3bd7dcf904cb67945b0393b17213877bcec87f8a0ddf2000033ad32a6ac06f8a

Analysis

max time kernel
150s
max time network
150s
platform
windows10_x64
resource
win10v20210410
submitted
05/05/2021, 08:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6000cfd_by_Libranalysis.exe
Size 639KB
Sample210505-slg6hvsvd2
SHA256 3bd7dcf904cb67945b0393b17213877bcec87f8a0ddf2000033ad32a6ac06f8a
MD5 a6000cfd981ee0b7618a874053dc7399
SHA1 2dbdc8a9bf8a65813f0c21c70ae1523e1b3b7a0e
SHA512 54f01376421790c63c277649c14220ef3eb7b68d7ee13e45f6510fc70615aa8ef0bef4eb7fecdad008cf0afb0708bdba85f4dfc904546adc959bd9d64174c5a1
MD5 SHA1 SHA512

Score

10^/10

evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\MSIUsAYU\\NGYUYkgg.exe,"	a6000cfd_by_Libranalysis.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\MSIUsAYU\\NGYUYkgg.exe,"	a6000cfd_by_Libranalysis.exe

Modifies visibility of file extensions in Explorer 2 TTPs
evasion

Hidden Files and Directories
T1158

Modify Registry
T1112
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Executes dropped EXE 3 IoCs

pid	Process
296	leIwAwYs.exe
1128	NGYUYkgg.exe
1784	UKwMcIEw.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	leIwAwYs.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\leIwAwYs.exe = "C:\\Users\\Admin\\FWYgkcYI\\leIwAwYs.exe"	a6000cfd_by_Libranalysis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\leIwAwYs.exe = "C:\\Users\\Admin\\FWYgkcYI\\leIwAwYs.exe"	leIwAwYs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NGYUYkgg.exe = "C:\\ProgramData\\MSIUsAYU\\NGYUYkgg.exe"	a6000cfd_by_Libranalysis.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NGYUYkgg.exe = "C:\\ProgramData\\MSIUsAYU\\NGYUYkgg.exe"	NGYUYkgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NGYUYkgg.exe = "C:\\ProgramData\\MSIUsAYU\\NGYUYkgg.exe"	UKwMcIEw.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a6000cfd_by_Libranalysis.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a6000cfd_by_Libranalysis.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\FWYgkcYI	UKwMcIEw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\FWYgkcYI\leIwAwYs	UKwMcIEw.exe
File created	C:\Windows\SysWOW64\shell32.dll.exe	leIwAwYs.exe
File opened for modification	C:\Windows\SysWOW64\sheMoveUpdate.xlsx	leIwAwYs.exe
File opened for modification	C:\Windows\SysWOW64\sheOpenSuspend.ppt	leIwAwYs.exe
File opened for modification	C:\Windows\SysWOW64\sheTraceUndo.zip	leIwAwYs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
3764	reg.exe
1404	reg.exe
1496	reg.exe
4964	reg.exe
1684	reg.exe
3328	reg.exe
2032	reg.exe
3516	reg.exe
3328	reg.exe
4424	reg.exe
4700	reg.exe
4352	reg.exe
4580	reg.exe
3268	reg.exe
3400	reg.exe
3080	reg.exe
428	reg.exe
3988	reg.exe
4440	reg.exe
4972	reg.exe
4296	reg.exe
476	reg.exe
1816	reg.exe
3844	reg.exe
5104	reg.exe
1816	reg.exe
1500	reg.exe
4324	reg.exe
1896	reg.exe
2168	reg.exe
2120	reg.exe
4956	reg.exe
4796	reg.exe
5072	reg.exe
3860	reg.exe
1900	reg.exe
1972	reg.exe
4200	reg.exe
4432	reg.exe
4708	reg.exe
4508	reg.exe
4124	reg.exe
4752	reg.exe
2120	reg.exe
3872	reg.exe
4512	reg.exe
1296	reg.exe
3944	reg.exe
4116	reg.exe
2252	reg.exe
4540	reg.exe
3872	reg.exe
748	reg.exe
4208	reg.exe
3872	reg.exe
4472	reg.exe
4644	reg.exe
3180	reg.exe
2472	reg.exe
4596	reg.exe
5048	reg.exe
4320	reg.exe
2168	reg.exe
1316	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3920	a6000cfd_by_Libranalysis.exe
3920	a6000cfd_by_Libranalysis.exe
3920	a6000cfd_by_Libranalysis.exe
3920	a6000cfd_by_Libranalysis.exe
2824	a6000cfd_by_Libranalysis.exe
2824	a6000cfd_by_Libranalysis.exe
2824	a6000cfd_by_Libranalysis.exe
2824	a6000cfd_by_Libranalysis.exe
3968	a6000cfd_by_Libranalysis.exe
3968	a6000cfd_by_Libranalysis.exe
3968	a6000cfd_by_Libranalysis.exe
3968	a6000cfd_by_Libranalysis.exe
2812	a6000cfd_by_Libranalysis.exe
2812	a6000cfd_by_Libranalysis.exe
2812	a6000cfd_by_Libranalysis.exe
2812	a6000cfd_by_Libranalysis.exe
900	cscript.exe
900	cscript.exe
900	cscript.exe
900	cscript.exe
1632	a6000cfd_by_Libranalysis.exe
1632	a6000cfd_by_Libranalysis.exe
1632	a6000cfd_by_Libranalysis.exe
1632	a6000cfd_by_Libranalysis.exe
3328	a6000cfd_by_Libranalysis.exe
3328	a6000cfd_by_Libranalysis.exe
3328	a6000cfd_by_Libranalysis.exe
3328	a6000cfd_by_Libranalysis.exe
3180	a6000cfd_by_Libranalysis.exe
3180	a6000cfd_by_Libranalysis.exe
3180	a6000cfd_by_Libranalysis.exe
3180	a6000cfd_by_Libranalysis.exe
2780	Conhost.exe
2780	Conhost.exe
2780	Conhost.exe
2780	Conhost.exe
2824	a6000cfd_by_Libranalysis.exe
2824	a6000cfd_by_Libranalysis.exe
2824	a6000cfd_by_Libranalysis.exe
2824	a6000cfd_by_Libranalysis.exe
3328	a6000cfd_by_Libranalysis.exe
3328	a6000cfd_by_Libranalysis.exe
3328	a6000cfd_by_Libranalysis.exe
3328	a6000cfd_by_Libranalysis.exe
2812	a6000cfd_by_Libranalysis.exe
2812	a6000cfd_by_Libranalysis.exe
2812	a6000cfd_by_Libranalysis.exe
2812	a6000cfd_by_Libranalysis.exe
4184	a6000cfd_by_Libranalysis.exe
4184	a6000cfd_by_Libranalysis.exe
4184	a6000cfd_by_Libranalysis.exe
4184	a6000cfd_by_Libranalysis.exe
4612	cmd.exe
4612	cmd.exe
4612	cmd.exe
4612	cmd.exe
4868	a6000cfd_by_Libranalysis.exe
4868	a6000cfd_by_Libranalysis.exe
4868	a6000cfd_by_Libranalysis.exe
4868	a6000cfd_by_Libranalysis.exe
4100	a6000cfd_by_Libranalysis.exe
4100	a6000cfd_by_Libranalysis.exe
4100	a6000cfd_by_Libranalysis.exe
4100	a6000cfd_by_Libranalysis.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
296	leIwAwYs.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe
296	leIwAwYs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 296	3920	a6000cfd_by_Libranalysis.exe	75
PID 3920 wrote to memory of 296	3920	a6000cfd_by_Libranalysis.exe	75
PID 3920 wrote to memory of 296	3920	a6000cfd_by_Libranalysis.exe	75
PID 3920 wrote to memory of 1128	3920	a6000cfd_by_Libranalysis.exe	76
PID 3920 wrote to memory of 1128	3920	a6000cfd_by_Libranalysis.exe	76
PID 3920 wrote to memory of 1128	3920	a6000cfd_by_Libranalysis.exe	76
PID 3920 wrote to memory of 2488	3920	a6000cfd_by_Libranalysis.exe	79
PID 3920 wrote to memory of 2488	3920	a6000cfd_by_Libranalysis.exe	79
PID 3920 wrote to memory of 2488	3920	a6000cfd_by_Libranalysis.exe	79
PID 2488 wrote to memory of 2824	2488	cmd.exe	81
PID 2488 wrote to memory of 2824	2488	cmd.exe	81
PID 2488 wrote to memory of 2824	2488	cmd.exe	81
PID 3920 wrote to memory of 3268	3920	a6000cfd_by_Libranalysis.exe	82
PID 3920 wrote to memory of 3268	3920	a6000cfd_by_Libranalysis.exe	82
PID 3920 wrote to memory of 3268	3920	a6000cfd_by_Libranalysis.exe	82
PID 3920 wrote to memory of 3764	3920	a6000cfd_by_Libranalysis.exe	83
PID 3920 wrote to memory of 3764	3920	a6000cfd_by_Libranalysis.exe	83
PID 3920 wrote to memory of 3764	3920	a6000cfd_by_Libranalysis.exe	83
PID 3920 wrote to memory of 3400	3920	a6000cfd_by_Libranalysis.exe	84
PID 3920 wrote to memory of 3400	3920	a6000cfd_by_Libranalysis.exe	84
PID 3920 wrote to memory of 3400	3920	a6000cfd_by_Libranalysis.exe	84
PID 2824 wrote to memory of 1808	2824	a6000cfd_by_Libranalysis.exe	88
PID 2824 wrote to memory of 1808	2824	a6000cfd_by_Libranalysis.exe	88
PID 2824 wrote to memory of 1808	2824	a6000cfd_by_Libranalysis.exe	88
PID 2824 wrote to memory of 3180	2824	a6000cfd_by_Libranalysis.exe	90
PID 2824 wrote to memory of 3180	2824	a6000cfd_by_Libranalysis.exe	90
PID 2824 wrote to memory of 3180	2824	a6000cfd_by_Libranalysis.exe	90
PID 2824 wrote to memory of 1684	2824	a6000cfd_by_Libranalysis.exe	91
PID 2824 wrote to memory of 1684	2824	a6000cfd_by_Libranalysis.exe	91
PID 2824 wrote to memory of 1684	2824	a6000cfd_by_Libranalysis.exe	91
PID 2824 wrote to memory of 3872	2824	a6000cfd_by_Libranalysis.exe	92
PID 2824 wrote to memory of 3872	2824	a6000cfd_by_Libranalysis.exe	92
PID 2824 wrote to memory of 3872	2824	a6000cfd_by_Libranalysis.exe	92
PID 2824 wrote to memory of 428	2824	a6000cfd_by_Libranalysis.exe	94
PID 2824 wrote to memory of 428	2824	a6000cfd_by_Libranalysis.exe	94
PID 2824 wrote to memory of 428	2824	a6000cfd_by_Libranalysis.exe	94
PID 1808 wrote to memory of 3968	1808	cmd.exe	98
PID 1808 wrote to memory of 3968	1808	cmd.exe	98
PID 1808 wrote to memory of 3968	1808	cmd.exe	98
PID 428 wrote to memory of 2784	428	cmd.exe	99
PID 428 wrote to memory of 2784	428	cmd.exe	99
PID 428 wrote to memory of 2784	428	cmd.exe	99
PID 3968 wrote to memory of 1632	3968	a6000cfd_by_Libranalysis.exe	100
PID 3968 wrote to memory of 1632	3968	a6000cfd_by_Libranalysis.exe	100
PID 3968 wrote to memory of 1632	3968	a6000cfd_by_Libranalysis.exe	100
PID 3968 wrote to memory of 3328	3968	a6000cfd_by_Libranalysis.exe	102
PID 3968 wrote to memory of 3328	3968	a6000cfd_by_Libranalysis.exe	102
PID 3968 wrote to memory of 3328	3968	a6000cfd_by_Libranalysis.exe	102
PID 3968 wrote to memory of 3080	3968	a6000cfd_by_Libranalysis.exe	103
PID 3968 wrote to memory of 3080	3968	a6000cfd_by_Libranalysis.exe	103
PID 3968 wrote to memory of 3080	3968	a6000cfd_by_Libranalysis.exe	103
PID 3968 wrote to memory of 2032	3968	a6000cfd_by_Libranalysis.exe	104
PID 3968 wrote to memory of 2032	3968	a6000cfd_by_Libranalysis.exe	104
PID 3968 wrote to memory of 2032	3968	a6000cfd_by_Libranalysis.exe	104
PID 3968 wrote to memory of 3936	3968	a6000cfd_by_Libranalysis.exe	105
PID 3968 wrote to memory of 3936	3968	a6000cfd_by_Libranalysis.exe	105
PID 3968 wrote to memory of 3936	3968	a6000cfd_by_Libranalysis.exe	105
PID 1632 wrote to memory of 2812	1632	cmd.exe	110
PID 1632 wrote to memory of 2812	1632	cmd.exe	110
PID 1632 wrote to memory of 2812	1632	cmd.exe	110
PID 3936 wrote to memory of 3772	3936	cmd.exe	111
PID 3936 wrote to memory of 3772	3936	cmd.exe	111
PID 3936 wrote to memory of 3772	3936	cmd.exe	111
PID 2812 wrote to memory of 1060	2812	a6000cfd_by_Libranalysis.exe	112

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a6000cfd_by_Libranalysis.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	a6000cfd_by_Libranalysis.exe

C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Users\Admin\FWYgkcYI\leIwAwYs.exe
  "C:\Users\Admin\FWYgkcYI\leIwAwYs.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:296
- C:\ProgramData\MSIUsAYU\NGYUYkgg.exe
  "C:\ProgramData\MSIUsAYU\NGYUYkgg.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
    C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3968
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        8⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        9⤵
        
        PID:900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        10⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        11⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        12⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        13⤵
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        System policy modification
        
        PID:3328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        14⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        15⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        16⤵
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        17⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        18⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        19⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        20⤵
        
        PID:3744
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        21⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        21⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        22⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        23⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        24⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        25⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        26⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        27⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        28⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        29⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        30⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        31⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        32⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        33⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        34⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        35⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        36⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        37⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        38⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        39⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        40⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        41⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        42⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        43⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        44⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        45⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        46⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        47⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        48⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        49⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        50⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis
        51⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis"
        52⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        52⤵
        Modifies registry key
        
        PID:2120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cMcQkkQo.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        52⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        53⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        52⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        52⤵
        Modifies registry key
        
        PID:2168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GAoIkUUc.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        50⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        51⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        50⤵
        Modifies registry key
        
        PID:4512
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        50⤵
        Modifies registry key
        
        PID:4540
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        50⤵
        Modifies registry key
        
        PID:4796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yQkQcUIQ.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        48⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        49⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        48⤵
        Modifies registry key
        
        PID:4644
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        48⤵
        Modifies registry key
        
        PID:4752
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        48⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        46⤵
        Modifies registry key
        
        PID:2252
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        46⤵
        Modifies registry key
        
        PID:476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\byAQIcok.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        46⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        47⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        46⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lCIwgIwA.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        44⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        45⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        44⤵
        Modifies registry key
        
        PID:4296
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        44⤵
        Modifies registry key
        
        PID:4320
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        44⤵
        Modifies registry key
        
        PID:4472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lIkwQwcY.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        42⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        43⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        42⤵
        Modifies registry key
        
        PID:1896
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        42⤵
        Modifies registry key
        
        PID:4124
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        42⤵
        Modifies registry key
        
        PID:4116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kQMMYgss.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        40⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        41⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        40⤵
        Modifies registry key
        
        PID:5048
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        40⤵
        Modifies registry key
        
        PID:5072
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        40⤵
        Modifies registry key
        
        PID:5104
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        38⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GQkkIIUE.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        38⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        39⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        38⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        38⤵
        
        PID:812
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        36⤵
        Modifies registry key
        
        PID:4508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ROAYUkAo.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        36⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        37⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        36⤵
        Modifies registry key
        
        PID:4580
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        36⤵
        Modifies registry key
        
        PID:4596
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        34⤵
        Modifies registry key
        
        PID:4324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FeEowgcI.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        34⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        35⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        34⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        34⤵
        Modifies registry key
        
        PID:4352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XsUAgQMw.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        32⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        33⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        32⤵
        Modifies registry key
        
        PID:3872
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        32⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        32⤵
        
        PID:800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WSEEsQwA.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        30⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        31⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        30⤵
        Modifies registry key
        
        PID:4972
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        30⤵
        Modifies registry key
        
        PID:4964
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        30⤵
        Modifies registry key
        
        PID:4956
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        28⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        28⤵
        Modifies registry key
        
        PID:4708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YwAYIIgw.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        28⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        29⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        28⤵
        Modifies registry key
        
        PID:4700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YwMEgkgY.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        26⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        27⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        26⤵
        Modifies registry key
        
        PID:4440
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        26⤵
        Modifies registry key
        
        PID:4432
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        26⤵
        Modifies registry key
        
        PID:4424
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        24⤵
        Modifies registry key
        
        PID:4200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BUYUsIkk.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        24⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        25⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        24⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        24⤵
        Modifies registry key
        
        PID:4208
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        22⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        22⤵
        Modifies registry key
        
        PID:3844
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        23⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fuMIwckc.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        22⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        23⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        22⤵
        
        PID:900
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        20⤵
        Modifies registry key
        
        PID:3988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BOkAUYIk.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        20⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        21⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        20⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        20⤵
        Modifies registry key
        
        PID:1500
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        18⤵
        Modifies registry key
        
        PID:3944
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        18⤵
        Modifies registry key
        
        PID:748
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        18⤵
        Modifies registry key
        
        PID:1316
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        19⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rcsUAIQs.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        18⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        19⤵
        
        PID:812
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        16⤵
        Modifies registry key
        
        PID:2120
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        17⤵
        
        PID:900
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        16⤵
        Modifies registry key
        
        PID:1496
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        16⤵
        Modifies registry key
        
        PID:1972
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        17⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GIAUUEEw.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        16⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        17⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        14⤵
        Modifies registry key
        
        PID:2472
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        14⤵
        Modifies registry key
        
        PID:1296
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        14⤵
        Modifies registry key
        
        PID:1816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ksEYoIME.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        14⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        15⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        12⤵
        Modifies registry key
        
        PID:428
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        12⤵
        Modifies registry key
        
        PID:3872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WEggUkow.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        12⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        13⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        12⤵
        Modifies registry key
        
        PID:1816
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        10⤵
        Modifies registry key
        
        PID:3860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oooosQsY.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        10⤵
        Checks whether UAC is enabled
        System policy modification
        
        PID:2168
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        11⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:900
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        10⤵
        Modifies registry key
        
        PID:3328
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        10⤵
        Modifies registry key
        
        PID:1900
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        8⤵
        Modifies registry key
        
        PID:1404
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        8⤵
        Modifies registry key
        
        PID:3516
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        8⤵
        Modifies registry key
        
        PID:2168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cqYUYEEs.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        8⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        9⤵
        
        PID:3944
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        6⤵
        Modifies registry key
        
        PID:3328
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        6⤵
        Modifies registry key
        
        PID:3080
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        6⤵
        Modifies registry key
        
        PID:2032
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tyQgEQkw.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        7⤵
        
        PID:3772
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:3180
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      Modifies registry key
      PID:1684
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:3872
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fGQkocQE.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:428
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        
        PID:2784
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:3268
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - Modifies registry key
  PID:3764
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - Modifies registry key
  PID:3400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oAEoEkMo.bat" "C:\Users\Admin\AppData\Local\Temp\a6000cfd_by_Libranalysis.exe""
  2⤵
  PID:4292
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:4208

C:\ProgramData\CmwccckY\UKwMcIEw.exe
C:\ProgramData\CmwccckY\UKwMcIEw.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1784