fa126a21c23cf57eb2ebbc8cd9df0a39707dd64a090f0f299416fca5a7fc63fb

Analysis

max time kernel
157s
max time network
129s
platform
windows7_x64
resource
win7v20210408
submitted
05/05/2021, 08:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a0be7f64_by_Libranalysis.exe
Size 623KB
Sample210505-bc9wt8db3n
SHA256 fa126a21c23cf57eb2ebbc8cd9df0a39707dd64a090f0f299416fca5a7fc63fb
MD5 a0be7f64f2215888a783b36e9d0a1f6d
SHA1 053b7954128083258c1c1f106763f18e5c26fbf1
SHA512 f1ec72fd719d565af79805f7ac916c75c321f632681ca9fbf01628e944f8ff7cb80f0190bbd574bd1c2f7cfc5c8446b203fd38e3383184d472e0b0b7b8970f64
MD5 SHA1 SHA512

Score

10^/10

evasion persistence ransomware spyware stealer trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\uMcYkIsM\\qQoUsQEI.exe,"	a0be7f64_by_Libranalysis.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\ProgramData\\uMcYkIsM\\qQoUsQEI.exe,"	a0be7f64_by_Libranalysis.exe

Modifies visibility of file extensions in Explorer 2 TTPs
evasion

Hidden Files and Directories
T1158

Modify Registry
T1112
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Executes dropped EXE 3 IoCs

pid	Process
1508	VUIsYYQI.exe
1944	qQoUsQEI.exe
1884	BiwQwogk.exe

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File created	C:\Users\Admin\Pictures\GetRestart.png.exe	qQoUsQEI.exe
File created	C:\Users\Admin\Pictures\RestoreResize.png.exe	qQoUsQEI.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\International\Geo\Nation	qQoUsQEI.exe

Deletes itself 1 IoCs

pid	Process
1436	cmd.exe

Loads dropped DLL 16 IoCs

pid	Process
784	a0be7f64_by_Libranalysis.exe
784	a0be7f64_by_Libranalysis.exe
784	a0be7f64_by_Libranalysis.exe
784	a0be7f64_by_Libranalysis.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qQoUsQEI.exe = "C:\\ProgramData\\uMcYkIsM\\qQoUsQEI.exe"	a0be7f64_by_Libranalysis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\VUIsYYQI.exe = "C:\\Users\\Admin\\kqYIUgws\\VUIsYYQI.exe"	VUIsYYQI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qQoUsQEI.exe = "C:\\ProgramData\\uMcYkIsM\\qQoUsQEI.exe"	qQoUsQEI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qQoUsQEI.exe = "C:\\ProgramData\\uMcYkIsM\\qQoUsQEI.exe"	BiwQwogk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\VUIsYYQI.exe = "C:\\Users\\Admin\\kqYIUgws\\VUIsYYQI.exe"	a0be7f64_by_Libranalysis.exe

Checks whether UAC is enabled 1 TTPs 12 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cscript.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cscript.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a0be7f64_by_Libranalysis.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0be7f64_by_Libranalysis.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a0be7f64_by_Libranalysis.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0be7f64_by_Libranalysis.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\kqYIUgws	BiwQwogk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\kqYIUgws\VUIsYYQI	BiwQwogk.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico	qQoUsQEI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
2012	reg.exe
524	reg.exe
1288	reg.exe
1240	reg.exe
864	reg.exe
296	reg.exe
584	reg.exe
960	reg.exe
916	reg.exe
1300	reg.exe
1204	reg.exe
332	reg.exe
1568	reg.exe
1280	reg.exe
296	reg.exe
1284	reg.exe
1068	reg.exe
864	reg.exe
916	reg.exe
1352	reg.exe
1332	reg.exe
960	reg.exe
1624	reg.exe
760	reg.exe
984	reg.exe
804	reg.exe
1232	reg.exe
472	reg.exe
624	reg.exe
1604	reg.exe
556	reg.exe
2004	reg.exe
928	reg.exe
1352	reg.exe
584	reg.exe
1532	reg.exe
1616	reg.exe
852	reg.exe
1556	reg.exe
852	reg.exe
1436	reg.exe
760	reg.exe
2016	reg.exe
864	reg.exe
1300	reg.exe
1544	reg.exe
2012	reg.exe
804	reg.exe
420	reg.exe
864	reg.exe
1544	reg.exe
1424	reg.exe
332	reg.exe
1052	reg.exe
556	reg.exe
1604	reg.exe
804	reg.exe
2012	reg.exe
916	reg.exe
840	reg.exe
1756	reg.exe
1988	reg.exe
1240	reg.exe
420	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
784	a0be7f64_by_Libranalysis.exe
784	a0be7f64_by_Libranalysis.exe
1140	a0be7f64_by_Libranalysis.exe
1140	a0be7f64_by_Libranalysis.exe
1324	a0be7f64_by_Libranalysis.exe
1324	a0be7f64_by_Libranalysis.exe
1468	a0be7f64_by_Libranalysis.exe
1468	a0be7f64_by_Libranalysis.exe
1204	a0be7f64_by_Libranalysis.exe
1204	a0be7f64_by_Libranalysis.exe
1548	a0be7f64_by_Libranalysis.exe
1548	a0be7f64_by_Libranalysis.exe
472	a0be7f64_by_Libranalysis.exe
472	a0be7f64_by_Libranalysis.exe
1968	a0be7f64_by_Libranalysis.exe
1968	a0be7f64_by_Libranalysis.exe
1580	a0be7f64_by_Libranalysis.exe
1580	a0be7f64_by_Libranalysis.exe
584	reg.exe
584	reg.exe
1072	a0be7f64_by_Libranalysis.exe
1072	a0be7f64_by_Libranalysis.exe
1576	a0be7f64_by_Libranalysis.exe
1576	a0be7f64_by_Libranalysis.exe
1756	a0be7f64_by_Libranalysis.exe
1756	a0be7f64_by_Libranalysis.exe
568	a0be7f64_by_Libranalysis.exe
568	a0be7f64_by_Libranalysis.exe
1336	a0be7f64_by_Libranalysis.exe
1336	a0be7f64_by_Libranalysis.exe
1452	a0be7f64_by_Libranalysis.exe
1452	a0be7f64_by_Libranalysis.exe
1552	a0be7f64_by_Libranalysis.exe
1552	a0be7f64_by_Libranalysis.exe
984	a0be7f64_by_Libranalysis.exe
984	a0be7f64_by_Libranalysis.exe
2016	a0be7f64_by_Libranalysis.exe
2016	a0be7f64_by_Libranalysis.exe
1864	a0be7f64_by_Libranalysis.exe
1864	a0be7f64_by_Libranalysis.exe
1352	a0be7f64_by_Libranalysis.exe
1352	a0be7f64_by_Libranalysis.exe
740	a0be7f64_by_Libranalysis.exe
740	a0be7f64_by_Libranalysis.exe
852	a0be7f64_by_Libranalysis.exe
852	a0be7f64_by_Libranalysis.exe
1248	a0be7f64_by_Libranalysis.exe
1248	a0be7f64_by_Libranalysis.exe
1532	cscript.exe
1532	cscript.exe
1352	a0be7f64_by_Libranalysis.exe
1352	a0be7f64_by_Libranalysis.exe
1556	a0be7f64_by_Libranalysis.exe
1556	a0be7f64_by_Libranalysis.exe
940	a0be7f64_by_Libranalysis.exe
940	a0be7f64_by_Libranalysis.exe
1324	a0be7f64_by_Libranalysis.exe
1324	a0be7f64_by_Libranalysis.exe
936	a0be7f64_by_Libranalysis.exe
936	a0be7f64_by_Libranalysis.exe
1756	a0be7f64_by_Libranalysis.exe
1756	a0be7f64_by_Libranalysis.exe
1224	a0be7f64_by_Libranalysis.exe
1224	a0be7f64_by_Libranalysis.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1944	qQoUsQEI.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe
1944	qQoUsQEI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 1508	784	a0be7f64_by_Libranalysis.exe	26
PID 784 wrote to memory of 1508	784	a0be7f64_by_Libranalysis.exe	26
PID 784 wrote to memory of 1508	784	a0be7f64_by_Libranalysis.exe	26
PID 784 wrote to memory of 1508	784	a0be7f64_by_Libranalysis.exe	26
PID 784 wrote to memory of 1944	784	a0be7f64_by_Libranalysis.exe	27
PID 784 wrote to memory of 1944	784	a0be7f64_by_Libranalysis.exe	27
PID 784 wrote to memory of 1944	784	a0be7f64_by_Libranalysis.exe	27
PID 784 wrote to memory of 1944	784	a0be7f64_by_Libranalysis.exe	27
PID 784 wrote to memory of 1620	784	a0be7f64_by_Libranalysis.exe	29
PID 784 wrote to memory of 1620	784	a0be7f64_by_Libranalysis.exe	29
PID 784 wrote to memory of 1620	784	a0be7f64_by_Libranalysis.exe	29
PID 784 wrote to memory of 1620	784	a0be7f64_by_Libranalysis.exe	29
PID 1620 wrote to memory of 1140	1620	cmd.exe	31
PID 1620 wrote to memory of 1140	1620	cmd.exe	31
PID 1620 wrote to memory of 1140	1620	cmd.exe	31
PID 1620 wrote to memory of 1140	1620	cmd.exe	31
PID 1140 wrote to memory of 836	1140	a0be7f64_by_Libranalysis.exe	33
PID 1140 wrote to memory of 836	1140	a0be7f64_by_Libranalysis.exe	33
PID 1140 wrote to memory of 836	1140	a0be7f64_by_Libranalysis.exe	33
PID 1140 wrote to memory of 836	1140	a0be7f64_by_Libranalysis.exe	33
PID 836 wrote to memory of 1324	836	cmd.exe	35
PID 836 wrote to memory of 1324	836	cmd.exe	35
PID 836 wrote to memory of 1324	836	cmd.exe	35
PID 836 wrote to memory of 1324	836	cmd.exe	35
PID 1324 wrote to memory of 768	1324	a0be7f64_by_Libranalysis.exe	37
PID 1324 wrote to memory of 768	1324	a0be7f64_by_Libranalysis.exe	37
PID 1324 wrote to memory of 768	1324	a0be7f64_by_Libranalysis.exe	37
PID 1324 wrote to memory of 768	1324	a0be7f64_by_Libranalysis.exe	37
PID 768 wrote to memory of 1468	768	cmd.exe	39
PID 768 wrote to memory of 1468	768	cmd.exe	39
PID 768 wrote to memory of 1468	768	cmd.exe	39
PID 768 wrote to memory of 1468	768	cmd.exe	39
PID 784 wrote to memory of 2008	784	a0be7f64_by_Libranalysis.exe	32
PID 784 wrote to memory of 2008	784	a0be7f64_by_Libranalysis.exe	32
PID 784 wrote to memory of 2008	784	a0be7f64_by_Libranalysis.exe	32
PID 784 wrote to memory of 2008	784	a0be7f64_by_Libranalysis.exe	32
PID 1140 wrote to memory of 1172	1140	a0be7f64_by_Libranalysis.exe	36
PID 1140 wrote to memory of 1172	1140	a0be7f64_by_Libranalysis.exe	36
PID 1140 wrote to memory of 1172	1140	a0be7f64_by_Libranalysis.exe	36
PID 1140 wrote to memory of 1172	1140	a0be7f64_by_Libranalysis.exe	36
PID 784 wrote to memory of 1456	784	a0be7f64_by_Libranalysis.exe	55
PID 784 wrote to memory of 1456	784	a0be7f64_by_Libranalysis.exe	55
PID 784 wrote to memory of 1456	784	a0be7f64_by_Libranalysis.exe	55
PID 784 wrote to memory of 1456	784	a0be7f64_by_Libranalysis.exe	55
PID 1140 wrote to memory of 1424	1140	a0be7f64_by_Libranalysis.exe	54
PID 1140 wrote to memory of 1424	1140	a0be7f64_by_Libranalysis.exe	54
PID 1140 wrote to memory of 1424	1140	a0be7f64_by_Libranalysis.exe	54
PID 1140 wrote to memory of 1424	1140	a0be7f64_by_Libranalysis.exe	54
PID 784 wrote to memory of 1448	784	a0be7f64_by_Libranalysis.exe	40
PID 784 wrote to memory of 1448	784	a0be7f64_by_Libranalysis.exe	40
PID 784 wrote to memory of 1448	784	a0be7f64_by_Libranalysis.exe	40
PID 784 wrote to memory of 1448	784	a0be7f64_by_Libranalysis.exe	40
PID 1324 wrote to memory of 1764	1324	a0be7f64_by_Libranalysis.exe	51
PID 1324 wrote to memory of 1764	1324	a0be7f64_by_Libranalysis.exe	51
PID 1324 wrote to memory of 1764	1324	a0be7f64_by_Libranalysis.exe	51
PID 1324 wrote to memory of 1764	1324	a0be7f64_by_Libranalysis.exe	51
PID 1140 wrote to memory of 552	1140	a0be7f64_by_Libranalysis.exe	47
PID 1140 wrote to memory of 552	1140	a0be7f64_by_Libranalysis.exe	47
PID 1140 wrote to memory of 552	1140	a0be7f64_by_Libranalysis.exe	47
PID 1140 wrote to memory of 552	1140	a0be7f64_by_Libranalysis.exe	47
PID 1324 wrote to memory of 956	1324	a0be7f64_by_Libranalysis.exe	42
PID 1324 wrote to memory of 956	1324	a0be7f64_by_Libranalysis.exe	42
PID 1324 wrote to memory of 956	1324	a0be7f64_by_Libranalysis.exe	42
PID 1324 wrote to memory of 956	1324	a0be7f64_by_Libranalysis.exe	42

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	a0be7f64_by_Libranalysis.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	a0be7f64_by_Libranalysis.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0be7f64_by_Libranalysis.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0be7f64_by_Libranalysis.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cmd.exe

C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:784
- C:\Users\Admin\kqYIUgws\VUIsYYQI.exe
  "C:\Users\Admin\kqYIUgws\VUIsYYQI.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1508
- C:\ProgramData\uMcYkIsM\qQoUsQEI.exe
  "C:\ProgramData\uMcYkIsM\qQoUsQEI.exe"
  2⤵
  - Executes dropped EXE
  - Modifies extensions of user files
  - Checks computer location settings
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:1944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
    C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:836
    - - C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1324
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1468
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        8⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1204
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        10⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        11⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1548
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        12⤵
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        13⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:472
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        14⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        15⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1968
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        16⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        17⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1580
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        18⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        19⤵
        
        PID:584
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        20⤵
        
        PID:472
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        21⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1072
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        22⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        23⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1576
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        24⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        25⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        26⤵
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        27⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        28⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        29⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1336
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        30⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        31⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1452
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        32⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        33⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1552
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        34⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        35⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:984
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        36⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        37⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2016
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        38⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        39⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1864
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        40⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        41⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1352
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        42⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        43⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:740
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        44⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        45⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:852
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        46⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        47⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1248
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        48⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        49⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        50⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        51⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1352
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        52⤵
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        53⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1556
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        54⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        55⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:940
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        56⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        57⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1324
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        58⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        59⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:936
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        60⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        61⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        62⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        63⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1224
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        64⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        65⤵
        
        PID:296
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        66⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        67⤵
        
        PID:936
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        68⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        69⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        70⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        71⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        72⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        73⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        74⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        75⤵
        
        PID:740
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        76⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        77⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        78⤵
        Checks whether UAC is enabled
        System policy modification
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        79⤵
        Checks whether UAC is enabled
        System policy modification
        
        PID:420
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        80⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        81⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        82⤵
        Checks whether UAC is enabled
        System policy modification
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        83⤵
        
        PID:936
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        84⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        85⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        86⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        87⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        88⤵
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        89⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        90⤵
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        91⤵
        Checks whether UAC is enabled
        System policy modification
        
        PID:848
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        92⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        93⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        94⤵
        Checks whether UAC is enabled
        System policy modification
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        95⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        96⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        97⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        98⤵
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        99⤵
        
        PID:332
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        100⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        101⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        102⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        103⤵
        
        PID:624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        104⤵
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        105⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        106⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        107⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        108⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        109⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        110⤵
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        111⤵
        
        PID:664
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        112⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        113⤵
        
        PID:904
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        114⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        115⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        116⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        117⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        118⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        119⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        120⤵
        
        PID:664
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        121⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        122⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        123⤵
        
        PID:472
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        124⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        125⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        126⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        127⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        128⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        129⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        130⤵
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        131⤵
        
        PID:324
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        132⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        133⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        134⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        135⤵
        
        PID:584
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        136⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        137⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        138⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        139⤵
        
        PID:420
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        140⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        141⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        142⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        143⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        144⤵
        
        PID:296
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        145⤵
        
        PID:840
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        146⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        147⤵
        
        PID:940
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        148⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        149⤵
        
        PID:384
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        150⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        151⤵
        
        PID:936
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        152⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        153⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        154⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        155⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        156⤵
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        157⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        158⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        159⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        160⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        161⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        162⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        163⤵
        
        PID:864
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        164⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        165⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        166⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        167⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        168⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        168⤵
        Modifies registry key
        
        PID:960
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        168⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        166⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        166⤵
        Modifies registry key
        
        PID:1332
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        166⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\DUMAcAUQ.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        166⤵
        Deletes itself
        
        PID:1436
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        167⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        164⤵
        
        PID:936
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        164⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        164⤵
        Modifies registry key
        
        PID:584
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\UmcsEMks.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        164⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        165⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        162⤵
        Modifies registry key
        
        PID:420
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        162⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        162⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\zKgEgwIs.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        162⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        163⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        160⤵
        
        PID:804
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\BOgEoUkU.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        160⤵
        
        PID:472
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        161⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        160⤵
        Modifies registry key
        
        PID:1240
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        160⤵
        
        PID:904
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        158⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\uuQgQYoE.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        158⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        159⤵
        
        PID:852
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        158⤵
        
        PID:864
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        158⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        156⤵
        Modifies registry key
        
        PID:1352
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\qwEYEcMQ.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        156⤵
        
        PID:940
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        157⤵
        
        PID:472
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        156⤵
        Modifies registry key
        
        PID:1288
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        156⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        154⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        154⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        154⤵
        
        PID:340
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\AmkQoEMk.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        154⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        155⤵
        
        PID:740
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        152⤵
        
        PID:864
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        152⤵
        Modifies registry key
        
        PID:296
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        152⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\YCEYIIws.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        152⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        153⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        150⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        150⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\kMEwkUYE.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        150⤵
        
        PID:904
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        151⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        150⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        148⤵
        
        PID:340
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\gCUEsAws.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        148⤵
        
        PID:804
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        149⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        148⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        148⤵
        
        PID:864
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        146⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        146⤵
        Modifies registry key
        
        PID:556
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\GIMQsMgo.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        146⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        147⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        146⤵
        
        PID:472
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        144⤵
        
        PID:904
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\PqUoQEgU.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        144⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        145⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        144⤵
        
        PID:624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        144⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        142⤵
        Modifies registry key
        
        PID:1424
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\seYYMAMM.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        142⤵
        
        PID:664
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        143⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        142⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        142⤵
        Modifies registry key
        
        PID:1280
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        140⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        140⤵
        
        PID:904
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        140⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\OGgoMAcs.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        140⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        141⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        138⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        138⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\KWYUMUkM.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        138⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        139⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        138⤵
        Modifies registry key
        
        PID:1556
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        136⤵
        Modifies registry key
        
        PID:1232
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        136⤵
        
        PID:556
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\hiEMgkss.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        136⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        137⤵
        
        PID:524
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        136⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\AGQUAAkc.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        134⤵
        
        PID:936
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        135⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        134⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        134⤵
        Modifies registry key
        
        PID:804
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        134⤵
        Modifies registry key
        
        PID:524
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        132⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        132⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\SKYkYYEk.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        132⤵
        
        PID:848
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        133⤵
        
        PID:340
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        132⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        130⤵
        
        PID:524
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        130⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        130⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\rYsIgwsI.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        130⤵
        
        PID:916
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        131⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        128⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        128⤵
        
        PID:852
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        128⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\GkEcscgA.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        128⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        129⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        126⤵
        
        PID:524
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        126⤵
        
        PID:864
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        126⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\fewowsYk.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        126⤵
        
        PID:940
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        127⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        124⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\aOskEcAo.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        124⤵
        
        PID:916
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        125⤵
        
        PID:956
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        124⤵
        Modifies registry key
        
        PID:1544
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        124⤵
        Modifies registry key
        
        PID:840
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        122⤵
        Modifies registry key
        
        PID:852
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        122⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        122⤵
        
        PID:804
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\iKQEYIco.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        122⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        123⤵
        
        PID:296
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        120⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\HmgYkkcs.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        120⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        121⤵
        
        PID:940
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        120⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        120⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        118⤵
        Modifies registry key
        
        PID:1604
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\OUAoQAgI.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        118⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        119⤵
        
        PID:956
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        118⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        118⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        116⤵
        Modifies registry key
        
        PID:1568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tAMMEsUM.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        116⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        117⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        116⤵
        Modifies registry key
        
        PID:1300
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        116⤵
        Modifies registry key
        
        PID:804
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        114⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\DIEgYEQc.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        114⤵
        
        PID:240
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        115⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        114⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        114⤵
        
        PID:848
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        112⤵
        
        PID:940
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\JUwAsUAE.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        112⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        113⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        112⤵
        
        PID:804
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        112⤵
        Modifies registry key
        
        PID:916
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        110⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        110⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\wcowosIw.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        110⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        111⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        110⤵
        
        PID:420
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\lqAUUgMA.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        108⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        109⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        108⤵
        Modifies registry key
        
        PID:916
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        108⤵
        
        PID:240
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        108⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        106⤵
        
        PID:904
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        106⤵
        
        PID:984
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        106⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\sCIwQwUo.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        106⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        107⤵
        
        PID:960
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        104⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\BwUAYYkI.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        104⤵
        
        PID:472
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        105⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        104⤵
        Modifies registry key
        
        PID:916
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        104⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        102⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        102⤵
        Modifies registry key
        
        PID:984
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        102⤵
        Modifies registry key
        
        PID:2016
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\MKgAQAAQ.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        102⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        103⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        100⤵
        
        PID:848
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        100⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        100⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\zAAIcEgQ.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        100⤵
        
        PID:324
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        101⤵
        
        PID:296
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\zSIMMkMk.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        98⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        99⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        98⤵
        Modifies registry key
        
        PID:1604
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        98⤵
        
        PID:960
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        98⤵
        
        PID:936
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        96⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\UkwMYgsU.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        96⤵
        
        PID:240
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        97⤵
        
        PID:420
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        96⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        96⤵
        Modifies registry key
        
        PID:864
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        94⤵
        Modifies registry key
        
        PID:1756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\BoIMUgAI.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        94⤵
        
        PID:340
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        95⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        94⤵
        Modifies registry key
        
        PID:760
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        94⤵
        
        PID:584
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        92⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\MMQscIsc.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        92⤵
        
        PID:664
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        93⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        92⤵
        Modifies registry key
        
        PID:624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        92⤵
        
        PID:936
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        90⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        90⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\QiQIwgAk.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        90⤵
        
        PID:340
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        91⤵
        
        PID:852
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        90⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        88⤵
        
        PID:760
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        88⤵
        
        PID:556
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        88⤵
        
        PID:960
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\sWIgIsAU.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        88⤵
        
        PID:240
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        89⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        86⤵
        Modifies registry key
        
        PID:1240
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        86⤵
        
        PID:848
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\NMIMocEE.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        86⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        87⤵
        
        PID:852
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        86⤵
        Modifies registry key
        
        PID:2012
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        84⤵
        
        PID:740
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\BMAcIYQw.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        84⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        85⤵
        
        PID:556
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        84⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        84⤵
        
        PID:324
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        82⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        82⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        82⤵
        Modifies registry key
        
        PID:760
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\EsIQEkwo.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        82⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        83⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        80⤵
        
        PID:864
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\sWIYwwIU.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        80⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        81⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        80⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        80⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        78⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        78⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\TOgUQgQs.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        78⤵
        
        PID:584
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        79⤵
        
        PID:384
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        78⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        76⤵
        
        PID:852
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        76⤵
        
        PID:760
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        76⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\pWAkosUs.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        76⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        77⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        74⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\ewYkcAEw.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        74⤵
        
        PID:556
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        75⤵
        
        PID:296
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        74⤵
        Modifies registry key
        
        PID:1436
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        74⤵
        
        PID:332
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        72⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\wUoMcgEg.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        72⤵
        
        PID:984
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        72⤵
        Modifies registry key
        
        PID:420
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        72⤵
        
        PID:956
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        70⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        70⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        70⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\suAgkooY.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        70⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        71⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        68⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\xMQYQMYs.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        68⤵
        
        PID:852
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        69⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        68⤵
        
        PID:960
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        68⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        66⤵
        Modifies registry key
        
        PID:1352
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        66⤵
        Modifies registry key
        
        PID:864
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        66⤵
        
        PID:804
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\UOQQwkwM.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        66⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        67⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        64⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\PiwQEEUc.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        64⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        65⤵
        
        PID:420
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        64⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        64⤵
        Modifies registry key
        
        PID:2012
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        63⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        62⤵
        Modifies registry key
        
        PID:332
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        62⤵
        Modifies registry key
        
        PID:1068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        62⤵
        
        PID:924
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\fsocQQUU.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        62⤵
        
        PID:912
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        63⤵
        
        PID:904
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\amQgsIYg.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        60⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        61⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        60⤵
        
        PID:948
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        60⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        60⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        58⤵
        Modifies registry key
        
        PID:1544
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\sqUwEwUs.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        58⤵
        
        PID:912
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        59⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        58⤵
        
        PID:624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        58⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        56⤵
        
        PID:524
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        56⤵
        
        PID:804
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\pQYwEwIA.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        56⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        57⤵
        
        PID:420
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        56⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\bugQYUso.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        54⤵
        
        PID:864
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        55⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        54⤵
        Modifies registry key
        
        PID:1616
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        54⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        54⤵
        
        PID:936
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\SgEAIIoE.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        52⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        53⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1532
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        52⤵
        
        PID:840
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        52⤵
        Modifies registry key
        
        PID:1624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        52⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        50⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        50⤵
        Modifies registry key
        
        PID:556
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\MoUYIgMw.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        50⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        51⤵
        
        PID:740
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        50⤵
        
        PID:524
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\ruwkYsMU.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        48⤵
        
        PID:904
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        49⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        48⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        48⤵
        
        PID:848
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        48⤵
        
        PID:924
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        46⤵
        Modifies registry key
        
        PID:296
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\eOQwIcgk.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        46⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        47⤵
        
        PID:912
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        46⤵
        Modifies registry key
        
        PID:864
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        46⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\IkcckwMU.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        44⤵
        
        PID:840
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        45⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        44⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        44⤵
        Modifies registry key
        
        PID:960
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        44⤵
        
        PID:936
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        42⤵
        Modifies registry key
        
        PID:472
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\uckwYgAA.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        42⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        43⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        42⤵
        
        PID:624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        42⤵
        Modifies registry key
        
        PID:1204
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\FyQcgwUo.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        40⤵
        
        PID:760
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        41⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        40⤵
        Modifies registry key
        
        PID:1300
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        40⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        40⤵
        
        PID:852
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tYgMQQAA.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        38⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        39⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        38⤵
        
        PID:804
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        38⤵
        Modifies registry key
        
        PID:864
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        38⤵
        Modifies registry key
        
        PID:2004
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        36⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\TqoIwMwI.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        36⤵
        
        PID:324
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        37⤵
        
        PID:740
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        36⤵
        
        PID:664
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        36⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        34⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        34⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        34⤵
        Modifies registry key
        
        PID:804
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\akwgwwEM.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        34⤵
        
        PID:960
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        32⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        32⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        32⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\DcgEoYcA.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        32⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        33⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        30⤵
        
        PID:912
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        30⤵
        Modifies registry key
        
        PID:852
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        30⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\LcogsEgw.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        30⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        28⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        28⤵
        
        PID:984
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        28⤵
        Modifies registry key
        
        PID:1988
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        26⤵
        
        PID:848
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        26⤵
        Modifies registry key
        
        PID:584
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        26⤵
        
        PID:956
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\WUAwYIMw.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        26⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        27⤵
        
        PID:556
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        24⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        24⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        24⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\ecQEUAkk.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        24⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        25⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        22⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:584
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        22⤵
        Modifies registry key
        
        PID:928
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        22⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\myEcscMY.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        22⤵
        
        PID:584
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        23⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        20⤵
        Modifies registry key
        
        PID:332
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        20⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        20⤵
        Modifies registry key
        
        PID:1284
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\FQwIMkog.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        20⤵
        
        PID:624
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        21⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        21⤵
        
        PID:924
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        18⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        18⤵
        
        PID:760
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        18⤵
        Modifies registry key
        
        PID:1532
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\CkQcMgEc.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        18⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        16⤵
        Modifies registry key
        
        PID:1052
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        16⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        16⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\MakMgokI.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        16⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        17⤵
        
        PID:816
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        14⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        14⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        14⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\CGAwYQYg.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        14⤵
        
        PID:296
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        15⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        12⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        12⤵
        Modifies registry key
        
        PID:2012
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        12⤵
        
        PID:864
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\qWwIgsAw.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        12⤵
        
        PID:568
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        13⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        10⤵
        
        PID:928
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        10⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        10⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\jGwMAQoY.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        10⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        11⤵
        
        PID:856
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        8⤵
        
        PID:740
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        8⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        8⤵
        
        PID:848
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\lcUoosoM.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        8⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        9⤵
        
        PID:324
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        6⤵
        
        PID:956
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        6⤵
        
        PID:1988
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        6⤵
        
        PID:1764
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\xMkgAEUI.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        6⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        7⤵
        
        PID:1560
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      PID:1172
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      PID:552
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      PID:1424
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tCUgYgME.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
      4⤵
      PID:1440
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        
        PID:1448
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  PID:2008
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:1448
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:1456
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\LisUUgwo.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
  2⤵
  PID:1248
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:984

C:\ProgramData\oOogsQIA\BiwQwogk.exe
C:\ProgramData\oOogsQIA\BiwQwogk.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1884

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:556

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "661350299-955092638-6698033932002060142-690523356552452582-2913983961116366256"
1⤵
PID:1284

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
PID:584

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\xEIIoMIA.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
1⤵
PID:624

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
1⤵
- Checks whether UAC is enabled
- System policy modification
PID:1424

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1960739903-996424516-1086394873-161838048410590629041085812-931906774-58848684"
1⤵
PID:1580

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1454389907176722267-852465027-138099205195835983411932608477430825-1898797021"
1⤵
PID:1988

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1611689727-1721561730-242546436765212126674695918-1668047121488618347-1505728210"
1⤵
PID:960

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-732679654-817592342190482657962996381761983996-2146411157689369586-1905759249"
1⤵
PID:1336

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1233416444-758037430-179402374216388390242400489641539426650-2085501004697699130"
1⤵
PID:1072

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1603845952-1918086451-1069055058-835315449-865529883-9755032620899921767770738"
1⤵
PID:864

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-162175892912336117221559488411-1668432308602485354-1430674209-13510201801466736073"
1⤵
PID:1616

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "308050260709534988-2140115927787375153197457623-136262992-5267146891327907228"
1⤵
PID:240

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1640973575-104765210824921506-1397732159-2064913262-1927477258-9639125021620288177"
1⤵
PID:848

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-18475275301626323631617221132-540408795-613526901024734825-790504957-749674589"
1⤵
PID:760

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1729349587-856449330-119323681617788957841740587573-1153048552-511884283-935120963"
1⤵
PID:2044

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-981049020-344460960-1802596718200919555-815160207-1264030818-520334645-1500761922"
1⤵
PID:1300

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1836038169733718595-770520087-1282922385-791095163-197521690968470533314163358"
1⤵
PID:296

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1194220799593734602-184788152033534717-544622755-6904391911883908988-11434927"
1⤵
PID:420

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "197201115810594815-1638662079323098943175035368718131756521601930885-1689831880"
1⤵
PID:1324

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "8703407371046079169-1499529988-1905943408-9925993321946430651-432017325-1605895821"
1⤵
PID:840