Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 11:06
Static task
static1
Behavioral task
behavioral1
Sample
4fa02afd_by_Libranalysis.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
4fa02afd_by_Libranalysis.exe
Resource
win10v20210408
General
-
Target
4fa02afd_by_Libranalysis.exe
-
Size
622KB
-
MD5
4fa02afd5bbc31e0885d4581d151c26c
-
SHA1
c7ef6fddc1b48820b54cf1b47fc0822ad01bcefe
-
SHA256
d407b05c01f4fa48b2fed39737c3850961e2df38e4e76e1af6482770bc77a1de
-
SHA512
8e79a723894cc7c9c22c29b2f222dad56a24b26ec8d34ca74b0cb05361a1ee2d12b5aea1037552e87ada5c456600457c17361dbe5a4e700e304d735e8a349d3f
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
4fa02afd_by_Libranalysis.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\BoAIkIEg\\VoYckYwI.exe," 4fa02afd_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\ProgramData\\BoAIkIEg\\VoYckYwI.exe," 4fa02afd_by_Libranalysis.exe -
Modifies visibility of file extensions in Explorer 2 TTPs
-
Executes dropped EXE 3 IoCs
Processes:
geUMsUkM.exeVoYckYwI.exexcQkkIkM.exepid process 1160 geUMsUkM.exe 1988 VoYckYwI.exe 1700 xcQkkIkM.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
geUMsUkM.exedescription ioc process File created C:\Users\Admin\Pictures\StepCompare.png.exe geUMsUkM.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
geUMsUkM.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\International\Geo\Nation geUMsUkM.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1712 cmd.exe -
Loads dropped DLL 16 IoCs
Processes:
4fa02afd_by_Libranalysis.exegeUMsUkM.exepid process 1240 4fa02afd_by_Libranalysis.exe 1240 4fa02afd_by_Libranalysis.exe 1240 4fa02afd_by_Libranalysis.exe 1240 4fa02afd_by_Libranalysis.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
VoYckYwI.exexcQkkIkM.exe4fa02afd_by_Libranalysis.exegeUMsUkM.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VoYckYwI.exe = "C:\\ProgramData\\BoAIkIEg\\VoYckYwI.exe" VoYckYwI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VoYckYwI.exe = "C:\\ProgramData\\BoAIkIEg\\VoYckYwI.exe" xcQkkIkM.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\geUMsUkM.exe = "C:\\Users\\Admin\\rosIYEAg\\geUMsUkM.exe" 4fa02afd_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VoYckYwI.exe = "C:\\ProgramData\\BoAIkIEg\\VoYckYwI.exe" 4fa02afd_by_Libranalysis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\geUMsUkM.exe = "C:\\Users\\Admin\\rosIYEAg\\geUMsUkM.exe" geUMsUkM.exe -
Processes:
4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4fa02afd_by_Libranalysis.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4fa02afd_by_Libranalysis.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4fa02afd_by_Libranalysis.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4fa02afd_by_Libranalysis.exe -
Drops file in System32 directory 2 IoCs
Processes:
xcQkkIkM.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\rosIYEAg xcQkkIkM.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\rosIYEAg\geUMsUkM xcQkkIkM.exe -
Drops file in Windows directory 1 IoCs
Processes:
geUMsUkM.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico geUMsUkM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1812 reg.exe 924 reg.exe 2008 reg.exe 1972 reg.exe 1504 reg.exe 968 reg.exe 308 reg.exe 1892 reg.exe 2012 reg.exe 1192 reg.exe 1604 reg.exe 1676 reg.exe 1672 reg.exe 1756 reg.exe 944 reg.exe 520 reg.exe 756 reg.exe 1336 reg.exe 1164 reg.exe 2016 reg.exe 1984 reg.exe 1316 reg.exe 1168 reg.exe 1144 reg.exe 552 reg.exe 616 reg.exe 1360 reg.exe 1760 reg.exe 2008 reg.exe 1476 reg.exe 1164 reg.exe 1756 reg.exe 336 reg.exe 688 reg.exe 1712 reg.exe 1544 reg.exe 688 reg.exe 1756 reg.exe 1164 reg.exe 1112 reg.exe 1764 reg.exe 944 reg.exe 1676 reg.exe 1144 reg.exe 392 reg.exe 384 reg.exe 2016 reg.exe 1880 reg.exe 1764 reg.exe 1984 reg.exe 756 reg.exe 392 reg.exe 1008 reg.exe 1272 reg.exe 856 reg.exe 1972 reg.exe 1604 reg.exe 1192 reg.exe 1956 reg.exe 1360 reg.exe 1316 reg.exe 1604 reg.exe 1112 reg.exe 1112 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exepid process 1240 4fa02afd_by_Libranalysis.exe 1240 4fa02afd_by_Libranalysis.exe 1688 4fa02afd_by_Libranalysis.exe 1688 4fa02afd_by_Libranalysis.exe 1756 4fa02afd_by_Libranalysis.exe 1756 4fa02afd_by_Libranalysis.exe 1604 4fa02afd_by_Libranalysis.exe 1604 4fa02afd_by_Libranalysis.exe 1680 4fa02afd_by_Libranalysis.exe 1680 4fa02afd_by_Libranalysis.exe 888 4fa02afd_by_Libranalysis.exe 888 4fa02afd_by_Libranalysis.exe 1876 4fa02afd_by_Libranalysis.exe 1876 4fa02afd_by_Libranalysis.exe 384 4fa02afd_by_Libranalysis.exe 384 4fa02afd_by_Libranalysis.exe 956 4fa02afd_by_Libranalysis.exe 956 4fa02afd_by_Libranalysis.exe 300 4fa02afd_by_Libranalysis.exe 300 4fa02afd_by_Libranalysis.exe 520 4fa02afd_by_Libranalysis.exe 520 4fa02afd_by_Libranalysis.exe 1168 4fa02afd_by_Libranalysis.exe 1168 4fa02afd_by_Libranalysis.exe 1972 4fa02afd_by_Libranalysis.exe 1972 4fa02afd_by_Libranalysis.exe 608 4fa02afd_by_Libranalysis.exe 608 4fa02afd_by_Libranalysis.exe 1256 4fa02afd_by_Libranalysis.exe 1256 4fa02afd_by_Libranalysis.exe 552 4fa02afd_by_Libranalysis.exe 552 4fa02afd_by_Libranalysis.exe 324 4fa02afd_by_Libranalysis.exe 324 4fa02afd_by_Libranalysis.exe 968 4fa02afd_by_Libranalysis.exe 968 4fa02afd_by_Libranalysis.exe 1316 4fa02afd_by_Libranalysis.exe 1316 4fa02afd_by_Libranalysis.exe 956 4fa02afd_by_Libranalysis.exe 956 4fa02afd_by_Libranalysis.exe 1192 4fa02afd_by_Libranalysis.exe 1192 4fa02afd_by_Libranalysis.exe 1112 4fa02afd_by_Libranalysis.exe 1112 4fa02afd_by_Libranalysis.exe 1948 4fa02afd_by_Libranalysis.exe 1948 4fa02afd_by_Libranalysis.exe 1192 4fa02afd_by_Libranalysis.exe 1192 4fa02afd_by_Libranalysis.exe 1760 4fa02afd_by_Libranalysis.exe 1760 4fa02afd_by_Libranalysis.exe 1604 4fa02afd_by_Libranalysis.exe 1604 4fa02afd_by_Libranalysis.exe 616 4fa02afd_by_Libranalysis.exe 616 4fa02afd_by_Libranalysis.exe 1980 4fa02afd_by_Libranalysis.exe 1980 4fa02afd_by_Libranalysis.exe 1272 4fa02afd_by_Libranalysis.exe 1272 4fa02afd_by_Libranalysis.exe 1892 4fa02afd_by_Libranalysis.exe 1892 4fa02afd_by_Libranalysis.exe 1564 4fa02afd_by_Libranalysis.exe 1564 4fa02afd_by_Libranalysis.exe 792 4fa02afd_by_Libranalysis.exe 792 4fa02afd_by_Libranalysis.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
geUMsUkM.exepid process 1160 geUMsUkM.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
geUMsUkM.exepid process 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe 1160 geUMsUkM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4fa02afd_by_Libranalysis.execmd.exe4fa02afd_by_Libranalysis.execmd.execmd.exe4fa02afd_by_Libranalysis.execmd.exedescription pid process target process PID 1240 wrote to memory of 1160 1240 4fa02afd_by_Libranalysis.exe geUMsUkM.exe PID 1240 wrote to memory of 1160 1240 4fa02afd_by_Libranalysis.exe geUMsUkM.exe PID 1240 wrote to memory of 1160 1240 4fa02afd_by_Libranalysis.exe geUMsUkM.exe PID 1240 wrote to memory of 1160 1240 4fa02afd_by_Libranalysis.exe geUMsUkM.exe PID 1240 wrote to memory of 1988 1240 4fa02afd_by_Libranalysis.exe VoYckYwI.exe PID 1240 wrote to memory of 1988 1240 4fa02afd_by_Libranalysis.exe VoYckYwI.exe PID 1240 wrote to memory of 1988 1240 4fa02afd_by_Libranalysis.exe VoYckYwI.exe PID 1240 wrote to memory of 1988 1240 4fa02afd_by_Libranalysis.exe VoYckYwI.exe PID 1240 wrote to memory of 1520 1240 4fa02afd_by_Libranalysis.exe cmd.exe PID 1240 wrote to memory of 1520 1240 4fa02afd_by_Libranalysis.exe cmd.exe PID 1240 wrote to memory of 1520 1240 4fa02afd_by_Libranalysis.exe cmd.exe PID 1240 wrote to memory of 1520 1240 4fa02afd_by_Libranalysis.exe cmd.exe PID 1520 wrote to memory of 1688 1520 cmd.exe 4fa02afd_by_Libranalysis.exe PID 1520 wrote to memory of 1688 1520 cmd.exe 4fa02afd_by_Libranalysis.exe PID 1520 wrote to memory of 1688 1520 cmd.exe 4fa02afd_by_Libranalysis.exe PID 1520 wrote to memory of 1688 1520 cmd.exe 4fa02afd_by_Libranalysis.exe PID 1240 wrote to memory of 1764 1240 4fa02afd_by_Libranalysis.exe reg.exe PID 1240 wrote to memory of 1764 1240 4fa02afd_by_Libranalysis.exe reg.exe PID 1240 wrote to memory of 1764 1240 4fa02afd_by_Libranalysis.exe reg.exe PID 1240 wrote to memory of 1764 1240 4fa02afd_by_Libranalysis.exe reg.exe PID 1240 wrote to memory of 1760 1240 4fa02afd_by_Libranalysis.exe reg.exe PID 1240 wrote to memory of 1760 1240 4fa02afd_by_Libranalysis.exe reg.exe PID 1240 wrote to memory of 1760 1240 4fa02afd_by_Libranalysis.exe reg.exe PID 1240 wrote to memory of 1760 1240 4fa02afd_by_Libranalysis.exe reg.exe PID 1240 wrote to memory of 968 1240 4fa02afd_by_Libranalysis.exe reg.exe PID 1240 wrote to memory of 968 1240 4fa02afd_by_Libranalysis.exe reg.exe PID 1240 wrote to memory of 968 1240 4fa02afd_by_Libranalysis.exe reg.exe PID 1240 wrote to memory of 968 1240 4fa02afd_by_Libranalysis.exe reg.exe PID 1688 wrote to memory of 944 1688 4fa02afd_by_Libranalysis.exe cmd.exe PID 1688 wrote to memory of 944 1688 4fa02afd_by_Libranalysis.exe cmd.exe PID 1688 wrote to memory of 944 1688 4fa02afd_by_Libranalysis.exe cmd.exe PID 1688 wrote to memory of 944 1688 4fa02afd_by_Libranalysis.exe cmd.exe PID 944 wrote to memory of 1756 944 cmd.exe 4fa02afd_by_Libranalysis.exe PID 944 wrote to memory of 1756 944 cmd.exe 4fa02afd_by_Libranalysis.exe PID 944 wrote to memory of 1756 944 cmd.exe 4fa02afd_by_Libranalysis.exe PID 944 wrote to memory of 1756 944 cmd.exe 4fa02afd_by_Libranalysis.exe PID 1688 wrote to memory of 1480 1688 4fa02afd_by_Libranalysis.exe reg.exe PID 1688 wrote to memory of 1480 1688 4fa02afd_by_Libranalysis.exe reg.exe PID 1688 wrote to memory of 1480 1688 4fa02afd_by_Libranalysis.exe reg.exe PID 1688 wrote to memory of 1480 1688 4fa02afd_by_Libranalysis.exe reg.exe PID 1688 wrote to memory of 384 1688 4fa02afd_by_Libranalysis.exe reg.exe PID 1688 wrote to memory of 384 1688 4fa02afd_by_Libranalysis.exe reg.exe PID 1688 wrote to memory of 384 1688 4fa02afd_by_Libranalysis.exe reg.exe PID 1688 wrote to memory of 384 1688 4fa02afd_by_Libranalysis.exe reg.exe PID 1688 wrote to memory of 656 1688 4fa02afd_by_Libranalysis.exe reg.exe PID 1688 wrote to memory of 656 1688 4fa02afd_by_Libranalysis.exe reg.exe PID 1688 wrote to memory of 656 1688 4fa02afd_by_Libranalysis.exe reg.exe PID 1688 wrote to memory of 656 1688 4fa02afd_by_Libranalysis.exe reg.exe PID 1688 wrote to memory of 1672 1688 4fa02afd_by_Libranalysis.exe cmd.exe PID 1688 wrote to memory of 1672 1688 4fa02afd_by_Libranalysis.exe cmd.exe PID 1688 wrote to memory of 1672 1688 4fa02afd_by_Libranalysis.exe cmd.exe PID 1688 wrote to memory of 1672 1688 4fa02afd_by_Libranalysis.exe cmd.exe PID 1672 wrote to memory of 324 1672 cmd.exe cscript.exe PID 1672 wrote to memory of 324 1672 cmd.exe cscript.exe PID 1672 wrote to memory of 324 1672 cmd.exe cscript.exe PID 1672 wrote to memory of 324 1672 cmd.exe cscript.exe PID 1756 wrote to memory of 1272 1756 4fa02afd_by_Libranalysis.exe cmd.exe PID 1756 wrote to memory of 1272 1756 4fa02afd_by_Libranalysis.exe cmd.exe PID 1756 wrote to memory of 1272 1756 4fa02afd_by_Libranalysis.exe cmd.exe PID 1756 wrote to memory of 1272 1756 4fa02afd_by_Libranalysis.exe cmd.exe PID 1272 wrote to memory of 1604 1272 cmd.exe 4fa02afd_by_Libranalysis.exe PID 1272 wrote to memory of 1604 1272 cmd.exe 4fa02afd_by_Libranalysis.exe PID 1272 wrote to memory of 1604 1272 cmd.exe 4fa02afd_by_Libranalysis.exe PID 1272 wrote to memory of 1604 1272 cmd.exe 4fa02afd_by_Libranalysis.exe -
System policy modification 1 TTPs 4 IoCs
Processes:
4fa02afd_by_Libranalysis.exe4fa02afd_by_Libranalysis.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 4fa02afd_by_Libranalysis.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4fa02afd_by_Libranalysis.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 4fa02afd_by_Libranalysis.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4fa02afd_by_Libranalysis.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\rosIYEAg\geUMsUkM.exe"C:\Users\Admin\rosIYEAg\geUMsUkM.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\BoAIkIEg\VoYckYwI.exe"C:\ProgramData\BoAIkIEg\VoYckYwI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"8⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"10⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"12⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"14⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"16⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"18⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"20⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"22⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"24⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"26⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"28⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"30⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"32⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"34⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"36⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis37⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"38⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"40⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis41⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"42⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis43⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"44⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis45⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"46⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis47⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"48⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis49⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"50⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis51⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"52⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis53⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"54⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis55⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"56⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis57⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"58⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis59⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"60⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis61⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"62⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis63⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"64⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis65⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"66⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis67⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"68⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis69⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"70⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis71⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"72⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis73⤵
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"74⤵
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exeC:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis75⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis"76⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\bSQkIUYg.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""76⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\zyosUUQQ.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""74⤵
- Deletes itself
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\iGMYkIYA.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""72⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\qSIYcYgs.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""70⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\CKocwMgE.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""68⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\cgMUEcgc.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""66⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\WAwsQEsU.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""64⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\liEIQMYE.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""62⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\LQwIIcws.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""60⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\BCYwwwAY.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""58⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hmIUgMEk.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""56⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RgkIsQQo.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""54⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\igwIMsws.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""52⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ScEksEsM.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""50⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\EuMoEsYY.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""48⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\iKAskEMk.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""46⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\UAAggIso.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""44⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FgkcIkgg.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""42⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\fiYUwoQQ.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""40⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\jWUwooIo.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""38⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\fEkUEwQI.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""36⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\yAgEowUY.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\yIkogooA.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\EWAYsAQY.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\wUsooYMo.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\IwYYUcUo.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\PcMEIYYk.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\baIAAcwo.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\LOAUgAwQ.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\bKwgoEAY.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\geAEsMss.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""16⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\wSgYgAYo.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""14⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\agMgMgYQ.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""12⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\daoMYUIk.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""10⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\paUwgoYQ.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\biggAswk.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""6⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\SCMosgoQ.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\XKQAcAUw.bat" "C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_Libranalysis.exe""2⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
C:\ProgramData\OOcEswMg\xcQkkIkM.exeC:\ProgramData\OOcEswMg\xcQkkIkM.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1851624654-1743031686-19206306191142432539931080182817633780313250411-929046537"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "163486502078009647-312771564-530060561770332360-1965362802542513159486544169"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\BoAIkIEg\VoYckYwI.exeMD5
c513a39eba4bd6a76504f23ad3c2afb8
SHA194a8ee2b7a86f2c5d928c17187aa69f24ba33a84
SHA256940d3f95a45ebfa9dda92805dae316c5a75bbae64d558622c452e9f5251af3ad
SHA5122d0f6c082297627b5d09570f2852681996dd9cc1ae867ae74865f3f38a3d4007df627455c8538a7f5fa505c6d6bc830099a5b35018817c3460c1be546849e49c
-
C:\ProgramData\OOcEswMg\xcQkkIkM.exeMD5
f8714a0adc94c56f0e6bc1265b175ea4
SHA18423f8fe344b85330e540ab1ff8ed9d19fa185e1
SHA2567f85536369445cf01ad4f8a901a5017f962f7dad38c97554d8ce9a53cf9f869f
SHA5123b300a7e54f96b8d8114bbca8f14f7f1ad608e63f03be9add03aca0af38e2ac94da644123f2023ed56ef98068d4c0dad5aefd050732d2b19aced50184a712296
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_LibranalysisMD5
ad19aeae3b6e4e7255c35b73bf519b49
SHA13ee1d901db2ed58d61a1c0da2532ef85562ae3fd
SHA256e9acba85eeed608d5deb570026d92d5c2904fa621223818a26383f64ddf8bfe8
SHA512a4c31c2dd8ca1ccfb59c73259f3b0d88fd0f93519f31e091e26748ccdb6e45780b6e2c8d9e0628195ac778480899e8102add43a20577bbf028d24952b24bf541
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_LibranalysisMD5
ad19aeae3b6e4e7255c35b73bf519b49
SHA13ee1d901db2ed58d61a1c0da2532ef85562ae3fd
SHA256e9acba85eeed608d5deb570026d92d5c2904fa621223818a26383f64ddf8bfe8
SHA512a4c31c2dd8ca1ccfb59c73259f3b0d88fd0f93519f31e091e26748ccdb6e45780b6e2c8d9e0628195ac778480899e8102add43a20577bbf028d24952b24bf541
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_LibranalysisMD5
ad19aeae3b6e4e7255c35b73bf519b49
SHA13ee1d901db2ed58d61a1c0da2532ef85562ae3fd
SHA256e9acba85eeed608d5deb570026d92d5c2904fa621223818a26383f64ddf8bfe8
SHA512a4c31c2dd8ca1ccfb59c73259f3b0d88fd0f93519f31e091e26748ccdb6e45780b6e2c8d9e0628195ac778480899e8102add43a20577bbf028d24952b24bf541
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_LibranalysisMD5
ad19aeae3b6e4e7255c35b73bf519b49
SHA13ee1d901db2ed58d61a1c0da2532ef85562ae3fd
SHA256e9acba85eeed608d5deb570026d92d5c2904fa621223818a26383f64ddf8bfe8
SHA512a4c31c2dd8ca1ccfb59c73259f3b0d88fd0f93519f31e091e26748ccdb6e45780b6e2c8d9e0628195ac778480899e8102add43a20577bbf028d24952b24bf541
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_LibranalysisMD5
ad19aeae3b6e4e7255c35b73bf519b49
SHA13ee1d901db2ed58d61a1c0da2532ef85562ae3fd
SHA256e9acba85eeed608d5deb570026d92d5c2904fa621223818a26383f64ddf8bfe8
SHA512a4c31c2dd8ca1ccfb59c73259f3b0d88fd0f93519f31e091e26748ccdb6e45780b6e2c8d9e0628195ac778480899e8102add43a20577bbf028d24952b24bf541
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_LibranalysisMD5
ad19aeae3b6e4e7255c35b73bf519b49
SHA13ee1d901db2ed58d61a1c0da2532ef85562ae3fd
SHA256e9acba85eeed608d5deb570026d92d5c2904fa621223818a26383f64ddf8bfe8
SHA512a4c31c2dd8ca1ccfb59c73259f3b0d88fd0f93519f31e091e26748ccdb6e45780b6e2c8d9e0628195ac778480899e8102add43a20577bbf028d24952b24bf541
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_LibranalysisMD5
ad19aeae3b6e4e7255c35b73bf519b49
SHA13ee1d901db2ed58d61a1c0da2532ef85562ae3fd
SHA256e9acba85eeed608d5deb570026d92d5c2904fa621223818a26383f64ddf8bfe8
SHA512a4c31c2dd8ca1ccfb59c73259f3b0d88fd0f93519f31e091e26748ccdb6e45780b6e2c8d9e0628195ac778480899e8102add43a20577bbf028d24952b24bf541
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_LibranalysisMD5
ad19aeae3b6e4e7255c35b73bf519b49
SHA13ee1d901db2ed58d61a1c0da2532ef85562ae3fd
SHA256e9acba85eeed608d5deb570026d92d5c2904fa621223818a26383f64ddf8bfe8
SHA512a4c31c2dd8ca1ccfb59c73259f3b0d88fd0f93519f31e091e26748ccdb6e45780b6e2c8d9e0628195ac778480899e8102add43a20577bbf028d24952b24bf541
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_LibranalysisMD5
ad19aeae3b6e4e7255c35b73bf519b49
SHA13ee1d901db2ed58d61a1c0da2532ef85562ae3fd
SHA256e9acba85eeed608d5deb570026d92d5c2904fa621223818a26383f64ddf8bfe8
SHA512a4c31c2dd8ca1ccfb59c73259f3b0d88fd0f93519f31e091e26748ccdb6e45780b6e2c8d9e0628195ac778480899e8102add43a20577bbf028d24952b24bf541
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_LibranalysisMD5
ad19aeae3b6e4e7255c35b73bf519b49
SHA13ee1d901db2ed58d61a1c0da2532ef85562ae3fd
SHA256e9acba85eeed608d5deb570026d92d5c2904fa621223818a26383f64ddf8bfe8
SHA512a4c31c2dd8ca1ccfb59c73259f3b0d88fd0f93519f31e091e26748ccdb6e45780b6e2c8d9e0628195ac778480899e8102add43a20577bbf028d24952b24bf541
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_LibranalysisMD5
ad19aeae3b6e4e7255c35b73bf519b49
SHA13ee1d901db2ed58d61a1c0da2532ef85562ae3fd
SHA256e9acba85eeed608d5deb570026d92d5c2904fa621223818a26383f64ddf8bfe8
SHA512a4c31c2dd8ca1ccfb59c73259f3b0d88fd0f93519f31e091e26748ccdb6e45780b6e2c8d9e0628195ac778480899e8102add43a20577bbf028d24952b24bf541
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_LibranalysisMD5
ad19aeae3b6e4e7255c35b73bf519b49
SHA13ee1d901db2ed58d61a1c0da2532ef85562ae3fd
SHA256e9acba85eeed608d5deb570026d92d5c2904fa621223818a26383f64ddf8bfe8
SHA512a4c31c2dd8ca1ccfb59c73259f3b0d88fd0f93519f31e091e26748ccdb6e45780b6e2c8d9e0628195ac778480899e8102add43a20577bbf028d24952b24bf541
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_LibranalysisMD5
ad19aeae3b6e4e7255c35b73bf519b49
SHA13ee1d901db2ed58d61a1c0da2532ef85562ae3fd
SHA256e9acba85eeed608d5deb570026d92d5c2904fa621223818a26383f64ddf8bfe8
SHA512a4c31c2dd8ca1ccfb59c73259f3b0d88fd0f93519f31e091e26748ccdb6e45780b6e2c8d9e0628195ac778480899e8102add43a20577bbf028d24952b24bf541
-
C:\Users\Admin\AppData\Local\Temp\4fa02afd_by_LibranalysisMD5
ad19aeae3b6e4e7255c35b73bf519b49
SHA13ee1d901db2ed58d61a1c0da2532ef85562ae3fd
SHA256e9acba85eeed608d5deb570026d92d5c2904fa621223818a26383f64ddf8bfe8
SHA512a4c31c2dd8ca1ccfb59c73259f3b0d88fd0f93519f31e091e26748ccdb6e45780b6e2c8d9e0628195ac778480899e8102add43a20577bbf028d24952b24bf541
-
C:\Users\Admin\AppData\Local\Temp\EWAYsAQY.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\IwYYUcUo.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\LOAUgAwQ.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\PcMEIYYk.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\SCMosgoQ.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\XKQAcAUw.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\agMgMgYQ.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\bKwgoEAY.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\baIAAcwo.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\biggAswk.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\daoMYUIk.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\file.vbsMD5
4afb5c4527091738faf9cd4addf9d34e
SHA1170ba9d866894c1b109b62649b1893eb90350459
SHA25659d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
SHA51216d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5
-
C:\Users\Admin\AppData\Local\Temp\geAEsMss.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\paUwgoYQ.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\wSgYgAYo.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\AppData\Local\Temp\wUsooYMo.batMD5
bae1095f340720d965898063fede1273
SHA1455d8a81818a7e82b1490c949b32fa7ff98d5210
SHA256ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
SHA5124e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024
-
C:\Users\Admin\rosIYEAg\geUMsUkM.exeMD5
1078b9a3474b12867c0e487e2d37d60b
SHA17b2b4f3bea1c229732786c91bd353b117bbe2c9e
SHA2565689e865b41193a4e90f46c571e8a5e7cb3f3bf032a768ff28747ee9dd868b7a
SHA5126d4666bf1dea58add7b2c30b4891feae33839c562c6056094aa0554dab4556f51bb95221afd87f926b47680001fce3190ee9dda1ed6d6c7e9def2330d75a1920
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exeMD5
9d10f99a6712e28f8acd5641e3a7ea6b
SHA1835e982347db919a681ba12f3891f62152e50f0d
SHA25670964a0ed9011ea94044e15fa77edd9cf535cc79ed8e03a3721ff007e69595cc
SHA5122141ee5c07aa3e038360013e3f40969e248bed05022d161b992df61f21934c5574ed9d3094ffd5245f5afd84815b24f80bda30055cf4d374f9c6254e842f6bd5
-
\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exeMD5
4d92f518527353c0db88a70fddcfd390
SHA1c4baffc19e7d1f0e0ebf73bab86a491c1d152f98
SHA25697e6f3fc1a9163f10b6502509d55bf75ee893967fb35f318954797e8ab4d4d9c
SHA51205a8136ccc45ef73cd5c70ee0ef204d9d2b48b950e938494b6d1a61dfba37527c9600382321d1c031dc74e4cf3e16f001ae0f8cd64d76d765f5509ce8dc76452
-
\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exeMD5
4d92f518527353c0db88a70fddcfd390
SHA1c4baffc19e7d1f0e0ebf73bab86a491c1d152f98
SHA25697e6f3fc1a9163f10b6502509d55bf75ee893967fb35f318954797e8ab4d4d9c
SHA51205a8136ccc45ef73cd5c70ee0ef204d9d2b48b950e938494b6d1a61dfba37527c9600382321d1c031dc74e4cf3e16f001ae0f8cd64d76d765f5509ce8dc76452
-
\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXEMD5
a41e524f8d45f0074fd07805ff0c9b12
SHA1948deacf95a60c3fdf17e0e4db1931a6f3fc5d38
SHA256082329648337e5ba7377fed9d8a178809f37eecb8d795b93cca4ec07d8640ff7
SHA51291bf4be7e82536a85a840dbc9f3ce7b7927d1cedf6391aac93989abae210620433e685b86a12d133a72369a4f8a665c46ac7fc9e8a806e2872d8b1514cbb305f
-
\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXEMD5
a41e524f8d45f0074fd07805ff0c9b12
SHA1948deacf95a60c3fdf17e0e4db1931a6f3fc5d38
SHA256082329648337e5ba7377fed9d8a178809f37eecb8d795b93cca4ec07d8640ff7
SHA51291bf4be7e82536a85a840dbc9f3ce7b7927d1cedf6391aac93989abae210620433e685b86a12d133a72369a4f8a665c46ac7fc9e8a806e2872d8b1514cbb305f
-
\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exeMD5
c87e561258f2f8650cef999bf643a731
SHA12c64b901284908e8ed59cf9c912f17d45b05e0af
SHA256a1dfa6639bef3cb4e41175c43730d46a51393942ead826337ca9541ac210c67b
SHA512dea4833aa712c5823f800f5f5a2adcf241c1b2b6747872f540f5ff9da6795c4ddb73db0912593337083c7c67b91e9eaf1b3d39a34b99980fd5904ba3d7d62f6c
-
\ProgramData\BoAIkIEg\VoYckYwI.exeMD5
c513a39eba4bd6a76504f23ad3c2afb8
SHA194a8ee2b7a86f2c5d928c17187aa69f24ba33a84
SHA256940d3f95a45ebfa9dda92805dae316c5a75bbae64d558622c452e9f5251af3ad
SHA5122d0f6c082297627b5d09570f2852681996dd9cc1ae867ae74865f3f38a3d4007df627455c8538a7f5fa505c6d6bc830099a5b35018817c3460c1be546849e49c
-
\ProgramData\BoAIkIEg\VoYckYwI.exeMD5
c513a39eba4bd6a76504f23ad3c2afb8
SHA194a8ee2b7a86f2c5d928c17187aa69f24ba33a84
SHA256940d3f95a45ebfa9dda92805dae316c5a75bbae64d558622c452e9f5251af3ad
SHA5122d0f6c082297627b5d09570f2852681996dd9cc1ae867ae74865f3f38a3d4007df627455c8538a7f5fa505c6d6bc830099a5b35018817c3460c1be546849e49c
-
\Users\Admin\rosIYEAg\geUMsUkM.exeMD5
1078b9a3474b12867c0e487e2d37d60b
SHA17b2b4f3bea1c229732786c91bd353b117bbe2c9e
SHA2565689e865b41193a4e90f46c571e8a5e7cb3f3bf032a768ff28747ee9dd868b7a
SHA5126d4666bf1dea58add7b2c30b4891feae33839c562c6056094aa0554dab4556f51bb95221afd87f926b47680001fce3190ee9dda1ed6d6c7e9def2330d75a1920
-
\Users\Admin\rosIYEAg\geUMsUkM.exeMD5
1078b9a3474b12867c0e487e2d37d60b
SHA17b2b4f3bea1c229732786c91bd353b117bbe2c9e
SHA2565689e865b41193a4e90f46c571e8a5e7cb3f3bf032a768ff28747ee9dd868b7a
SHA5126d4666bf1dea58add7b2c30b4891feae33839c562c6056094aa0554dab4556f51bb95221afd87f926b47680001fce3190ee9dda1ed6d6c7e9def2330d75a1920
-
memory/300-166-0x0000000000000000-mapping.dmp
-
memory/308-108-0x0000000000000000-mapping.dmp
-
memory/324-87-0x0000000000000000-mapping.dmp
-
memory/384-83-0x0000000000000000-mapping.dmp
-
memory/384-140-0x0000000000000000-mapping.dmp
-
memory/520-143-0x0000000000000000-mapping.dmp
-
memory/520-161-0x0000000000000000-mapping.dmp
-
memory/552-112-0x0000000000000000-mapping.dmp
-
memory/616-159-0x0000000000000000-mapping.dmp
-
memory/656-84-0x0000000000000000-mapping.dmp
-
memory/668-139-0x0000000000000000-mapping.dmp
-
memory/688-115-0x0000000000000000-mapping.dmp
-
memory/688-165-0x0000000000000000-mapping.dmp
-
memory/784-96-0x0000000000000000-mapping.dmp
-
memory/792-131-0x0000000000000000-mapping.dmp
-
memory/792-156-0x0000000000000000-mapping.dmp
-
memory/824-178-0x0000000000000000-mapping.dmp
-
memory/828-121-0x0000000000000000-mapping.dmp
-
memory/888-110-0x0000000000000000-mapping.dmp
-
memory/888-144-0x0000000000000000-mapping.dmp
-
memory/944-114-0x0000000000000000-mapping.dmp
-
memory/944-79-0x0000000000000000-mapping.dmp
-
memory/956-153-0x0000000000000000-mapping.dmp
-
memory/968-148-0x0000000000000000-mapping.dmp
-
memory/968-77-0x0000000000000000-mapping.dmp
-
memory/1092-107-0x0000000000000000-mapping.dmp
-
memory/1112-170-0x0000000000000000-mapping.dmp
-
memory/1144-104-0x0000000000000000-mapping.dmp
-
memory/1160-62-0x0000000000000000-mapping.dmp
-
memory/1168-174-0x0000000000000000-mapping.dmp
-
memory/1192-141-0x0000000000000000-mapping.dmp
-
memory/1240-59-0x00000000752B1000-0x00000000752B3000-memory.dmpFilesize
8KB
-
memory/1256-146-0x0000000000000000-mapping.dmp
-
memory/1256-99-0x0000000000000000-mapping.dmp
-
memory/1272-89-0x0000000000000000-mapping.dmp
-
memory/1272-128-0x0000000000000000-mapping.dmp
-
memory/1452-105-0x0000000000000000-mapping.dmp
-
memory/1476-168-0x0000000000000000-mapping.dmp
-
memory/1480-82-0x0000000000000000-mapping.dmp
-
memory/1520-72-0x0000000000000000-mapping.dmp
-
memory/1564-157-0x0000000000000000-mapping.dmp
-
memory/1604-90-0x0000000000000000-mapping.dmp
-
memory/1664-124-0x0000000000000000-mapping.dmp
-
memory/1672-85-0x0000000000000000-mapping.dmp
-
memory/1672-169-0x0000000000000000-mapping.dmp
-
memory/1676-151-0x0000000000000000-mapping.dmp
-
memory/1680-101-0x0000000000000000-mapping.dmp
-
memory/1688-73-0x0000000000000000-mapping.dmp
-
memory/1712-129-0x0000000000000000-mapping.dmp
-
memory/1756-135-0x0000000000000000-mapping.dmp
-
memory/1756-80-0x0000000000000000-mapping.dmp
-
memory/1760-76-0x0000000000000000-mapping.dmp
-
memory/1764-97-0x0000000000000000-mapping.dmp
-
memory/1764-75-0x0000000000000000-mapping.dmp
-
memory/1812-130-0x0000000000000000-mapping.dmp
-
memory/1876-127-0x0000000000000000-mapping.dmp
-
memory/1892-118-0x0000000000000000-mapping.dmp
-
memory/1896-103-0x0000000000000000-mapping.dmp
-
memory/1952-113-0x0000000000000000-mapping.dmp
-
memory/1972-93-0x0000000000000000-mapping.dmp
-
memory/1984-172-0x0000000000000000-mapping.dmp
-
memory/1988-67-0x0000000000000000-mapping.dmp
-
memory/1992-119-0x0000000000000000-mapping.dmp
-
memory/2008-92-0x0000000000000000-mapping.dmp
-
memory/2008-155-0x0000000000000000-mapping.dmp