59d2831a51451d985345a6ff36447ad166e6f32ab61a0054634079f90a8fd99dcb54e7a0aa186fb78cfb157b3bbe9f29

Download Submit
C:\Windows\SysWOW64\cUMk.exe

Filesize
305KB

MD5
3c0894bbefc0d807e5945156ce22df2d

SHA1
4248996c523990847b25b1db08c4c7d9f1a7cc01

SHA256
2d50e91c86cac1ea5092519ddced3a7d98f1601fc7757db4e610981e42d051ba

SHA512
efb27190622df4ed30665a359b918e00f6c0c807456b9b6cd7714018f7e5ecc7f676eff8a8681360efa8c0cf0ff63828304a01d91811c47cf2eff34d6f6863e7

Download Submit
C:\Windows\SysWOW64\cUUS.exe

Filesize
203KB

MD5
ea50ace5461449b2211b3ac28b43d0ac

SHA1
4f588b94ac8f2b1ac9546266794c05b4f7b3fd9b

SHA256
bfbc61a6e00d76c78ddd6dfef783c32363ed2103290f92caeacc2dfa84e53e99

SHA512
3a4f6f4b5678e64d2834e9166a2d4ca160b865c9162c869617d604ed9bfd39604ad2568f10e81f576e207d3c2ef4e4b5d906e8c2c9ba410829598ae4c1af1540

Download Submit
C:\Windows\SysWOW64\cYkG.exe

Filesize
206KB

MD5
0ebf2f111a71213256afa4b0c2f9905f

SHA1
c6a05b2f226679a0bba4dab2f055c2945c789990

SHA256
4de9b7537588774f600ce195c5fde277cf860bbc15f5f2c120ac7f95ba42e160

SHA512
f4727307eec8568a425025919569c81128df2fad4700d62401ad2d5d6ed1036c66a4a45b91b165cd72e6938800c60094a00064ab8b6e30a550a666a7e56c7c76

Download Submit
C:\Windows\SysWOW64\cccu.exe

Filesize
403KB

MD5
3079f212c93137cdf91c956080e8514a

SHA1
f2c5220196e3ff843406d7a30c15120a544bd2f4

SHA256
9ef958f156cc703379e4a64913e6bcd172450d2b9eb1c8f616fa797ad68fe9de

SHA512
36007258d36fb9ee075538ccae938a03ddc0e5f218c2096c664f289deb8364a1cb0023e604654176e00c9e35327b6243f0339d00c664a5dd9296352c21f623ed

Download Submit
C:\Windows\SysWOW64\cgwU.exe

Filesize
215KB

MD5
eea38343866bacd73323b7a74f827895

SHA1
67764279047d94a9e5b2235753f16f33e3320c7c

SHA256
b700c6b50b93dcd2e91d66281666e52d6684edf9b9047574937d88ea5b2d2bde

SHA512
f4616cfa9c44acafa8908502726d2083a090c853fd93c89561e5ebfc2a6ec46a812e69c9e07c7bb5298cfc856c9ea1e760747d988f7f0ef7839e77c2f37fc64b

Download Submit
C:\Windows\SysWOW64\cwIg.exe

Filesize
192KB

MD5
7cde9cd128e010d39eaace3052a93282

SHA1
21df28baf92b36b87e4f25037a708f10b2cc6e20

SHA256
e088aed415812878a139f52b7978ac8db089c0ae6941b0a60d3823892e10e24c

SHA512
907381de947b155436b638f213ea49f1902834c8c9b187d72958541bbe62a2e139378338e365ddab8b1d25f6dab404eb9581a2e91cff166c98048d33e15974aa

Download Submit
C:\Windows\SysWOW64\eEsK.exe

Filesize
198KB

MD5
63a4479231e480a3902375fe244deb1f

SHA1
8bc0edd5558bec2ada8f38d7514f9a221bbaf116

SHA256
e1b9ca4f6de1db0a56bb32cbdf85bed7676f1351e7229b053722a52212c23b56

SHA512
b2816cadc6054e75ab1e0dd11874ae7d6d336b962ef5ab323bad496bc1783c71eaaa33ad6bedd9f8b3a4b9f4c935647ac68227c70a2a2ba5bf50f7a22b9186a6

Download Submit
C:\Windows\SysWOW64\eUQA.exe

Filesize
1.7MB

MD5
88d0b9bb7bd9471bbd721de32c7d4046

SHA1
227aae75d6249ef327a6c5718898bfac826d6b28

SHA256
a4c22144c921186ee672acf783287a236416b78734b6d09c93ee6a2197b735cc

SHA512
32e0121010e17e61635b4a65bd77f144e4a7f938201750cbbed81c28a92791f50b4fc58f97edc6a4c32c7eab13277a7101b2baaa9fee60f57158efb2e423a9b1

Download Submit
C:\Windows\SysWOW64\egAK.exe

Filesize
200KB

MD5
6031912498584db7506841b6222258cc

SHA1
fdaf3902b5debd82381cc0eadb1d0df2c6e3ea98

SHA256
b0430d30c02d365cf5c93768d227855e015d7904843f4635d75f288ca435584b

SHA512
e267d76a823d10966504d6d2fb2c0755093bd750ab61aeb2c2eafd89b529fb22b25a669e6750dce6407d66d76b583acea22a435fc84e578397cfe923d68ca8d7

Download Submit
C:\Windows\SysWOW64\esEM.exe

Filesize
187KB

MD5
b5f2707c0c4b730c5b043869cdc09091

SHA1
226f8e9b531784f5763096614978f29042055d31

SHA256
302d7c8bc85d8d535336fe88f8acf6545c1f41474a2275710f9db9211dafc0e6

SHA512
5f5f0abae65932274076763525a7d2bfbdaf257b34ff9043201ec3cae0173c5f548d3dbe5f37fc80c37817906251b3d2e65eef75f45edaeef47e3d121d7352c4

Download Submit
C:\Windows\SysWOW64\ewks.ico

Filesize
4KB

MD5
ac4b56cc5c5e71c3bb226181418fd891

SHA1
e62149df7a7d31a7777cae68822e4d0eaba2199d

SHA256
701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3

SHA512
a8136ef9245c8a03a155d831ed9b9d5b126f160cdf3da3214850305d726d5d511145e0c83b817ca1ac7b10abccb47729624867d48fede0c46da06f4ac50cf998

Download Submit
C:\Windows\SysWOW64\gEIM.exe

Filesize
698KB

MD5
c70734548174f9922b8070450c336163

SHA1
3482e3deb9fd5cedb27dde452ac6c83afe0c86b9

SHA256
81d76f2775a6d0062a3801d0c7fa26aae044a79deba285f9c164435c24679168

SHA512
ea28c46ce9d3ff7b77163a0d4f82560167c3b2a96814fbd2ba014ecaa2c2c9c1d7d530f81a75234f79e448923ca3842c5ef538fa6d551081609a0b159a9f7137

Download Submit
C:\Windows\SysWOW64\gIQU.exe

Filesize
229KB

MD5
0466bde7f13a9f43f7af4682c99ec400

SHA1
e6a688633786d0c0546b41d96f5a5552fdb4733d

SHA256
fbe6f472f5437f552e0370ebd90dfafd0af3cdec45e88f2ba993cbeadd2fc732

SHA512
acc9f351b30df8f645496530aaf0d5f3d9044d8e163077784ec234a1b5d156dc56a600bf9702750ab2d823fd57a2ad8b15655f74cfc7d3affcd37b1201d24c77

Download Submit
C:\Windows\SysWOW64\gIYa.exe

Filesize
195KB

MD5
88e8d9538d605b9a853c795508c00764

SHA1
1804d23388d8db3e89144d977811886405f47fe2

SHA256
9cc6e8742e5cc8110dd3c7f7aaaac65d3d7d04cffea0ba93a0816c20dcacdeb5

SHA512
5c5519e62e2c262989a2c5fa35cc28febdd36c68fe51304ef5dd056910c354a168436093fd73700cdc7c9dbae4368ab933feea008114930e30e48c0520843c13

Download Submit
C:\Windows\SysWOW64\gkga.exe

Filesize
188KB

MD5
f1e97c8de332ec57dcba20dc803552b0

SHA1
2a8df7b26771d27cde4e89794aa523a1e796f191

SHA256
165231629423143d34e52c1e293d19d40e7a30205850813b1552d903b8e82e10

SHA512
a0490cabed79687a2b5779651c544a264ccfcd7ba946d6bcef109549746f8041828182d9b1a49c24fd82b661f9cc4e390af0ab0abd577d1dd5f01cac1a90bccb

Download Submit
C:\Windows\SysWOW64\gwky.exe

Filesize
565KB

MD5
d84724c9f8f1c1b148eb4321e567b2a8

SHA1
94dc03630324e007434cab44d62e43f41682d7d9

SHA256
69f1b7a4d34f8530c69a712e0411c16f504e0b7f05a2f7747b73a50a193b4767

SHA512
487a64a22b7ad5d40509dac26695cc6e4f1418211ce3eeddec22c7bb6b54737ff80618ad1eca451de760ceffe264f049c6d0cfb4801e82b20bf45b07cab7bc57

Download Submit
C:\Windows\SysWOW64\iIwS.exe

Filesize
190KB

MD5
b63beea1c0d1f7ef5b0dbbcd6a00e1af

SHA1
92b0cddae9dd82c993e784b743d7efce7b880289

SHA256
e7f7f24173b18132125f3e71ebcf53ebfb9c1171cf5700993b26d58820a7f7db

SHA512
3f5be599bb0f467e40307fb7c03dab95d0d4f59a7930ab0d879b261547051987325286c5c7937821ca1454d0d4debd62541f60d7cc6a5e5bc551148ca0f5f25e

Download Submit
C:\Windows\SysWOW64\iQYm.exe

Filesize
193KB

MD5
7f7daff590d480d5b1f7e5f5a94bfbb4

SHA1
6416df2858cc78cc62aef4c89f61f5db10bd0972

SHA256
f886ebdc066370ad4024d9a00c40537807090fe570bede6f8753b4d115d071a6

SHA512
d5078fc9f2741f81d6dde2569d86bf19a195860b028af22e174f56a6c3c4c3ab8731b726af0b1c4cc3ee33606c707f707d9ee25bdf2df5bb693ca9046695f4c2

Download Submit
C:\Windows\SysWOW64\iosO.exe

Filesize
186KB

MD5
42e67f4a74607b035ebeda14a9872dbc

SHA1
c2ea28e29d6a8d3be46ff4df1d2e6b369faf2422

SHA256
54ddb7170e7729619fae2ddbb0a7da975382b1bd313e12784a5de1cf2e522982

SHA512
6239e4e6996ca34bba77a056b9a314dd4a8213efad07437a34a14cd31830dee9ca171ba3442c20f9501fc7d6874ced0f685aab8f746095aed4825537ca3b948d

Download Submit
C:\Windows\SysWOW64\iwYS.exe

Filesize
797KB

MD5
f14c2af88e781f0abdfe35ff263d9129

SHA1
f8922bd614062b359b07bf50622331d3a9ac2531

SHA256
4b786ab8897934032ecee12c4e1279a26e134b38d8366441aa291f2875fceee4

SHA512
fcaf8e6ef07b07e3906c8129c5cd39c562019987e1dc1312372d29dce982d179cda1abac2f4d398bae9437533c71aa320080d54dd6f61c677ed1f3b1ad1f509c

Download Submit
C:\Windows\SysWOW64\kIck.exe

Filesize
199KB

MD5
f62676a7c97f9134102d31a8eaed0f9c

SHA1
7e6941004bfd1e053da0d93e1fc7c33cccfb8bd5

SHA256
cd26c26191e72ddd168735f506d7775b5b570789f1ce9b2e3261c77f815e7c62

SHA512
75affbeb3c2313fdbeac6e18ba971384d12cd0ced621d427feb8775355561a930ff27d6485e94ebd723ad7c023c1ee30989e471961e007585492989aaf4a7094

Download Submit
C:\Windows\SysWOW64\kYUy.exe

Filesize
189KB

MD5
03aa7a88160c9cad174b3e31237b689e

SHA1
eaef530b5334a8673e1a59b2555a3be10fc7f728

SHA256
bb88b0d14f8ceb6561e40e7de6ae3aa16a7718a5b7e6068d72cc13924911fc29

SHA512
2a88ffc7e052c4ea6c9a691e0939d44021a2069ef35966b766b650e7a9cec385b0ab28ea7ab28ec8bbe476c433963b8822d5d42038b56afe2767c63af62de70c

Download Submit
C:\Windows\SysWOW64\kcwe.exe

Filesize
193KB

MD5
37f4235da094ffca20162900a7eead55

SHA1
af4f2c4f75cabb3e97809e1010d55eccc0627767

SHA256
70d42357fd307b04c434055f053828fa203979c3d2162b3f792b78c18171569e

SHA512
55bef3f6a3377d9e37e7130458d6dc11544d3adcbc7d86e85dd6b43fcb235d86fe90772576f5f4f8dd28323f857c7aef332b0938335734429bbdc2b2f42e0200

Download Submit
C:\Windows\SysWOW64\mAkA.exe

Filesize
206KB

MD5
a8a17c878783c6d3906900fc828a5b8c

SHA1
a39d40318a75e535cb18833f7b638eb5a4691cb5

SHA256
edbf072a997e2965a5e344739c52f9e5071440cb4adab49da481dba95cdbc792

SHA512
d6d045ee1e73f5d18a0e7cddeb202499d005dc35728070459e13db1117d0790897134d6ecbfbf199992ca19c5c6c1906afce6675926fe69b665bb812873f513f

Download Submit
C:\Windows\SysWOW64\mUgA.exe

Filesize
206KB

MD5
4886dd0dfcfc4e04c5b757622904998d

SHA1
6d292a1ac59abb458a4c9f3ebc0afb1bb68c6961

SHA256
a15ddcc90cdffeade3e9b78d079fbdf8badcc846b9b36c581c04aa0cbf70f0a1

SHA512
ade5f0580324cc4287212559e9c3bb29b6b5b4e9bf2a0613767a7d2f3bb13a4cdbc54e75c3ecc968565e0bae819c0e85ab56c99d464ec0e05a08158ae7c5caba

Download Submit
C:\Windows\SysWOW64\mYIQ.exe

Filesize
476KB

MD5
6dac73541d85197a264681ba374f38b7

SHA1
8018dc2d9e6e72faa3b2d50a33aaef9853cf6981

SHA256
0db2d7e3f8654bda48ac1b3ed4833575cdbd03b13091e1296902439c4df13069

SHA512
41e7c8f35cdb9ee2df9daf8dd4ce402853b4d7bc569cd6757bed6bf77942ca39ce423ed0fc6fbb9487bcdca6b5611f4c43fe07ed29643eb3ca77bbef4b10cf65

Download Submit
C:\Windows\SysWOW64\moMg.exe

Filesize
348KB

MD5
6d47b94dd00ffa70e6579f9619024fcd

SHA1
3ce9d31a51883c7775fab9ab72ec1ed8b0492619

SHA256
8f20717ef6ed110e014e90523b3f542383356ac38a068aed7faff0160f88d60e

SHA512
a546055192d3b8bf437c9b9a0b9f24c08a83b0653ddc6a15e563138e4b2fc51fc23b95e3b700ae346c08d563b40ba7f84335cd8ac7d86acd1599338c2e20480e

Download Submit
C:\Windows\SysWOW64\moce.exe

Filesize
210KB

MD5
acb89c8c4f09718957531413b3711008

SHA1
64eaf019baa4e1ebb328f1bd937666acf61d5ee0

SHA256
ec8fbe11a22a801720792338f13f2c0a116662986555cc7f5f2a58350287fcac

SHA512
dae786c453d1fd4e8af2af4128e6fdbe93c64ba475bd876b0fff83c5e460347fdbea09c8a84d713c72e44f3933bd89aafb9f56ec77ec665fe70cb4331afddd31

Download Submit
C:\Windows\SysWOW64\msgK.exe

Filesize
201KB

MD5
d491b25a2338d776ce66efb504d0b5c1

SHA1
325e6a246bde99565fc1a8e4fc77bfe9b835b610

SHA256
c093bc5f8409e44c6401b49917451466b186942772c25ee15d4f54e7da557202

SHA512
6a100ac3dc1459acf8f193d638896647cc2bae985842026c1790579969de124c7780a8ca4846112410c5e1f499123d51b9f8092180f5c1fabf96f2025c39e172

Download Submit
C:\Windows\SysWOW64\oEUy.exe

Filesize
223KB

MD5
6bd3b1a8f7afd875e31b89ae884a7271

SHA1
305f64b63d27e05bcd411f9061e8c8c439466a8d

SHA256
274d6b8c8c6f0d9153fc85fbd1af091e4b39a9c4907fbe105e7ee934c4ce61a6

SHA512
357f7341389a652a25da0b89d4aa86d322ad4549c81227059dcf9cb9e0312f4d430d127c566f022b62e4e364ab78a342582f2a690ce0f79654a3c7cf1d111972

Download Submit
C:\Windows\SysWOW64\oMEo.exe

Filesize
421KB

MD5
dedf91a5412e59a446b10ac93d2c7d2a

SHA1
1a115b6f9a06fdbd24af4df8dff2c01239218747

SHA256
f67118be1f03cbdc9236e3d8254a924f3845da6b6637d8bc63a78b01ef18dffd

SHA512
79a8e7883900c82a35436171e631a930001347a476882e4c61ac2ef29019bc2f7dd20711fa65fd12784f9462c0a1892fbad1f59c8414b64d31ddb566234d9ae7

Download Submit
C:\Windows\SysWOW64\oQgW.exe

Filesize
316KB

MD5
001883c1c6443e09a780a4af20f32412

SHA1
8601741dfbcf15073ff0944bda269c042d28d575

SHA256
cb770ed63b46d919e2b351031f3f3cf50f33e79c830fb0bc6a3a649863a615cb

SHA512
3bb54dc275a068aa2d9ab59b732094df68067b2c25d73276a0769b3750c7b70dbec1ea06e16178722796f174807e01ee915ca7e9ca8eecde973ff1b54aa52f99

Download Submit
C:\Windows\SysWOW64\oUcI.exe

Filesize
182KB

MD5
2ecd9fab8be0b26f9700f1708c89eb49

SHA1
9c60ed48a6eb59dff0e42de56220c886f90d3c0c

SHA256
d1f1fa48c6e3712ecb7585394cb8e8d47056590d3ee0796bd07f4da97ae20682

SHA512
5e43bebbaf3c9fdbe7e2fbfe62d2c404518b951bf0add1fb67b24424569e2c0f0fc1f4b80d5a3177dc6a2851ecf359fc94e3ac4d8950cc36477d8eb9358901e8

Download Submit
C:\Windows\SysWOW64\owIO.exe

Filesize
243KB

MD5
b00fdb7282b16eba8b1e21db7c018d24

SHA1
50a6b0dac340428f053d1e4ed03804de452ce8bb

SHA256
905f79f7f50c6f5ccbf9fa563338ed9ae274cc40c458a7c424d7152368759da7

SHA512
5869b5e24d02c326ea832b66fff4acf73269df8b24934b223e60938cdb381cef9079d20ab9570f35fd314828df268ebd8d1a5773ca5934e176f600b425295103

Download Submit
C:\Windows\SysWOW64\qIAi.exe

Filesize
182KB

MD5
d1c3a39dccef438c79a17abace412a7f

SHA1
f09a0d553c4769261da584d3d99b332a16d01ec1

SHA256
2e3d3287c307db60b2a77ba1c5ed75233a55088e87787786d6fe4cc5ee4eba62

SHA512
bb6ff546762fbf6190d11dca188ae40df47257220f5e633ee47741740cf4c8222cedea3b538c4c74c8d9e624d911db48584d0630a116bd13690330d3e16c4ff9

Download Submit
C:\Windows\SysWOW64\qMMg.exe

Filesize
647KB

MD5
e03362d5e87fce48ebb96b13993b70f5

SHA1
24a673b63280d8382b5c96d012ad5930294285dc

SHA256
299a80075d431160c982c75268407b61b40b1ac713e6d2fee56266d04dd773cb

SHA512
6b509ac9402a3e4c96cd33dc064c02cae40b9bd486ad225f996c9a39ff6731d367dd59100d0e9db811031da40eed712680a20ff745275006a46dd5e13a5c1273

Download Submit
C:\Windows\SysWOW64\qUkc.exe

Filesize
197KB

MD5
f9449cf58cd84c727510eb444adc1be3

SHA1
da5b2dc33cb7000dbb185b531df4127809bf1100

SHA256
38e7937e84b2d8d3846884788de70b08ad59090b6364990711e8cb8a1ef3e807

SHA512
50f80b3d9a8f15d70a7c0b195dd0fc358df4e822eb456beed5ad5399b43756e05e8d2751ff3e35056e2ad6265a28fcc9bdbf40efc2e30542088e2993636b79b2

Download Submit
C:\Windows\SysWOW64\qcAu.exe

Filesize
381KB

MD5
800e0a4938452ce0071ccc67b64a8555

SHA1
d067f47f303dfa8e3c369bbde36164be4468b9ee

SHA256
4931cd5bb4af806f34bec2686db94f01f53ac43b98ed76971624ca11ddfaf729

SHA512
b9aa8cfb9baef685cac1242db753a5a531e8d758898dc1fe952c588bf1c9c72c6ea5629bd687986bdc362d949d906318976e44f8acfc7e1cd27c5fe88ed5f5bc

Download Submit
C:\Windows\SysWOW64\qgcU.exe

Filesize
203KB

MD5
cf74743072f4d74bff81fcaa0442256a

SHA1
e32f9d9065443b2d309c89ca50a35248c169d2c4

SHA256
bfd20bd2a9a24618fc78c1413b69210ec825bb1d45c04a16a4984074725bad1c

SHA512
9700ff86c43c30c879d7ecf87ba7bc1a4aab5eb6a6602d7004864ae8194a1484ae7b892f2975c38874c6e9b44f58defc36fa4b389e066437a983ca9ef2b5f858

Download Submit
C:\Windows\SysWOW64\qsIa.exe

Filesize
1.8MB

MD5
64d5f28e3492b62781c9b5750a3baa80

SHA1
d370a6a74ab0cf512b766b57447591b4dc1de757

SHA256
22f71d228db6c48fb1d22ecccc9c5cf68591c40d0fa77cbb34af2ad9172eb88b

SHA512
e2fed69ef8f80ef5685d4e3c05185d1e3267b5a1e569472c4648250c5a343fcfb29d9f711bbe5e073955cd66ac32fd294b00c6172ec91a38d88a1564e4c7f80d

Download Submit
C:\Windows\SysWOW64\qsIe.exe

Filesize
209KB

MD5
75079553bb3fabe88f33458534d86813

SHA1
a3f565b5c1b891ec57b3274e706f62715e309857

SHA256
8bc8d1a133efedec9eb7a37449b873dd021d9c84c8cf01cf4761e789462a4e0d

SHA512
6fa4073261c0d372b752d71a94565698f7d9c1c41512613a9ad770a9150097af619bd8261b483587828c471c4863c0021ca75101f94eb3158d95987342ed195a

Download Submit
C:\Windows\SysWOW64\sAsu.exe

Filesize
1.3MB

MD5
2ecdffe80800374f2b8d7ff815c743b1

SHA1
4e1bfeef4cdfb77d1df6933a1f4946552b93d0a0

SHA256
b859864f9b8d000dbbcf8835b03b142bca51d03a0670df371b462267c0d2afb2

SHA512
88bbf72aec1f69e05cdca67419e799bf5cb80caaa9af9822718754e3acb5ec30da9e02e372be1847e6eba54de863a52f41296bc4296f791dc466966c68cd5ab3

Download Submit
C:\Windows\SysWOW64\sIAk.exe

Filesize
203KB

MD5
f30b0da671514d6d5180d2ee26ed4703

SHA1
4c50ef16b512b9570afeaca1527cc325d2677f5a

SHA256
5de57e31f6d8c72a8850a7d012b152f3274060b4eaeec9cbd7676d8ee3a93c2a

SHA512
f71b3652762408d7791c153d602bc5c47fed69e8381d0f279917e56dffdfb987b5b2f13e1a36879e4b65d122d6c9bf7ddf24a803e2a7e8282347dea44a274934

Download Submit
C:\Windows\SysWOW64\sgQy.exe

Filesize
766KB

MD5
42916ba460584c7685714df6429a3660

SHA1
6675c68e93a2fd0f4d966f459adfd4abb1756814

SHA256
df5812b9088c9c2ff4e7f890e980066a38cca7c06ef02410c005b81fbba20543

SHA512
b322fe08781ad3fe4fa4523378aca6ad180c814bf55b3587957ce24e82da11f5b0118c50079eb45cb6ccc88aff7b19036a2724395803d179ed0aa6760760d476

Download Submit
C:\Windows\SysWOW64\uIwG.exe

Filesize
201KB

MD5
1fca81977a4bd4047221819428e4e1e3

SHA1
581ace4b9c20de04eaebf827f9093fe6888b5706

SHA256
add50a3bebfd741af244645a63f2107939b99458e3fc0ab5ac8bce3b325ab3cf

SHA512
fe2ec4639df30561f0d6903ccdcd8c07dd3b7354e8fe17570a6fcfaa44a5264401fc9d7f9d59d3074ec530afa94e42d7094a50724daef827858c9bc81f132bc8

Download Submit
C:\Windows\SysWOW64\uMoc.exe

Filesize
796KB

MD5
d1e3be4d3e1c30f274fb8109ce822733

SHA1
9acb67606b9746324f2b4e488c320d473b2ceb5d

SHA256
d9c526a2f50b4057f6455857f615f1141006c3479da1fa2013ac75fa7fd14286

SHA512
3ae2450530c0b3a9cf68f05bdc63a4a65e2dd5ab91c3a6f284d4070460e18981dde27dbdeec3fc0b1ccf0523367abc7b6ebf70fbb46110aa7d441868fcbaae8d

Download Submit
C:\Windows\SysWOW64\uUQy.exe

Filesize
498KB

MD5
2ee6e937ad72f9b5427ef41b5396199c

SHA1
fd033f7ab10443882e84d3cbbe5ad1bba622b3bf

SHA256
5be40aeb5eae3a2f3ebffff86c252d897cec5c69ab71b08d6790f8c723c93ac9

SHA512
9b8261e190be906fe705c9eda6178527267fe19951d07398f652ba9e8cbbd2709fecc4971cfd9cfd5c26ad5b3ad5be8646b4bf7996a1a4fd861b0ba84b0f76dd

Download Submit
C:\Windows\SysWOW64\uYQe.exe

Filesize
183KB

MD5
a36639258381863bf4508d1c4b450a02

SHA1
7e860ff2e8173919a89a6ad1f67a8194c3de542f

SHA256
330cf336851a2c791b56a565a94b58eb8ab141c3844ce821517677ca31b1740f

SHA512
843d1ec9b647ee822e97033d85ae512ca8b2a1c829e9d8660e99f410ac1d41ee2330cbf569c888f45905292555750185f3f2dd9ffa668550cb16c6819b2cb520

Download Submit
C:\Windows\SysWOW64\uoYQ.exe

Filesize
201KB

MD5
ef40092235750813057ed614939e794a

SHA1
f6d7542ea4756e044269c1ef063d977c3fd28d3c

SHA256
06de79c0e79109b73aa0ff2c666e8ff6c727bda8cadb831baea95a730fbcd5f5

SHA512
ce1225d0843cd669c0ad8725f5a1fccd1786b8c84574ab63c00b1d44f498f24dd64c6a8e635c21ae14334a0ee64944cc57420d929c28471a9d2ecf2d3541c2ac

Download Submit
C:\Windows\SysWOW64\usAe.exe

Filesize
202KB

MD5
9e26070b9a03fb70dfc210c02bbfea20

SHA1
14d9c90e3250ebfd94e07562cf5c07aa4f2155ad

SHA256
6e46b0d03e18aaf9f1532b50d7b13ba0e38ba52a59781a958ce246f56245788d

SHA512
c46e1d294b1e32c4d9623c3b4d51cac904ffba02b3434efb15ffcc9b82a7b5e0a813ef630a8ab61e49560f3d093549b17ab7a7524448af971cb604596457a590

Download Submit
C:\Windows\SysWOW64\wAca.exe

Filesize
2.5MB

MD5
7d2f9b36900d00ae263c8d6e00a5b883

SHA1
fb50f541d490ab1b2acf3b665342bcc850058a6b

SHA256
78e90a332e89f75877b355ad7051ae691ef480fc625a5814874e1b17640d4099

SHA512
3f317ce4354936c5bf5c5723ef8be3bc13e0aa79de4aceeb3cf863f7eb8b12eaf4691095eafd17f9811a2552b0f3ccb3adf2ad54d6dacdd6c819e9fd2028ef12

Download Submit
C:\Windows\SysWOW64\wEsi.exe

Filesize
182KB

MD5
795a1a103641ac942bb0df0976649c62

SHA1
cf1e06d6e5b1d038861cddcfb7bc613d743a1b35

SHA256
f6a4e92614b61c3c08f9e1f6eb99bb601f344b78b0c6b2fdcf2825a91da71f4d

SHA512
0bd1fef593549b498397a1a77843fea8e7df74c1859c9d4fba07ed945338417029247a0f5f155fdde00651f9b828e0a9cc5322664cee863486f35be12019267c

Download Submit
C:\Windows\SysWOW64\wMQw.exe

Filesize
651KB

MD5
e4e7f566e9c0e05fa3e86c6057955434

SHA1
dbbf3ec77b86bf55782d1b4b0ed86b21312fc333

SHA256
63b3ebd81fab075cdbd1bb65a7be5f52f9df6a6da6208659f76fc9ba879b55ad

SHA512
cd5ff0967816407239bf92258adde1d3d0f8bbc2f8ba09e8e3029cffe1d3a7cf55476532adb60f4d9ca60817b2e9e05b78528d09be9aad3cf3db2588ac33df26

Download Submit
C:\Windows\SysWOW64\wQAw.exe

Filesize
200KB

MD5
1b04393c0646f6f6617c725b18808f72

SHA1
05e40b9e60634031b78cab45e6bf4ce7a4580714

SHA256
58fdb0f29132ffe8c9de00788313600064dbdf8480dfec94c7d1fe53714001a4

SHA512
551149c4efc6478e0bef39261b9490bacd509a4a280a858db35339e8e6e8b9329cbc7399146fad656a69cdae91accaf3c3c9e9bcd1e75c1e488b0a8c020300a3

Download Submit
C:\Windows\SysWOW64\wYcC.exe

Filesize
187KB

MD5
bfecedaae708da0753f19ac7796b6135

SHA1
f35d2c2f3a7b9e84299b403a96f1d1eed38f50c1

SHA256
a0b84390995687a5cf7de70115f17bf4a375a36644792a7298f7b874d9b37023

SHA512
63030c357dda761207ec7007d76e3499fa7bffea5bf383232a650ccc7fce81b86d7765b6044e89fb7608464ac9d36e36ce9916a3a960a67ad3a203a35d465f5a

Download Submit
C:\Windows\SysWOW64\wccK.exe

Filesize
802KB

MD5
fae271c5bb0459a052b791a2272192fa

SHA1
1c3f560e7ddf2e06b5448d0dcc0d816a299a632e

SHA256
a72c04a9fe0e082c1b91fb1baa5fcbcf9fe1b2e12875ceca5028bebcb2dd5563

SHA512
f08a37850da1d1291938aecc6fbf717267b8274801d05894746aad9ddc47e310687885c96e2cfc0f2c4596f273fd964fc9ee3c41db8fed6328e7bea46d140b12

Download Submit
C:\Windows\SysWOW64\wkQS.exe

Filesize
208KB

MD5
716065cedb0442e204a81030c2b5e132

SHA1
1f97b78cbe0b4eae29a510c8c1969754f7a702e5

SHA256
2f6c67cf1b50a8a3ee5624e8dafdf8330b8831ec6a1d349a0d39cb49688bd8c4

SHA512
cbfcdaa252aa07c5075b2f5cb930f2ad68fe553e387ad8e535c3788052fef239c0fdb676347e30a51782c22ee664f9c314b68b2c6933753865eef4a09a78b247

Download Submit
C:\Windows\SysWOW64\wsIc.exe

Filesize
620KB

MD5
edf655d2acefa249c32dfb0aed5cab0d

SHA1
3a289a23649c6d3b8e9c7ff5cfe9cdbd57218b1b

SHA256
677d05c9ab9e7d97e7c0f01e5d63cf41974696de823f9b9dec0c8dcd3c975d7a

SHA512
f870ff13a44b52ed3f2b89d76fc67be620d67603e0d64e8339a9fb484d2da3cbd13552de2002b6399c72cbf4937b639669319c97bb3a31d897c1be7b866bbcec

Download Submit
C:\Windows\SysWOW64\yIoS.exe

Filesize
180KB

MD5
16e7f202654a02011420baceb576e32b

SHA1
69c71ec79ce55523058c7ad3f48eede0fcc96657

SHA256
4f1d95b25ebe89329b8def075b89aa2fdaf1b02ba7a34e96bc9a20545d5c61c9

SHA512
38e15e95b03eb629da9195ac53e68057f59e5e7c2bc90872c7444b84d5d8779888c403425750c6384405f92faa02a3122cf3f4d8e32c509bb9046e4b4827e4c8

Download Submit
C:\Windows\SysWOW64\yMMM.exe

Filesize
193KB

MD5
f9e90ab1ac9316f5f826c201e0b0cdde

SHA1
c595260ab5325c2a34e265add4b13b46186f8d5c

SHA256
9e82fe915469ecedeed7c9ec3a3ea762126501b22ccc9aa0cbe8ccb9512ab033

SHA512
f1132443ceba453beec63bb057f20e762445e3e4f36712615ce9300e039e04fc9758ea89c8e45f058872c8b19853bf2605cc64dd0c245fb331befbc1b4e3a149

Download Submit
C:\Windows\SysWOW64\yUsi.exe

Filesize
181KB

MD5
267d481934d1c242298061164240993e

SHA1
229b748ca217795d7ccaaa21532fdc22179ea404

SHA256
55a79dae5ae655efa206f31c9d7a8da9964fb72c3871714f32ef3a8c5aadbd25

SHA512
482ec26b837b96ee9958a0b4bff8de85753960a27c3adea20ad7174a18bf092c08b480a011000853806c33e0ac32c3c10868133bed194d76869d47b2ad2b5257

Download Submit
C:\Windows\SysWOW64\yoAA.exe

Filesize
196KB

MD5
286f3cd687cf704f4bcfdf9a84eec3ac

SHA1
448f27eeab35d33b2dc3bd779d57a88e92c69c82

SHA256
19f783a370c7e4eda242dd8313860a2c0ea51ec6397603847d61ac8978b17fca

SHA512
ce15a11428185de1414c068814e6ca14c9f1df9721753156544751b1183f0c0e66b6a34f0f62251a399ef1b60c454546ee1d0558252d712f3f06cb055a1c4204

Download Submit
memory/108-629-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/240-437-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/240-334-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/404-878-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/404-867-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/428-1035-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/440-564-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/444-935-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/480-360-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/496-715-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/508-854-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/704-679-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/984-398-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/984-385-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1476-974-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1484-740-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1564-793-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1576-892-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1608-346-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1608-758-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1740-308-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1740-321-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1844-698-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1844-689-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1844-767-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1844-776-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1940-1111-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1940-1061-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2036-425-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2036-412-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2212-486-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2268-671-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2268-530-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2316-845-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2332-866-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2388-386-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2440-413-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2460-462-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2528-663-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2712-512-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2856-478-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3044-868-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3104-655-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3124-750-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3180-448-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3180-690-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3340-1034-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3340-1060-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3444-811-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3480-601-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3480-611-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3492-619-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3580-944-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3724-600-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3772-645-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3772-724-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3840-1173-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3852-538-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3856-591-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3856-583-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3916-965-0x000001913F4F0000-0x000001913F4F1000-memory.dmp

Filesize
4KB

Download
memory/3916-964-0x000001913F4F0000-0x000001913F4F1000-memory.dmp

Filesize
4KB

Download
memory/3916-955-0x000001913F4F0000-0x000001913F4F1000-memory.dmp

Filesize
4KB

Download
memory/3916-954-0x000001913F4F0000-0x000001913F4F1000-memory.dmp

Filesize
4KB

Download
memory/3916-953-0x000001913F4F0000-0x000001913F4F1000-memory.dmp

Filesize
4KB

Download
memory/3916-966-0x000001913F4F0000-0x000001913F4F1000-memory.dmp

Filesize
4KB

Download
memory/3916-963-0x000001913F4F0000-0x000001913F4F1000-memory.dmp

Filesize
4KB

Download
memory/3916-910-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3916-960-0x000001913F4F0000-0x000001913F4F1000-memory.dmp

Filesize
4KB

Download
memory/3916-962-0x000001913F4F0000-0x000001913F4F1000-memory.dmp

Filesize
4KB

Download
memory/3916-961-0x000001913F4F0000-0x000001913F4F1000-memory.dmp

Filesize
4KB

Download
memory/3964-522-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4124-732-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4136-992-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4248-572-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4248-706-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4404-1191-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4540-819-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4540-556-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4564-785-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4612-982-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4612-864-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4612-880-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4636-862-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4636-853-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4644-496-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4656-289-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4656-309-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4656-956-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4664-546-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4700-927-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4708-801-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4740-1000-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4756-303-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4772-766-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4804-835-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4812-827-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4820-900-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4824-470-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4864-1017-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4912-504-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4912-637-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5040-373-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5040-355-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5048-1172-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/5048-301-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads