fa126a21c23cf57eb2ebbc8cd9df0a39707dd64a090f0f299416fca5a7fc63fb

Analysis

max time kernel
152s
max time network
152s
platform
windows10_x64
resource
win10v20210410
submitted
05/05/2021, 08:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a0be7f64_by_Libranalysis.exe
Size 623KB
Sample210505-bc9wt8db3n
SHA256 fa126a21c23cf57eb2ebbc8cd9df0a39707dd64a090f0f299416fca5a7fc63fb
MD5 a0be7f64f2215888a783b36e9d0a1f6d
SHA1 053b7954128083258c1c1f106763f18e5c26fbf1
SHA512 f1ec72fd719d565af79805f7ac916c75c321f632681ca9fbf01628e944f8ff7cb80f0190bbd574bd1c2f7cfc5c8446b203fd38e3383184d472e0b0b7b8970f64
MD5 SHA1 SHA512

Score

10^/10

evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\NWQIMYEE\\JugIMUsk.exe,"	a0be7f64_by_Libranalysis.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\NWQIMYEE\\JugIMUsk.exe,"	a0be7f64_by_Libranalysis.exe

Modifies visibility of file extensions in Explorer 2 TTPs
evasion

Hidden Files and Directories
T1158

Modify Registry
T1112
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Executes dropped EXE 3 IoCs

pid	Process
1464	aioosMcA.exe
1576	JugIMUsk.exe
1596	TAoggcAY.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	aioosMcA.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\aioosMcA.exe = "C:\\Users\\Admin\\LGEkooYM\\aioosMcA.exe"	a0be7f64_by_Libranalysis.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JugIMUsk.exe = "C:\\ProgramData\\NWQIMYEE\\JugIMUsk.exe"	a0be7f64_by_Libranalysis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\aioosMcA.exe = "C:\\Users\\Admin\\LGEkooYM\\aioosMcA.exe"	aioosMcA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JugIMUsk.exe = "C:\\ProgramData\\NWQIMYEE\\JugIMUsk.exe"	JugIMUsk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JugIMUsk.exe = "C:\\ProgramData\\NWQIMYEE\\JugIMUsk.exe"	TAoggcAY.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shePublishMerge.gif	aioosMcA.exe
File opened for modification	C:\Windows\SysWOW64\sheRenameStop.pdf	aioosMcA.exe
File opened for modification	C:\Windows\SysWOW64\sheSendResume.exe	aioosMcA.exe
File opened for modification	C:\Windows\SysWOW64\sheSkipExit.doc	aioosMcA.exe
File opened for modification	C:\Windows\SysWOW64\sheUninstallConvertFrom.png	aioosMcA.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\LGEkooYM	TAoggcAY.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\LGEkooYM\aioosMcA	TAoggcAY.exe
File created	C:\Windows\SysWOW64\shell32.dll.exe	aioosMcA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
4380	reg.exe
1004	reg.exe
4504	reg.exe
5032	reg.exe
5104	reg.exe
4804	reg.exe
2124	reg.exe
3640	reg.exe
4896	reg.exe
4548	reg.exe
1664	reg.exe
4120	reg.exe
5092	reg.exe
4100	reg.exe
1012	reg.exe
896	reg.exe
1360	reg.exe
4512	reg.exe
4848	reg.exe
4100	reg.exe
3936	reg.exe
5052	reg.exe
2128	reg.exe
1364	reg.exe
3828	reg.exe
4780	reg.exe
340	reg.exe
4336	reg.exe
4336	reg.exe
3344	reg.exe
4796	reg.exe
4352	reg.exe
4592	reg.exe
1236	reg.exe
4208	reg.exe
4504	reg.exe
4176	reg.exe
4880	reg.exe
4124	reg.exe
3832	reg.exe
3704	reg.exe
4192	reg.exe
5040	reg.exe
5024	reg.exe
4844	reg.exe
3828	reg.exe
1004	reg.exe
1360	reg.exe
3344	reg.exe
4300	reg.exe
3944	reg.exe
896	reg.exe
4236	reg.exe
4776	reg.exe
3936	reg.exe
4204	reg.exe
4276	reg.exe
4228	reg.exe
4496	reg.exe
2128	reg.exe
4528	reg.exe
4300	reg.exe
4356	reg.exe
3840	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3904	a0be7f64_by_Libranalysis.exe
3904	a0be7f64_by_Libranalysis.exe
3904	a0be7f64_by_Libranalysis.exe
3904	a0be7f64_by_Libranalysis.exe
3860	a0be7f64_by_Libranalysis.exe
3860	a0be7f64_by_Libranalysis.exe
3860	a0be7f64_by_Libranalysis.exe
3860	a0be7f64_by_Libranalysis.exe
3832	a0be7f64_by_Libranalysis.exe
3832	a0be7f64_by_Libranalysis.exe
3832	a0be7f64_by_Libranalysis.exe
3832	a0be7f64_by_Libranalysis.exe
1340	a0be7f64_by_Libranalysis.exe
1340	a0be7f64_by_Libranalysis.exe
1340	a0be7f64_by_Libranalysis.exe
1340	a0be7f64_by_Libranalysis.exe
1572	a0be7f64_by_Libranalysis.exe
1572	a0be7f64_by_Libranalysis.exe
1572	a0be7f64_by_Libranalysis.exe
1572	a0be7f64_by_Libranalysis.exe
2628	a0be7f64_by_Libranalysis.exe
2628	a0be7f64_by_Libranalysis.exe
2628	a0be7f64_by_Libranalysis.exe
2628	a0be7f64_by_Libranalysis.exe
1340	a0be7f64_by_Libranalysis.exe
1340	a0be7f64_by_Libranalysis.exe
1340	a0be7f64_by_Libranalysis.exe
1340	a0be7f64_by_Libranalysis.exe
3288	a0be7f64_by_Libranalysis.exe
3288	a0be7f64_by_Libranalysis.exe
3288	a0be7f64_by_Libranalysis.exe
3288	a0be7f64_by_Libranalysis.exe
1664	a0be7f64_by_Libranalysis.exe
1664	a0be7f64_by_Libranalysis.exe
1664	a0be7f64_by_Libranalysis.exe
1664	a0be7f64_by_Libranalysis.exe
2628	a0be7f64_by_Libranalysis.exe
2628	a0be7f64_by_Libranalysis.exe
2628	a0be7f64_by_Libranalysis.exe
2628	a0be7f64_by_Libranalysis.exe
4372	a0be7f64_by_Libranalysis.exe
4372	a0be7f64_by_Libranalysis.exe
4372	a0be7f64_by_Libranalysis.exe
4372	a0be7f64_by_Libranalysis.exe
4660	a0be7f64_by_Libranalysis.exe
4660	a0be7f64_by_Libranalysis.exe
4660	a0be7f64_by_Libranalysis.exe
4660	a0be7f64_by_Libranalysis.exe
4928	a0be7f64_by_Libranalysis.exe
4928	a0be7f64_by_Libranalysis.exe
4928	a0be7f64_by_Libranalysis.exe
4928	a0be7f64_by_Libranalysis.exe
3984	a0be7f64_by_Libranalysis.exe
3984	a0be7f64_by_Libranalysis.exe
3984	a0be7f64_by_Libranalysis.exe
3984	a0be7f64_by_Libranalysis.exe
4260	a0be7f64_by_Libranalysis.exe
4260	a0be7f64_by_Libranalysis.exe
4260	a0be7f64_by_Libranalysis.exe
4260	a0be7f64_by_Libranalysis.exe
4456	a0be7f64_by_Libranalysis.exe
4456	a0be7f64_by_Libranalysis.exe
4456	a0be7f64_by_Libranalysis.exe
4456	a0be7f64_by_Libranalysis.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1464	aioosMcA.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe
1464	aioosMcA.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 1464	3904	a0be7f64_by_Libranalysis.exe	75
PID 3904 wrote to memory of 1464	3904	a0be7f64_by_Libranalysis.exe	75
PID 3904 wrote to memory of 1464	3904	a0be7f64_by_Libranalysis.exe	75
PID 3904 wrote to memory of 1576	3904	a0be7f64_by_Libranalysis.exe	76
PID 3904 wrote to memory of 1576	3904	a0be7f64_by_Libranalysis.exe	76
PID 3904 wrote to memory of 1576	3904	a0be7f64_by_Libranalysis.exe	76
PID 3904 wrote to memory of 1704	3904	a0be7f64_by_Libranalysis.exe	79
PID 3904 wrote to memory of 1704	3904	a0be7f64_by_Libranalysis.exe	79
PID 3904 wrote to memory of 1704	3904	a0be7f64_by_Libranalysis.exe	79
PID 1704 wrote to memory of 3860	1704	cmd.exe	81
PID 1704 wrote to memory of 3860	1704	cmd.exe	81
PID 1704 wrote to memory of 3860	1704	cmd.exe	81
PID 3904 wrote to memory of 1012	3904	a0be7f64_by_Libranalysis.exe	82
PID 3904 wrote to memory of 1012	3904	a0be7f64_by_Libranalysis.exe	82
PID 3904 wrote to memory of 1012	3904	a0be7f64_by_Libranalysis.exe	82
PID 3904 wrote to memory of 3288	3904	a0be7f64_by_Libranalysis.exe	83
PID 3904 wrote to memory of 3288	3904	a0be7f64_by_Libranalysis.exe	83
PID 3904 wrote to memory of 3288	3904	a0be7f64_by_Libranalysis.exe	83
PID 3904 wrote to memory of 3284	3904	a0be7f64_by_Libranalysis.exe	86
PID 3904 wrote to memory of 3284	3904	a0be7f64_by_Libranalysis.exe	86
PID 3904 wrote to memory of 3284	3904	a0be7f64_by_Libranalysis.exe	86
PID 3860 wrote to memory of 896	3860	a0be7f64_by_Libranalysis.exe	88
PID 3860 wrote to memory of 896	3860	a0be7f64_by_Libranalysis.exe	88
PID 3860 wrote to memory of 896	3860	a0be7f64_by_Libranalysis.exe	88
PID 896 wrote to memory of 3832	896	cmd.exe	90
PID 896 wrote to memory of 3832	896	cmd.exe	90
PID 896 wrote to memory of 3832	896	cmd.exe	90
PID 3860 wrote to memory of 1508	3860	a0be7f64_by_Libranalysis.exe	91
PID 3860 wrote to memory of 1508	3860	a0be7f64_by_Libranalysis.exe	91
PID 3860 wrote to memory of 1508	3860	a0be7f64_by_Libranalysis.exe	91
PID 3860 wrote to memory of 1664	3860	a0be7f64_by_Libranalysis.exe	92
PID 3860 wrote to memory of 1664	3860	a0be7f64_by_Libranalysis.exe	92
PID 3860 wrote to memory of 1664	3860	a0be7f64_by_Libranalysis.exe	92
PID 3860 wrote to memory of 2352	3860	a0be7f64_by_Libranalysis.exe	93
PID 3860 wrote to memory of 2352	3860	a0be7f64_by_Libranalysis.exe	93
PID 3860 wrote to memory of 2352	3860	a0be7f64_by_Libranalysis.exe	93
PID 3860 wrote to memory of 8	3860	a0be7f64_by_Libranalysis.exe	95
PID 3860 wrote to memory of 8	3860	a0be7f64_by_Libranalysis.exe	95
PID 3860 wrote to memory of 8	3860	a0be7f64_by_Libranalysis.exe	95
PID 3832 wrote to memory of 2068	3832	a0be7f64_by_Libranalysis.exe	99
PID 3832 wrote to memory of 2068	3832	a0be7f64_by_Libranalysis.exe	99
PID 3832 wrote to memory of 2068	3832	a0be7f64_by_Libranalysis.exe	99
PID 3832 wrote to memory of 2128	3832	a0be7f64_by_Libranalysis.exe	101
PID 3832 wrote to memory of 2128	3832	a0be7f64_by_Libranalysis.exe	101
PID 3832 wrote to memory of 2128	3832	a0be7f64_by_Libranalysis.exe	101
PID 3832 wrote to memory of 1004	3832	a0be7f64_by_Libranalysis.exe	102
PID 3832 wrote to memory of 1004	3832	a0be7f64_by_Libranalysis.exe	102
PID 3832 wrote to memory of 1004	3832	a0be7f64_by_Libranalysis.exe	102
PID 3832 wrote to memory of 2124	3832	a0be7f64_by_Libranalysis.exe	103
PID 3832 wrote to memory of 2124	3832	a0be7f64_by_Libranalysis.exe	103
PID 3832 wrote to memory of 2124	3832	a0be7f64_by_Libranalysis.exe	103
PID 3832 wrote to memory of 2804	3832	a0be7f64_by_Libranalysis.exe	105
PID 3832 wrote to memory of 2804	3832	a0be7f64_by_Libranalysis.exe	105
PID 3832 wrote to memory of 2804	3832	a0be7f64_by_Libranalysis.exe	105
PID 8 wrote to memory of 904	8	cmd.exe	110
PID 8 wrote to memory of 904	8	cmd.exe	110
PID 8 wrote to memory of 904	8	cmd.exe	110
PID 2068 wrote to memory of 1340	2068	cmd.exe	109
PID 2068 wrote to memory of 1340	2068	cmd.exe	109
PID 2068 wrote to memory of 1340	2068	cmd.exe	109
PID 2804 wrote to memory of 3600	2804	cmd.exe	111
PID 2804 wrote to memory of 3600	2804	cmd.exe	111
PID 2804 wrote to memory of 3600	2804	cmd.exe	111
PID 1340 wrote to memory of 2352	1340	a0be7f64_by_Libranalysis.exe	112

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe

C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Users\Admin\LGEkooYM\aioosMcA.exe
  "C:\Users\Admin\LGEkooYM\aioosMcA.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:1464
- C:\ProgramData\NWQIMYEE\JugIMUsk.exe
  "C:\ProgramData\NWQIMYEE\JugIMUsk.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
    C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3860
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:896
    - - C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3832
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        8⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        10⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        11⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        12⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        13⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        14⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        15⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        16⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        17⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        18⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        19⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        20⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        21⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        22⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        23⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        24⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        25⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        26⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        27⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        28⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        29⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        30⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        31⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        32⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        33⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        34⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        35⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        36⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        37⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        38⤵
        
        PID:340
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        39⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        40⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        41⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        42⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        43⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        44⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        45⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        46⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        47⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        48⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        49⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        50⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        51⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        52⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        53⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        54⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        55⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        56⤵
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        57⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        58⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis
        59⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis"
        60⤵
        
        PID:3160
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        61⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        60⤵
        Modifies registry key
        
        PID:4336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LKYMMssc.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        60⤵
        
        PID:4524
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        61⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        61⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        60⤵
        Modifies registry key
        
        PID:4380
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        60⤵
        Modifies registry key
        
        PID:4592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VeEoksso.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        58⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        59⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        58⤵
        Modifies registry key
        
        PID:3828
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        58⤵
        Modifies registry key
        
        PID:3944
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        58⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        56⤵
        Modifies registry key
        
        PID:4356
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        56⤵
        Modifies registry key
        
        PID:4776
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        56⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JUYMswsE.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        56⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        57⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tgUooEIg.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        54⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        55⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        54⤵
        Modifies registry key
        
        PID:4844
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        54⤵
        Modifies registry key
        
        PID:4504
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        54⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aOoMssUE.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        52⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        53⤵
        
        PID:476
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        52⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        52⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        52⤵
        Modifies registry key
        
        PID:4100
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        50⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        50⤵
        Modifies registry key
        
        PID:5052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SagUIQAo.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        50⤵
        Checks whether UAC is enabled
        System policy modification
        
        PID:4528
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        51⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        50⤵
        Modifies registry key
        
        PID:4336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uYogkMsU.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        48⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        49⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        48⤵
        Modifies registry key
        
        PID:4300
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        48⤵
        Modifies registry key
        
        PID:4228
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        48⤵
        Modifies registry key
        
        PID:4236
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        46⤵
        Modifies registry key
        
        PID:3936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lMwYgYEg.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        46⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        47⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        46⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        46⤵
        Modifies registry key
        
        PID:4848
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        44⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zYcQcwQM.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        44⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        45⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        44⤵
        Modifies registry key
        
        PID:4804
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        44⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        42⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        42⤵
        Modifies registry key
        
        PID:4548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jUsYgAQw.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        42⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        43⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        42⤵
        Modifies registry key
        
        PID:4100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eUssYUIs.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        40⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        41⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        40⤵
        Modifies registry key
        
        PID:4528
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        40⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        40⤵
        Modifies registry key
        
        PID:4352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SyYwwMoQ.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        38⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        39⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        38⤵
        Modifies registry key
        
        PID:4300
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        38⤵
        Modifies registry key
        
        PID:4208
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        38⤵
        Modifies registry key
        
        PID:4276
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        36⤵
        Modifies registry key
        
        PID:5092
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        36⤵
        Modifies registry key
        
        PID:5104
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        36⤵
        Modifies registry key
        
        PID:4124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VCEQskMs.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        36⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        37⤵
        
        PID:740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JosQooMo.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        34⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        35⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        34⤵
        Modifies registry key
        
        PID:4796
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        34⤵
        Modifies registry key
        
        PID:4896
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        34⤵
        Modifies registry key
        
        PID:4880
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        32⤵
        Modifies registry key
        
        PID:3640
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        32⤵
        Modifies registry key
        
        PID:4176
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        32⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DOIAUUYU.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        32⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        33⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        30⤵
        Modifies registry key
        
        PID:3840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oIcQssMM.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        30⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        31⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        30⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        30⤵
        Modifies registry key
        
        PID:2128
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        28⤵
        Modifies registry key
        
        PID:340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SMEIkkMI.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        28⤵
        
        PID:4156
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        29⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        28⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        28⤵
        Modifies registry key
        
        PID:4120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aGcgcwws.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        26⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        27⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        26⤵
        Modifies registry key
        
        PID:5040
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        26⤵
        Modifies registry key
        
        PID:5032
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        26⤵
        Modifies registry key
        
        PID:5024
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        24⤵
        Modifies registry key
        
        PID:4780
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        24⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        24⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BKckUsYw.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        24⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        25⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lwwIEUss.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        22⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        23⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        22⤵
        Modifies registry key
        
        PID:4512
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        22⤵
        Modifies registry key
        
        PID:4504
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        22⤵
        Modifies registry key
        
        PID:4496
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        20⤵
        Modifies registry key
        
        PID:4192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nSsskUgo.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        20⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        21⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        20⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        20⤵
        Modifies registry key
        
        PID:4204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HKcUcIok.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        18⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        19⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        18⤵
        Modifies registry key
        
        PID:3344
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        18⤵
        Modifies registry key
        
        PID:1360
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        18⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        16⤵
        Modifies registry key
        
        PID:3936
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        16⤵
        Modifies registry key
        
        PID:1236
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        16⤵
        Modifies registry key
        
        PID:3704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PWocIUEk.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        16⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        17⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        14⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        14⤵
        Modifies registry key
        
        PID:3344
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        14⤵
        Modifies registry key
        
        PID:1664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qmwgocQA.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        14⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        15⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        12⤵
        Modifies registry key
        
        PID:3832
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        12⤵
        Modifies registry key
        
        PID:896
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        12⤵
        Modifies registry key
        
        PID:1360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uOsIcUQQ.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        12⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        13⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        10⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        10⤵
        Modifies registry key
        
        PID:896
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        10⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kGEYwYkk.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        10⤵
        
        PID:8
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        11⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        8⤵
        Modifies registry key
        
        PID:1004
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        8⤵
        Modifies registry key
        
        PID:1364
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        8⤵
        Modifies registry key
        
        PID:3828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FEcIEQkw.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        8⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        9⤵
        
        PID:3504
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        6⤵
        Modifies registry key
        
        PID:2128
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        6⤵
        Modifies registry key
        
        PID:1004
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        6⤵
        Modifies registry key
        
        PID:2124
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jYcUEYAc.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2804
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        7⤵
        
        PID:3600
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      PID:1508
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      PID:1664
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      PID:2352
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zIMEUwsc.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:8
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        
        PID:904
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:1012
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:3288
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  PID:3284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qYkEAYIE.bat" "C:\Users\Admin\AppData\Local\Temp\a0be7f64_by_Libranalysis.exe""
  2⤵
  PID:4772
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:4392

C:\ProgramData\oEoAIEEM\TAoggcAY.exe
C:\ProgramData\oEoAIEEM\TAoggcAY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1596