5f32ef9a224027930381255b1ff7d6be7af83f4886006243effeee31ec775b6e

Analysis

max time kernel
151s
max time network
133s
platform
windows7_x64
resource
win7v20210408
submitted
05-05-2021 11:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa625b84_by_Libranalysis.exe
Size

534KB
MD5

aa625b8479b7874ae21cfce7f0bd6de1
SHA1

f5906108c38dd0ff1a5f846f80cbc648f03e5f0a
SHA256

5f32ef9a224027930381255b1ff7d6be7af83f4886006243effeee31ec775b6e
SHA512

3d047f66aff1786cce70dd8f465e0332a329d2e50c47fa63dab56a81923c3e19f6e536bfdef1d0f978b9ab41043e4aa836a54734e1a569577c58cd35065b7f82

Score

10^/10

evasion persistence ransomware spyware stealer trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

aa625b84_by_Libranalysis.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\mGYgsQMA\\gqwQksoU.exe,"	aa625b84_by_Libranalysis.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\ProgramData\\mGYgsQMA\\gqwQksoU.exe,"	aa625b84_by_Libranalysis.exe

Modifies visibility of file extensions in Explorer 2 TTPs
evasion

Hidden Files and Directories
T1158

Modify Registry
T1112
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Executes dropped EXE 3 IoCs

Processes:

KQwEksYA.exegqwQksoU.exeQwMgIcgc.exe

pid process

1332 KQwEksYA.exe
1360 gqwQksoU.exe
2020 QwMgIcgc.exe

pid	process
1332	KQwEksYA.exe
1360	gqwQksoU.exe
2020	QwMgIcgc.exe

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

gqwQksoU.exe

description	ioc	process
File created	C:\Users\Admin\Pictures\PushRedo.png.exe	gqwQksoU.exe
File created	C:\Users\Admin\Pictures\RegisterRead.png.exe	gqwQksoU.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

gqwQksoU.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\International\Geo\Nation	gqwQksoU.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1376 cmd.exe

pid	process
1376	cmd.exe

Loads dropped DLL 16 IoCs

Processes:

aa625b84_by_Libranalysis.exegqwQksoU.exe

pid	process
1840	aa625b84_by_Libranalysis.exe
1840	aa625b84_by_Libranalysis.exe
1840	aa625b84_by_Libranalysis.exe
1840	aa625b84_by_Libranalysis.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

aa625b84_by_Libranalysis.exeKQwEksYA.exegqwQksoU.exeQwMgIcgc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\KQwEksYA.exe = "C:\\Users\\Admin\\jOwAMAwE\\KQwEksYA.exe"	aa625b84_by_Libranalysis.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gqwQksoU.exe = "C:\\ProgramData\\mGYgsQMA\\gqwQksoU.exe"	aa625b84_by_Libranalysis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\KQwEksYA.exe = "C:\\Users\\Admin\\jOwAMAwE\\KQwEksYA.exe"	KQwEksYA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gqwQksoU.exe = "C:\\ProgramData\\mGYgsQMA\\gqwQksoU.exe"	gqwQksoU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gqwQksoU.exe = "C:\\ProgramData\\mGYgsQMA\\gqwQksoU.exe"	QwMgIcgc.exe

Drops file in System32 directory 2 IoCs

Processes:

QwMgIcgc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\jOwAMAwE	QwMgIcgc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\jOwAMAwE\KQwEksYA	QwMgIcgc.exe

Drops file in Windows directory 1 IoCs

Processes:

gqwQksoU.exe

description ioc process

File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico gqwQksoU.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico	gqwQksoU.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

pid	process
1848	reg.exe
1060	reg.exe
1164	reg.exe
1464	reg.exe
1560	reg.exe
1260	reg.exe
1264	reg.exe
1848	reg.exe
964	reg.exe
1032	reg.exe
1700	reg.exe
916	reg.exe
1848	reg.exe
756	reg.exe
916	reg.exe
1824	reg.exe
952	reg.exe
1572	reg.exe
1656	reg.exe
1468	reg.exe
484	reg.exe
1624	reg.exe
1888	reg.exe
1748	reg.exe
1280	reg.exe
396	reg.exe
1620	reg.exe
1468	reg.exe
1040	reg.exe
1628	reg.exe
828	reg.exe
932	reg.exe
1432	reg.exe
396	reg.exe
1748	reg.exe
1864	reg.exe
396	reg.exe
1368	reg.exe
592	reg.exe
1644	reg.exe
1620	reg.exe
828	reg.exe
1916	reg.exe
964	reg.exe
1664	reg.exe
1732	reg.exe
1700	reg.exe
916	reg.exe
1604	reg.exe
1520	reg.exe
1708	reg.exe
1656	reg.exe
1756	reg.exe
1748	reg.exe
1572	reg.exe
1048	reg.exe
928	reg.exe
1432	reg.exe
1816	reg.exe
1320	reg.exe
1284	reg.exe
820	reg.exe
1604	reg.exe
1644	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

aa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exeaa625b84_by_Libranalysis.exe

pid	process
1840	aa625b84_by_Libranalysis.exe
1840	aa625b84_by_Libranalysis.exe
1640	aa625b84_by_Libranalysis.exe
1640	aa625b84_by_Libranalysis.exe
932	aa625b84_by_Libranalysis.exe
932	aa625b84_by_Libranalysis.exe
1124	aa625b84_by_Libranalysis.exe
1124	aa625b84_by_Libranalysis.exe
1392	aa625b84_by_Libranalysis.exe
1392	aa625b84_by_Libranalysis.exe
1060	aa625b84_by_Libranalysis.exe
1060	aa625b84_by_Libranalysis.exe
272	aa625b84_by_Libranalysis.exe
272	aa625b84_by_Libranalysis.exe
828	aa625b84_by_Libranalysis.exe
828	aa625b84_by_Libranalysis.exe
1824	aa625b84_by_Libranalysis.exe
1824	aa625b84_by_Libranalysis.exe
1708	aa625b84_by_Libranalysis.exe
1708	aa625b84_by_Libranalysis.exe
1280	aa625b84_by_Libranalysis.exe
1280	aa625b84_by_Libranalysis.exe
1680	aa625b84_by_Libranalysis.exe
1680	aa625b84_by_Libranalysis.exe
1876	aa625b84_by_Libranalysis.exe
1876	aa625b84_by_Libranalysis.exe
1628	aa625b84_by_Libranalysis.exe
1628	aa625b84_by_Libranalysis.exe
556	aa625b84_by_Libranalysis.exe
556	aa625b84_by_Libranalysis.exe
1620	aa625b84_by_Libranalysis.exe
1620	aa625b84_by_Libranalysis.exe
1876	aa625b84_by_Libranalysis.exe
1876	aa625b84_by_Libranalysis.exe
752	aa625b84_by_Libranalysis.exe
752	aa625b84_by_Libranalysis.exe
660	aa625b84_by_Libranalysis.exe
660	aa625b84_by_Libranalysis.exe
1876	aa625b84_by_Libranalysis.exe
1876	aa625b84_by_Libranalysis.exe
1560	aa625b84_by_Libranalysis.exe
1560	aa625b84_by_Libranalysis.exe
1208	aa625b84_by_Libranalysis.exe
1208	aa625b84_by_Libranalysis.exe
1260	aa625b84_by_Libranalysis.exe
1260	aa625b84_by_Libranalysis.exe
912	aa625b84_by_Libranalysis.exe
912	aa625b84_by_Libranalysis.exe
1208	aa625b84_by_Libranalysis.exe
1208	aa625b84_by_Libranalysis.exe
1484	aa625b84_by_Libranalysis.exe
1484	aa625b84_by_Libranalysis.exe
1376	aa625b84_by_Libranalysis.exe
1376	aa625b84_by_Libranalysis.exe
1032	aa625b84_by_Libranalysis.exe
1032	aa625b84_by_Libranalysis.exe
1840	aa625b84_by_Libranalysis.exe
1840	aa625b84_by_Libranalysis.exe
944	aa625b84_by_Libranalysis.exe
944	aa625b84_by_Libranalysis.exe
1712	aa625b84_by_Libranalysis.exe
1712	aa625b84_by_Libranalysis.exe
1548	aa625b84_by_Libranalysis.exe
1548	aa625b84_by_Libranalysis.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

gqwQksoU.exe

pid process

1360 gqwQksoU.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

gqwQksoU.exe

pid	process
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe
1360	gqwQksoU.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

aa625b84_by_Libranalysis.execmd.exeaa625b84_by_Libranalysis.execmd.exeaa625b84_by_Libranalysis.execmd.exe

description	pid	process	target process
PID 1840 wrote to memory of 1332	1840	aa625b84_by_Libranalysis.exe	KQwEksYA.exe
PID 1840 wrote to memory of 1332	1840	aa625b84_by_Libranalysis.exe	KQwEksYA.exe
PID 1840 wrote to memory of 1332	1840	aa625b84_by_Libranalysis.exe	KQwEksYA.exe
PID 1840 wrote to memory of 1332	1840	aa625b84_by_Libranalysis.exe	KQwEksYA.exe
PID 1840 wrote to memory of 1360	1840	aa625b84_by_Libranalysis.exe	gqwQksoU.exe
PID 1840 wrote to memory of 1360	1840	aa625b84_by_Libranalysis.exe	gqwQksoU.exe
PID 1840 wrote to memory of 1360	1840	aa625b84_by_Libranalysis.exe	gqwQksoU.exe
PID 1840 wrote to memory of 1360	1840	aa625b84_by_Libranalysis.exe	gqwQksoU.exe
PID 1840 wrote to memory of 556	1840	aa625b84_by_Libranalysis.exe	cmd.exe
PID 1840 wrote to memory of 556	1840	aa625b84_by_Libranalysis.exe	cmd.exe
PID 1840 wrote to memory of 556	1840	aa625b84_by_Libranalysis.exe	cmd.exe
PID 1840 wrote to memory of 556	1840	aa625b84_by_Libranalysis.exe	cmd.exe
PID 1840 wrote to memory of 1600	1840	aa625b84_by_Libranalysis.exe	reg.exe
PID 1840 wrote to memory of 1600	1840	aa625b84_by_Libranalysis.exe	reg.exe
PID 1840 wrote to memory of 1600	1840	aa625b84_by_Libranalysis.exe	reg.exe
PID 1840 wrote to memory of 1600	1840	aa625b84_by_Libranalysis.exe	reg.exe
PID 1840 wrote to memory of 1740	1840	aa625b84_by_Libranalysis.exe	reg.exe
PID 1840 wrote to memory of 1740	1840	aa625b84_by_Libranalysis.exe	reg.exe
PID 1840 wrote to memory of 1740	1840	aa625b84_by_Libranalysis.exe	reg.exe
PID 1840 wrote to memory of 1740	1840	aa625b84_by_Libranalysis.exe	reg.exe
PID 1840 wrote to memory of 1888	1840	aa625b84_by_Libranalysis.exe	reg.exe
PID 1840 wrote to memory of 1888	1840	aa625b84_by_Libranalysis.exe	reg.exe
PID 1840 wrote to memory of 1888	1840	aa625b84_by_Libranalysis.exe	reg.exe
PID 1840 wrote to memory of 1888	1840	aa625b84_by_Libranalysis.exe	reg.exe
PID 556 wrote to memory of 1640	556	cmd.exe	aa625b84_by_Libranalysis.exe
PID 556 wrote to memory of 1640	556	cmd.exe	aa625b84_by_Libranalysis.exe
PID 556 wrote to memory of 1640	556	cmd.exe	aa625b84_by_Libranalysis.exe
PID 556 wrote to memory of 1640	556	cmd.exe	aa625b84_by_Libranalysis.exe
PID 1640 wrote to memory of 1656	1640	aa625b84_by_Libranalysis.exe	cmd.exe
PID 1640 wrote to memory of 1656	1640	aa625b84_by_Libranalysis.exe	cmd.exe
PID 1640 wrote to memory of 1656	1640	aa625b84_by_Libranalysis.exe	cmd.exe
PID 1640 wrote to memory of 1656	1640	aa625b84_by_Libranalysis.exe	cmd.exe
PID 1656 wrote to memory of 932	1656	cmd.exe	aa625b84_by_Libranalysis.exe
PID 1656 wrote to memory of 932	1656	cmd.exe	aa625b84_by_Libranalysis.exe
PID 1656 wrote to memory of 932	1656	cmd.exe	aa625b84_by_Libranalysis.exe
PID 1656 wrote to memory of 932	1656	cmd.exe	aa625b84_by_Libranalysis.exe
PID 1640 wrote to memory of 396	1640	aa625b84_by_Libranalysis.exe	reg.exe
PID 1640 wrote to memory of 396	1640	aa625b84_by_Libranalysis.exe	reg.exe
PID 1640 wrote to memory of 396	1640	aa625b84_by_Libranalysis.exe	reg.exe
PID 1640 wrote to memory of 396	1640	aa625b84_by_Libranalysis.exe	reg.exe
PID 1640 wrote to memory of 1148	1640	aa625b84_by_Libranalysis.exe	reg.exe
PID 1640 wrote to memory of 1148	1640	aa625b84_by_Libranalysis.exe	reg.exe
PID 1640 wrote to memory of 1148	1640	aa625b84_by_Libranalysis.exe	reg.exe
PID 1640 wrote to memory of 1148	1640	aa625b84_by_Libranalysis.exe	reg.exe
PID 1640 wrote to memory of 756	1640	aa625b84_by_Libranalysis.exe	reg.exe
PID 1640 wrote to memory of 756	1640	aa625b84_by_Libranalysis.exe	reg.exe
PID 1640 wrote to memory of 756	1640	aa625b84_by_Libranalysis.exe	reg.exe
PID 1640 wrote to memory of 756	1640	aa625b84_by_Libranalysis.exe	reg.exe
PID 932 wrote to memory of 660	932	aa625b84_by_Libranalysis.exe	cmd.exe
PID 932 wrote to memory of 660	932	aa625b84_by_Libranalysis.exe	cmd.exe
PID 932 wrote to memory of 660	932	aa625b84_by_Libranalysis.exe	cmd.exe
PID 932 wrote to memory of 660	932	aa625b84_by_Libranalysis.exe	cmd.exe
PID 1640 wrote to memory of 1812	1640	aa625b84_by_Libranalysis.exe	cmd.exe
PID 1640 wrote to memory of 1812	1640	aa625b84_by_Libranalysis.exe	cmd.exe
PID 1640 wrote to memory of 1812	1640	aa625b84_by_Libranalysis.exe	cmd.exe
PID 1640 wrote to memory of 1812	1640	aa625b84_by_Libranalysis.exe	cmd.exe
PID 660 wrote to memory of 1124	660	cmd.exe	aa625b84_by_Libranalysis.exe
PID 660 wrote to memory of 1124	660	cmd.exe	aa625b84_by_Libranalysis.exe
PID 660 wrote to memory of 1124	660	cmd.exe	aa625b84_by_Libranalysis.exe
PID 660 wrote to memory of 1124	660	cmd.exe	aa625b84_by_Libranalysis.exe
PID 932 wrote to memory of 1620	932	aa625b84_by_Libranalysis.exe	reg.exe
PID 932 wrote to memory of 1620	932	aa625b84_by_Libranalysis.exe	reg.exe
PID 932 wrote to memory of 1620	932	aa625b84_by_Libranalysis.exe	reg.exe
PID 932 wrote to memory of 1620	932	aa625b84_by_Libranalysis.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1840

C:\Users\Admin\jOwAMAwE\KQwEksYA.exe
"C:\Users\Admin\jOwAMAwE\KQwEksYA.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1332

C:\ProgramData\mGYgsQMA\gqwQksoU.exe
"C:\ProgramData\mGYgsQMA\gqwQksoU.exe"
2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1360

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
2⤵
- Suspicious use of WriteProcessMemory
PID:556

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
4⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:932

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
6⤵
- Suspicious use of WriteProcessMemory
PID:660

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
7⤵
- Suspicious behavior: EnumeratesProcesses
PID:1124

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
8⤵
PID:1752

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
9⤵
- Suspicious behavior: EnumeratesProcesses
PID:1392

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
10⤵
PID:1320

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1060

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
12⤵
PID:1800

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
13⤵
- Suspicious behavior: EnumeratesProcesses
PID:272

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
14⤵
PID:1644

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
15⤵
- Suspicious behavior: EnumeratesProcesses
PID:828

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
16⤵
PID:1724

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
17⤵
- Suspicious behavior: EnumeratesProcesses
PID:1824

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
18⤵
PID:832

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
19⤵
- Suspicious behavior: EnumeratesProcesses
PID:1708

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
20⤵
PID:972

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
21⤵
- Suspicious behavior: EnumeratesProcesses
PID:1280

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
22⤵
PID:828

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1680

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
24⤵
PID:592

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
25⤵
- Suspicious behavior: EnumeratesProcesses
PID:1876

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
26⤵
PID:1560

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
27⤵
- Suspicious behavior: EnumeratesProcesses
PID:1628

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
28⤵
PID:1732

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
29⤵
- Suspicious behavior: EnumeratesProcesses
PID:556

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
30⤵
PID:1392

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
31⤵
- Suspicious behavior: EnumeratesProcesses
PID:1620

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
32⤵
PID:928

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1876

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
34⤵
PID:556

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
35⤵
- Suspicious behavior: EnumeratesProcesses
PID:752

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
36⤵
PID:1736

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
37⤵
- Suspicious behavior: EnumeratesProcesses
PID:660

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
38⤵
PID:820

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
39⤵
- Suspicious behavior: EnumeratesProcesses
PID:1876

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
40⤵
PID:752

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
41⤵
- Suspicious behavior: EnumeratesProcesses
PID:1560

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
42⤵
PID:1620

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
43⤵
- Suspicious behavior: EnumeratesProcesses
PID:1208

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
44⤵
PID:1548

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
45⤵
- Suspicious behavior: EnumeratesProcesses
PID:1260

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
46⤵
PID:1468

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
47⤵
- Suspicious behavior: EnumeratesProcesses
PID:912

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
48⤵
PID:1736

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
49⤵
- Suspicious behavior: EnumeratesProcesses
PID:1208

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
50⤵
PID:1948

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
51⤵
- Suspicious behavior: EnumeratesProcesses
PID:1484

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
52⤵
PID:1600

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
53⤵
- Suspicious behavior: EnumeratesProcesses
PID:1376

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
54⤵
PID:1800

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
55⤵
- Suspicious behavior: EnumeratesProcesses
PID:1032

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
56⤵
PID:1484

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
57⤵
- Suspicious behavior: EnumeratesProcesses
PID:1840

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
58⤵
PID:1724

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
59⤵
- Suspicious behavior: EnumeratesProcesses
PID:944

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
60⤵
PID:1432

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
61⤵
- Suspicious behavior: EnumeratesProcesses
PID:1712

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
62⤵
PID:1644

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
63⤵
- Suspicious behavior: EnumeratesProcesses
PID:1548

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
64⤵
PID:484

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
65⤵
PID:1696

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
66⤵
PID:1032

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
67⤵
PID:1744

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
68⤵
PID:1644

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
69⤵
PID:1816

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
70⤵
PID:1280

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
71⤵
PID:1520

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
72⤵
PID:948

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
73⤵
PID:1712

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
74⤵
PID:1656

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
75⤵
PID:928

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
76⤵
PID:1164

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
77⤵
PID:832

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
78⤵
PID:1848

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
79⤵
PID:1696

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
80⤵
PID:1584

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
81⤵
PID:608

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
82⤵
PID:1612

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
83⤵
PID:952

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
84⤵
PID:1208

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
85⤵
PID:928

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
86⤵
PID:748

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
87⤵
PID:1756

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
88⤵
PID:1784

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
89⤵
PID:1624

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
90⤵
PID:1520

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
91⤵
PID:660

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
92⤵
PID:1600

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
93⤵
PID:1264

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
94⤵
PID:1860

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
95⤵
PID:1548

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
96⤵
PID:1664

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
97⤵
PID:1648

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
98⤵
PID:1048

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
99⤵
PID:1432

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
100⤵
PID:1284

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
101⤵
PID:1520

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
102⤵
PID:1876

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
103⤵
PID:1952

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
104⤵
PID:1644

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
105⤵
PID:1948

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
106⤵
PID:1208

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
107⤵
PID:608

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
108⤵
PID:1280

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
109⤵
PID:272

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
110⤵
PID:1644

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
111⤵
PID:1628

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
112⤵
PID:1584

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
113⤵
PID:1164

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
114⤵
PID:944

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
115⤵
PID:1280

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
116⤵
PID:1392

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
117⤵
PID:1048

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
118⤵
PID:916

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
119⤵
PID:1696

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
120⤵
PID:1060

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
121⤵
PID:1716

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
122⤵
PID:1952

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
123⤵
PID:1864

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
124⤵
PID:1624

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
125⤵
PID:916

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
126⤵
PID:1520

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
127⤵
PID:568

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis"
128⤵
PID:1784

C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
129⤵
PID:940

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
130⤵
- Modifies registry key
PID:1468

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
130⤵
PID:1628

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
130⤵
- Modifies registry key
PID:1624

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
128⤵
PID:1744

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
128⤵
- Modifies registry key
PID:592

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
128⤵
PID:1668

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\wSIgkQYE.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
128⤵
- Deletes itself
PID:1376

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
129⤵
PID:1948

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
126⤵
PID:1860

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
126⤵
- Modifies registry key
PID:1368

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
126⤵
- Modifies registry key
PID:484

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\kOYMssYY.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
126⤵
PID:1032

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
127⤵
PID:752

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
124⤵
PID:1124

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
124⤵
PID:940

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
124⤵
PID:608

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\JSooAwEc.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
124⤵
PID:1680

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
125⤵
PID:396

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
122⤵
PID:1612

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
122⤵
PID:1628

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
122⤵
- Modifies registry key
PID:1468

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\ekoIIEMA.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
122⤵
PID:1620

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
123⤵
PID:748

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
120⤵
PID:1732

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
120⤵
PID:952

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\wOcUUkAY.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
120⤵
PID:396

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
121⤵
PID:1948

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
120⤵
PID:1600

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
118⤵
PID:1520

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
118⤵
PID:1164

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\ZmQcocEI.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
118⤵
PID:748

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
119⤵
PID:484

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
118⤵
- Modifies registry key
PID:1656

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
116⤵
- Modifies registry key
PID:1432

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
116⤵
PID:1040

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
116⤵
PID:1404

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\JicsEgwY.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
116⤵
PID:1876

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
117⤵
PID:1916

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\VowkAMIs.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
114⤵
PID:1060

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
115⤵
PID:1848

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
114⤵
PID:828

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
114⤵
PID:1700

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
114⤵
PID:748

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
112⤵
PID:1032

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
112⤵
PID:972

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\TmEsoAEs.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
112⤵
PID:752

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
113⤵
PID:1376

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
112⤵
- Modifies registry key
PID:1708

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
110⤵
- Modifies registry key
PID:1520

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\OWswcEos.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
110⤵
PID:1284

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
111⤵
PID:608

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
110⤵
- Modifies registry key
PID:1604

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
110⤵
PID:948

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
108⤵
- Modifies registry key
PID:1620

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
108⤵
PID:1484

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\jkcssIYE.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
108⤵
PID:660

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
109⤵
PID:556

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
108⤵
PID:1840

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
106⤵
PID:1284

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
106⤵
PID:1628

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
106⤵
PID:832

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\kcscQMAU.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
106⤵
PID:972

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
107⤵
PID:1748

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
104⤵
- Modifies registry key
PID:916

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\meAYwEcY.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
104⤵
PID:1824

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
105⤵
PID:1756

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
104⤵
PID:1784

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
104⤵
- Modifies registry key
PID:1848

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
102⤵
PID:1612

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
102⤵
PID:1708

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
102⤵
- Modifies registry key
PID:964

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\SqwgwYMY.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
102⤵
PID:1588

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
103⤵
PID:1280

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
100⤵
PID:1860

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
100⤵
PID:660

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\kIUsYAMM.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
100⤵
PID:1208

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
101⤵
PID:1696

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
100⤵
PID:1624

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
98⤵
PID:1852

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
98⤵
- Modifies registry key
PID:1916

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
98⤵
PID:1952

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\wugwgoco.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
98⤵
PID:1468

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
99⤵
PID:1644

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
96⤵
PID:1716

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
96⤵
- Modifies registry key
PID:1320

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tOYEQAAQ.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
96⤵
PID:1148

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
97⤵
PID:832

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
96⤵
- Modifies registry key
PID:1032

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\LoossEgE.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
94⤵
PID:1284

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
95⤵
PID:944

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
94⤵
PID:1876

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
94⤵
PID:1404

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
94⤵
PID:396

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
92⤵
PID:1732

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\XSgcsYAI.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
92⤵
PID:1744

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
93⤵
PID:1048

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
92⤵
- Modifies registry key
PID:1700

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
92⤵
PID:1572

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
90⤵
- Modifies registry key
PID:916

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
90⤵
PID:1852

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\XOkUAcww.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
90⤵
PID:1712

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
91⤵
PID:1620

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
90⤵
PID:272

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
88⤵
- Modifies registry key
PID:932

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
88⤵
PID:1668

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
88⤵
PID:1716

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\xWkgwkco.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
88⤵
PID:964

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
89⤵
PID:1860

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
86⤵
PID:1060

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\yiosUYYQ.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
86⤵
PID:1700

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
87⤵
PID:1432

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
86⤵
PID:1048

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
86⤵
- Modifies registry key
PID:1816

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
84⤵
PID:1628

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
84⤵
- Modifies registry key
PID:828

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\necQYogw.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
84⤵
PID:272

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
85⤵
PID:940

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
84⤵
PID:568

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
82⤵
- Modifies registry key
PID:1700

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
82⤵
PID:1864

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\CkgEooUE.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
82⤵
PID:1040

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
83⤵
PID:944

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
82⤵
PID:916

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
80⤵
PID:1948

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
80⤵
- Modifies registry key
PID:1644

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\ScEoEQIM.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
80⤵
PID:1732

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
81⤵
PID:1860

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
80⤵
PID:964

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
78⤵
- Modifies registry key
PID:952

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\dkYYogEA.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
78⤵
PID:1376

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
79⤵
PID:1468

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
78⤵
PID:1824

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
78⤵
- Modifies registry key
PID:1572

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
76⤵
- Modifies registry key
PID:964

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
76⤵
- Modifies registry key
PID:1048

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
76⤵
PID:1736

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\eEYUMAso.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
76⤵
PID:1628

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
77⤵
PID:272

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
74⤵
- Modifies registry key
PID:1824

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\PqogoskE.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
74⤵
PID:660

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
75⤵
PID:556

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
74⤵
PID:1548

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
74⤵
- Modifies registry key
PID:1572

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
72⤵
- Modifies registry key
PID:1432

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
72⤵
- Modifies registry key
PID:1748

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
72⤵
- Modifies registry key
PID:828

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\BSUswoMw.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
72⤵
PID:272

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
73⤵
PID:1840

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
70⤵
- Modifies registry key
PID:396

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\GwowkEYc.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
70⤵
PID:952

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
71⤵
PID:1260

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
70⤵
- Modifies registry key
PID:1604

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
70⤵
PID:1160

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\JecAIgYY.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
68⤵
PID:1840

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
69⤵
PID:1680

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
68⤵
PID:272

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
68⤵
PID:828

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
68⤵
- Modifies registry key
PID:1620

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
66⤵
PID:396

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
66⤵
PID:1800

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
66⤵
PID:1160

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\zqIIQwAk.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
66⤵
PID:940

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
67⤵
PID:1664

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
64⤵
PID:1648

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\nMYsEcQs.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
64⤵
PID:1584

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
65⤵
PID:1280

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
64⤵
PID:972

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
64⤵
PID:1628

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
62⤵
PID:1948

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
62⤵
PID:1520

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
62⤵
PID:1784

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\pKwwIgUQ.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
62⤵
PID:1468

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
63⤵
PID:1664

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
60⤵
PID:748

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
60⤵
PID:1588

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
60⤵
- Modifies registry key
PID:1164

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\kCwIIgMs.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
60⤵
PID:1032

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
61⤵
PID:1736

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
58⤵
PID:1520

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\dMcQUIcY.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
58⤵
PID:1848

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
59⤵
PID:1696

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
58⤵
PID:1860

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
58⤵
- Modifies registry key
PID:1060

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
56⤵
PID:1696

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
56⤵
- Modifies registry key
PID:1848

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
56⤵
PID:1600

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\FAwksgMk.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
56⤵
PID:1852

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
57⤵
PID:1876

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
54⤵
PID:1048

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
54⤵
- Modifies registry key
PID:1732

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
54⤵
PID:828

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\ewgEIEIQ.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
54⤵
PID:1588

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
55⤵
PID:1948

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
52⤵
PID:1628

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
52⤵
PID:1744

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
52⤵
- Modifies registry key
PID:916

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\EoIMwMIM.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
52⤵
PID:624

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
53⤵
PID:1040

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
50⤵
- Modifies registry key
PID:1280

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
50⤵
- Modifies registry key
PID:396

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
50⤵
- Modifies registry key
PID:1756

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\dSEAYcsw.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
50⤵
PID:1320

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
51⤵
PID:272

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\OOYcUgAo.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
48⤵
PID:1040

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
49⤵
PID:1840

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
48⤵
PID:916

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
48⤵
PID:928

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
48⤵
- Modifies registry key
PID:1628

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
46⤵
PID:1280

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\ZyMAIwkE.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
46⤵
PID:940

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
47⤵
PID:1600

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
46⤵
PID:592

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
46⤵
PID:1716

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
44⤵
PID:928

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
44⤵
PID:1744

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
44⤵
PID:1432

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\lOQckcUs.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
44⤵
PID:820

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
45⤵
PID:1816

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
42⤵
PID:1708

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\vqEMUMcQ.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
42⤵
PID:964

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
43⤵
PID:1124

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
42⤵
PID:592

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
42⤵
PID:952

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
40⤵
- Modifies registry key
PID:1656

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
40⤵
PID:1432

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
40⤵
PID:1800

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\agwowcsM.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
40⤵
PID:1864

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
41⤵
PID:948

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
38⤵
PID:1032

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
38⤵
PID:1956

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tAgYMAcs.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
38⤵
PID:940

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
39⤵
PID:1588

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
38⤵
PID:592

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\Eucsgkkk.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
36⤵
PID:1784

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
37⤵
PID:1840

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
36⤵
PID:1656

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
36⤵
PID:1744

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
36⤵
- Modifies registry key
PID:1848

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
34⤵
- Modifies registry key
PID:1264

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
34⤵
PID:1716

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
34⤵
- Modifies registry key
PID:1664

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\aOgkwQQQ.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
34⤵
PID:1520

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
35⤵
PID:1036

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
32⤵
PID:1656

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
32⤵
PID:624

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
32⤵
PID:964

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\paQkkcYY.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
32⤵
PID:1852

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
33⤵
PID:396

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
30⤵
PID:1124

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
30⤵
PID:1664

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
30⤵
- Modifies registry key
PID:1644

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\dsokIIcE.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
30⤵
PID:1712

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
31⤵
PID:1724

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
28⤵
PID:964

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
28⤵
PID:1032

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\BWAkAEcU.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
28⤵
PID:1952

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
29⤵
PID:1824

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
28⤵
PID:1784

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
26⤵
PID:1404

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
26⤵
PID:1264

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\nqsAsEkg.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
26⤵
PID:1520

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
27⤵
PID:1320

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
26⤵
PID:1124

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
24⤵
PID:1784

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\PmAEskso.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
24⤵
PID:1756

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
25⤵
PID:1852

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
24⤵
PID:1864

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
24⤵
- Modifies registry key
PID:1260

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
22⤵
PID:1264

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
22⤵
- Modifies registry key
PID:820

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\AGgkcYEY.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
22⤵
PID:568

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
23⤵
PID:1468

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
22⤵
- Modifies registry key
PID:928

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
20⤵
PID:1560

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
20⤵
PID:1124

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\VGEMgYUo.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
20⤵
PID:1732

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
21⤵
PID:396

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
20⤵
PID:1484

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
18⤵
- Modifies registry key
PID:1864

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
18⤵
PID:1664

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
18⤵
PID:1680

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\RkcAMYEw.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
18⤵
PID:1464

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
19⤵
PID:1784

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
16⤵
PID:1956

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
16⤵
PID:1744

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
16⤵
PID:1148

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\gUMIsMEQ.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
16⤵
PID:1736

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
17⤵
PID:1816

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
14⤵
- Modifies registry key
PID:1748

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\qkIAEYUo.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
14⤵
PID:1664

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
14⤵
PID:1468

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
14⤵
PID:1280

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
12⤵
- Modifies registry key
PID:1284

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
12⤵
- Modifies registry key
PID:1748

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
12⤵
PID:608

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\sGAgQUgQ.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
12⤵
PID:1724

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
13⤵
PID:1600

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
10⤵
- Modifies registry key
PID:1560

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
10⤵
- Modifies registry key
PID:756

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
10⤵
PID:1744

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\cIcIUoMs.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
10⤵
PID:1036

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
11⤵
PID:1436

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
8⤵
PID:272

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
8⤵
- Modifies registry key
PID:1040

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
8⤵
PID:820

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\fMIkUUcc.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
8⤵
PID:1432

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
9⤵
PID:1848

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
6⤵
PID:1620

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
6⤵
PID:1208

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
6⤵
- Modifies registry key
PID:1464

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\UeMIkEMA.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
6⤵
PID:1732

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
7⤵
PID:1284

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
4⤵
- Modifies registry key
PID:396

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
4⤵
PID:1148

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
4⤵
PID:756

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\jYIYUQog.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
4⤵
PID:1812

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
5⤵
PID:1260

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
2⤵
PID:1600

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
2⤵
PID:1740

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
2⤵
- Modifies registry key
PID:1888

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\GUIwMIEY.bat" "C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis.exe""
2⤵
PID:1756

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
3⤵
PID:1680

C:\ProgramData\XyYgIgog\QwMgIcgc.exe
C:\ProgramData\XyYgIgog\QwMgIcgc.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2020

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:1712

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "65011297227614574123594252411324733731765699114-1334892595385521687-400992234"
1⤵
PID:1260

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Modify Registry

T1112

Hidden Files and Directories

T1158

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\XyYgIgog\QwMgIcgc.exe
MD5
e08f9db86245c94acc24d4f6ee2910ea

SHA1
99aca6ac596e6feb29b7a9154ac2ec0b14a6b568

SHA256
44f91d8d35cd704774c4887fef3fe625376983041ce4372777006e4611a5134c

SHA512
d1c8a7e7bef10e2275ec3dbe4c17eb1dd02e0d95c0ab6db0a6c763831d7ebcf6f315829e5dd69323b59812c3ae4e5bf4636c8ab4030950348f1b02d060729e97

Download Submit
C:\ProgramData\mGYgsQMA\gqwQksoU.exe
MD5
3251e8d462ca481ac6ab0e014de572c9

SHA1
54ecbeb1893f495754c244209069b4ce7d53deee

SHA256
af35a99e46b41c8be6628d97945044731d4af917afb603c9f9e6a349e42788cb

SHA512
410e4d4877998f0f61ca70661fde4e7ec9d31aba16422022d84c9ec14a780de55dedc2703e9978ae51b2a97f6f61b50f8a3fe9c9d6f1cd3d21ddce3580c3cd81

Download Submit
C:\Users\Admin\AppData\Local\Temp\AGgkcYEY.bat
MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\BWAkAEcU.bat
MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUIwMIEY.bat
MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\PmAEskso.bat
MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\RkcAMYEw.bat
MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\UeMIkEMA.bat
MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\VGEMgYUo.bat
MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
MD5
187048b427556605b452d1a18359bb8b

SHA1
19fef45d5f94903ac879fc2404490fc796ad1b08

SHA256
18d6564632c7a550efbc5db58e500e28c107dcf0cf06171ca765632de44a8a2b

SHA512
94c577a08d39e29799ecb60300f910a2797e7ff9b9dba82c8231dbff22a6c83ec8b42bc5d99c3277b28f0ef637aec2b2b25fbe459941088142becb9ca9e74094

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
MD5
187048b427556605b452d1a18359bb8b

SHA1
19fef45d5f94903ac879fc2404490fc796ad1b08

SHA256
18d6564632c7a550efbc5db58e500e28c107dcf0cf06171ca765632de44a8a2b

SHA512
94c577a08d39e29799ecb60300f910a2797e7ff9b9dba82c8231dbff22a6c83ec8b42bc5d99c3277b28f0ef637aec2b2b25fbe459941088142becb9ca9e74094

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
MD5
187048b427556605b452d1a18359bb8b

SHA1
19fef45d5f94903ac879fc2404490fc796ad1b08

SHA256
18d6564632c7a550efbc5db58e500e28c107dcf0cf06171ca765632de44a8a2b

SHA512
94c577a08d39e29799ecb60300f910a2797e7ff9b9dba82c8231dbff22a6c83ec8b42bc5d99c3277b28f0ef637aec2b2b25fbe459941088142becb9ca9e74094

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
MD5
187048b427556605b452d1a18359bb8b

SHA1
19fef45d5f94903ac879fc2404490fc796ad1b08

SHA256
18d6564632c7a550efbc5db58e500e28c107dcf0cf06171ca765632de44a8a2b

SHA512
94c577a08d39e29799ecb60300f910a2797e7ff9b9dba82c8231dbff22a6c83ec8b42bc5d99c3277b28f0ef637aec2b2b25fbe459941088142becb9ca9e74094

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
MD5
187048b427556605b452d1a18359bb8b

SHA1
19fef45d5f94903ac879fc2404490fc796ad1b08

SHA256
18d6564632c7a550efbc5db58e500e28c107dcf0cf06171ca765632de44a8a2b

SHA512
94c577a08d39e29799ecb60300f910a2797e7ff9b9dba82c8231dbff22a6c83ec8b42bc5d99c3277b28f0ef637aec2b2b25fbe459941088142becb9ca9e74094

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
MD5
187048b427556605b452d1a18359bb8b

SHA1
19fef45d5f94903ac879fc2404490fc796ad1b08

SHA256
18d6564632c7a550efbc5db58e500e28c107dcf0cf06171ca765632de44a8a2b

SHA512
94c577a08d39e29799ecb60300f910a2797e7ff9b9dba82c8231dbff22a6c83ec8b42bc5d99c3277b28f0ef637aec2b2b25fbe459941088142becb9ca9e74094

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
MD5
187048b427556605b452d1a18359bb8b

SHA1
19fef45d5f94903ac879fc2404490fc796ad1b08

SHA256
18d6564632c7a550efbc5db58e500e28c107dcf0cf06171ca765632de44a8a2b

SHA512
94c577a08d39e29799ecb60300f910a2797e7ff9b9dba82c8231dbff22a6c83ec8b42bc5d99c3277b28f0ef637aec2b2b25fbe459941088142becb9ca9e74094

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
MD5
187048b427556605b452d1a18359bb8b

SHA1
19fef45d5f94903ac879fc2404490fc796ad1b08

SHA256
18d6564632c7a550efbc5db58e500e28c107dcf0cf06171ca765632de44a8a2b

SHA512
94c577a08d39e29799ecb60300f910a2797e7ff9b9dba82c8231dbff22a6c83ec8b42bc5d99c3277b28f0ef637aec2b2b25fbe459941088142becb9ca9e74094

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
MD5
187048b427556605b452d1a18359bb8b

SHA1
19fef45d5f94903ac879fc2404490fc796ad1b08

SHA256
18d6564632c7a550efbc5db58e500e28c107dcf0cf06171ca765632de44a8a2b

SHA512
94c577a08d39e29799ecb60300f910a2797e7ff9b9dba82c8231dbff22a6c83ec8b42bc5d99c3277b28f0ef637aec2b2b25fbe459941088142becb9ca9e74094

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
MD5
187048b427556605b452d1a18359bb8b

SHA1
19fef45d5f94903ac879fc2404490fc796ad1b08

SHA256
18d6564632c7a550efbc5db58e500e28c107dcf0cf06171ca765632de44a8a2b

SHA512
94c577a08d39e29799ecb60300f910a2797e7ff9b9dba82c8231dbff22a6c83ec8b42bc5d99c3277b28f0ef637aec2b2b25fbe459941088142becb9ca9e74094

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
MD5
187048b427556605b452d1a18359bb8b

SHA1
19fef45d5f94903ac879fc2404490fc796ad1b08

SHA256
18d6564632c7a550efbc5db58e500e28c107dcf0cf06171ca765632de44a8a2b

SHA512
94c577a08d39e29799ecb60300f910a2797e7ff9b9dba82c8231dbff22a6c83ec8b42bc5d99c3277b28f0ef637aec2b2b25fbe459941088142becb9ca9e74094

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
MD5
187048b427556605b452d1a18359bb8b

SHA1
19fef45d5f94903ac879fc2404490fc796ad1b08

SHA256
18d6564632c7a550efbc5db58e500e28c107dcf0cf06171ca765632de44a8a2b

SHA512
94c577a08d39e29799ecb60300f910a2797e7ff9b9dba82c8231dbff22a6c83ec8b42bc5d99c3277b28f0ef637aec2b2b25fbe459941088142becb9ca9e74094

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
MD5
187048b427556605b452d1a18359bb8b

SHA1
19fef45d5f94903ac879fc2404490fc796ad1b08

SHA256
18d6564632c7a550efbc5db58e500e28c107dcf0cf06171ca765632de44a8a2b

SHA512
94c577a08d39e29799ecb60300f910a2797e7ff9b9dba82c8231dbff22a6c83ec8b42bc5d99c3277b28f0ef637aec2b2b25fbe459941088142becb9ca9e74094

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa625b84_by_Libranalysis
MD5
187048b427556605b452d1a18359bb8b

SHA1
19fef45d5f94903ac879fc2404490fc796ad1b08

SHA256
18d6564632c7a550efbc5db58e500e28c107dcf0cf06171ca765632de44a8a2b

SHA512
94c577a08d39e29799ecb60300f910a2797e7ff9b9dba82c8231dbff22a6c83ec8b42bc5d99c3277b28f0ef637aec2b2b25fbe459941088142becb9ca9e74094

Download Submit
C:\Users\Admin\AppData\Local\Temp\cIcIUoMs.bat
MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\dsokIIcE.bat
MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\fMIkUUcc.bat
MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs
MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs
MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs
MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs
MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs
MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs
MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs
MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs
MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs
MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs
MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs
MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs
MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs
MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\gUMIsMEQ.bat
MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\jYIYUQog.bat
MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\nqsAsEkg.bat
MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\qkIAEYUo.bat
MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\sGAgQUgQ.bat
MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\jOwAMAwE\KQwEksYA.exe
MD5
f8f51c75f4f363338b65e8c349788846

SHA1
c39b5b3755035c9d79735c2df8129858f0daddf8

SHA256
984d1f5a289f5bb3166e2e6b4fd26d67873c7615375a8bc0f38087b3e99729da

SHA512
5dba06b0a1b96525cde7d6946c843333ac331314e7d80db6aafa7abded6e2b863861533e8376cd50b7a4efcc80f3afef64a68a8cf5a48bf410def6171f712f21

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe
MD5
9d10f99a6712e28f8acd5641e3a7ea6b

SHA1
835e982347db919a681ba12f3891f62152e50f0d

SHA256
70964a0ed9011ea94044e15fa77edd9cf535cc79ed8e03a3721ff007e69595cc

SHA512
2141ee5c07aa3e038360013e3f40969e248bed05022d161b992df61f21934c5574ed9d3094ffd5245f5afd84815b24f80bda30055cf4d374f9c6254e842f6bd5

Download Submit
\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe
MD5
4d92f518527353c0db88a70fddcfd390

SHA1
c4baffc19e7d1f0e0ebf73bab86a491c1d152f98

SHA256
97e6f3fc1a9163f10b6502509d55bf75ee893967fb35f318954797e8ab4d4d9c

SHA512
05a8136ccc45ef73cd5c70ee0ef204d9d2b48b950e938494b6d1a61dfba37527c9600382321d1c031dc74e4cf3e16f001ae0f8cd64d76d765f5509ce8dc76452

Download Submit
\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe
MD5
4d92f518527353c0db88a70fddcfd390

SHA1
c4baffc19e7d1f0e0ebf73bab86a491c1d152f98

SHA256
97e6f3fc1a9163f10b6502509d55bf75ee893967fb35f318954797e8ab4d4d9c

SHA512
05a8136ccc45ef73cd5c70ee0ef204d9d2b48b950e938494b6d1a61dfba37527c9600382321d1c031dc74e4cf3e16f001ae0f8cd64d76d765f5509ce8dc76452

Download Submit
\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE
MD5
a41e524f8d45f0074fd07805ff0c9b12

SHA1
948deacf95a60c3fdf17e0e4db1931a6f3fc5d38

SHA256
082329648337e5ba7377fed9d8a178809f37eecb8d795b93cca4ec07d8640ff7

SHA512
91bf4be7e82536a85a840dbc9f3ce7b7927d1cedf6391aac93989abae210620433e685b86a12d133a72369a4f8a665c46ac7fc9e8a806e2872d8b1514cbb305f

Download Submit
\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE
MD5
a41e524f8d45f0074fd07805ff0c9b12

SHA1
948deacf95a60c3fdf17e0e4db1931a6f3fc5d38

SHA256
082329648337e5ba7377fed9d8a178809f37eecb8d795b93cca4ec07d8640ff7

SHA512
91bf4be7e82536a85a840dbc9f3ce7b7927d1cedf6391aac93989abae210620433e685b86a12d133a72369a4f8a665c46ac7fc9e8a806e2872d8b1514cbb305f

Download Submit
\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe
MD5
c87e561258f2f8650cef999bf643a731

SHA1
2c64b901284908e8ed59cf9c912f17d45b05e0af

SHA256
a1dfa6639bef3cb4e41175c43730d46a51393942ead826337ca9541ac210c67b

SHA512
dea4833aa712c5823f800f5f5a2adcf241c1b2b6747872f540f5ff9da6795c4ddb73db0912593337083c7c67b91e9eaf1b3d39a34b99980fd5904ba3d7d62f6c

Download Submit
\ProgramData\mGYgsQMA\gqwQksoU.exe
MD5
3251e8d462ca481ac6ab0e014de572c9

SHA1
54ecbeb1893f495754c244209069b4ce7d53deee

SHA256
af35a99e46b41c8be6628d97945044731d4af917afb603c9f9e6a349e42788cb

SHA512
410e4d4877998f0f61ca70661fde4e7ec9d31aba16422022d84c9ec14a780de55dedc2703e9978ae51b2a97f6f61b50f8a3fe9c9d6f1cd3d21ddce3580c3cd81

Download Submit
\ProgramData\mGYgsQMA\gqwQksoU.exe
MD5
3251e8d462ca481ac6ab0e014de572c9

SHA1
54ecbeb1893f495754c244209069b4ce7d53deee

SHA256
af35a99e46b41c8be6628d97945044731d4af917afb603c9f9e6a349e42788cb

SHA512
410e4d4877998f0f61ca70661fde4e7ec9d31aba16422022d84c9ec14a780de55dedc2703e9978ae51b2a97f6f61b50f8a3fe9c9d6f1cd3d21ddce3580c3cd81

Download Submit
\Users\Admin\jOwAMAwE\KQwEksYA.exe
MD5
f8f51c75f4f363338b65e8c349788846

SHA1
c39b5b3755035c9d79735c2df8129858f0daddf8

SHA256
984d1f5a289f5bb3166e2e6b4fd26d67873c7615375a8bc0f38087b3e99729da

SHA512
5dba06b0a1b96525cde7d6946c843333ac331314e7d80db6aafa7abded6e2b863861533e8376cd50b7a4efcc80f3afef64a68a8cf5a48bf410def6171f712f21

Download Submit
\Users\Admin\jOwAMAwE\KQwEksYA.exe
MD5
f8f51c75f4f363338b65e8c349788846

SHA1
c39b5b3755035c9d79735c2df8129858f0daddf8

SHA256
984d1f5a289f5bb3166e2e6b4fd26d67873c7615375a8bc0f38087b3e99729da

SHA512
5dba06b0a1b96525cde7d6946c843333ac331314e7d80db6aafa7abded6e2b863861533e8376cd50b7a4efcc80f3afef64a68a8cf5a48bf410def6171f712f21

Download Submit
memory/272-134-0x0000000000000000-mapping.dmp

Download
memory/272-103-0x0000000000000000-mapping.dmp

Download
memory/396-83-0x0000000000000000-mapping.dmp

Download
memory/556-73-0x0000000000000000-mapping.dmp

Download
memory/608-129-0x0000000000000000-mapping.dmp

Download
memory/660-87-0x0000000000000000-mapping.dmp

Download
memory/756-117-0x0000000000000000-mapping.dmp

Download
memory/756-85-0x0000000000000000-mapping.dmp

Download
memory/820-104-0x0000000000000000-mapping.dmp

Download
memory/828-150-0x0000000000000000-mapping.dmp

Download
memory/832-175-0x0000000000000000-mapping.dmp

Download
memory/932-81-0x0000000000000000-mapping.dmp

Download
memory/1036-122-0x0000000000000000-mapping.dmp

Download
memory/1040-106-0x0000000000000000-mapping.dmp

Download
memory/1060-119-0x0000000000000000-mapping.dmp

Download
memory/1124-89-0x0000000000000000-mapping.dmp

Download
memory/1148-170-0x0000000000000000-mapping.dmp

Download
memory/1148-84-0x0000000000000000-mapping.dmp

Download
memory/1208-93-0x0000000000000000-mapping.dmp

Download
memory/1260-94-0x0000000000000000-mapping.dmp

Download
memory/1280-155-0x0000000000000000-mapping.dmp

Download
memory/1284-127-0x0000000000000000-mapping.dmp

Download
memory/1284-101-0x0000000000000000-mapping.dmp

Download
memory/1320-115-0x0000000000000000-mapping.dmp

Download
memory/1332-63-0x0000000000000000-mapping.dmp

Download
memory/1360-68-0x0000000000000000-mapping.dmp

Download
memory/1392-102-0x0000000000000000-mapping.dmp

Download
memory/1432-108-0x0000000000000000-mapping.dmp

Download
memory/1436-124-0x0000000000000000-mapping.dmp

Download
memory/1464-95-0x0000000000000000-mapping.dmp

Download
memory/1464-183-0x0000000000000000-mapping.dmp

Download
memory/1468-157-0x0000000000000000-mapping.dmp

Download
memory/1560-116-0x0000000000000000-mapping.dmp

Download
memory/1600-74-0x0000000000000000-mapping.dmp

Download
memory/1600-138-0x0000000000000000-mapping.dmp

Download
memory/1620-91-0x0000000000000000-mapping.dmp

Download
memory/1640-77-0x0000000000000000-mapping.dmp

Download
memory/1644-149-0x0000000000000000-mapping.dmp

Download
memory/1656-80-0x0000000000000000-mapping.dmp

Download
memory/1664-181-0x0000000000000000-mapping.dmp

Download
memory/1664-159-0x0000000000000000-mapping.dmp

Download
memory/1680-182-0x0000000000000000-mapping.dmp

Download
memory/1680-141-0x0000000000000000-mapping.dmp

Download
memory/1708-178-0x0000000000000000-mapping.dmp

Download
memory/1712-161-0x0000000000000000-mapping.dmp

Download
memory/1724-165-0x0000000000000000-mapping.dmp

Download
memory/1724-131-0x0000000000000000-mapping.dmp

Download
memory/1732-96-0x0000000000000000-mapping.dmp

Download
memory/1736-171-0x0000000000000000-mapping.dmp

Download
memory/1740-75-0x0000000000000000-mapping.dmp

Download
memory/1744-169-0x0000000000000000-mapping.dmp

Download
memory/1744-118-0x0000000000000000-mapping.dmp

Download
memory/1748-152-0x0000000000000000-mapping.dmp

Download
memory/1748-128-0x0000000000000000-mapping.dmp

Download
memory/1752-98-0x0000000000000000-mapping.dmp

Download
memory/1756-136-0x0000000000000000-mapping.dmp

Download
memory/1800-126-0x0000000000000000-mapping.dmp

Download
memory/1812-88-0x0000000000000000-mapping.dmp

Download
memory/1816-173-0x0000000000000000-mapping.dmp

Download
memory/1824-166-0x0000000000000000-mapping.dmp

Download
memory/1840-60-0x0000000074D91000-0x0000000074D93000-memory.dmp

Filesize
8KB

Download
memory/1848-111-0x0000000000000000-mapping.dmp

Download
memory/1864-180-0x0000000000000000-mapping.dmp

Download
memory/1888-76-0x0000000000000000-mapping.dmp

Download
memory/1956-168-0x0000000000000000-mapping.dmp

Download