6279abde41ce2445065fd31b0762774da7a532e622d4e144ff47a5b4eda34fc4

Analysis

max time kernel
150s
max time network
149s
platform
windows10_x64
resource
win10v20210410
submitted
05/05/2021, 09:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3fb28b39_by_Libranalysis.exe
Size 636KB
Sample210505-waeax43can
SHA256 6279abde41ce2445065fd31b0762774da7a532e622d4e144ff47a5b4eda34fc4
MD5 3fb28b39d5df7e3e10865278c2865567
SHA1 3cc5eb50dc9f7cadb758db7df032ff4d4f9da5d0
SHA512 d8acd4213a362f0f890af4b5aef9187ec8364e5414299f895ae04b8a818022db9a76c96aa626e379565313ac09100750c83c89fa18b753664f14788febc3898b
MD5 SHA1 SHA512

Score

10^/10

evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\vIokgYcI\\WYoswYwg.exe,"	3fb28b39_by_Libranalysis.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\vIokgYcI\\WYoswYwg.exe,"	3fb28b39_by_Libranalysis.exe

Modifies visibility of file extensions in Explorer 2 TTPs
evasion

Hidden Files and Directories
T1158

Modify Registry
T1112
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Executes dropped EXE 3 IoCs

pid	Process
1968	wSQwIsoA.exe
2072	WYoswYwg.exe
2684	KqkoIswI.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	WYoswYwg.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WYoswYwg.exe = "C:\\ProgramData\\vIokgYcI\\WYoswYwg.exe"	KqkoIswI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\wSQwIsoA.exe = "C:\\Users\\Admin\\OWcEEEkc\\wSQwIsoA.exe"	3fb28b39_by_Libranalysis.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WYoswYwg.exe = "C:\\ProgramData\\vIokgYcI\\WYoswYwg.exe"	3fb28b39_by_Libranalysis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\wSQwIsoA.exe = "C:\\Users\\Admin\\OWcEEEkc\\wSQwIsoA.exe"	wSQwIsoA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WYoswYwg.exe = "C:\\ProgramData\\vIokgYcI\\WYoswYwg.exe"	WYoswYwg.exe

Checks whether UAC is enabled 1 TTPs 10 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\sheWaitNew.bmp	WYoswYwg.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\OWcEEEkc	KqkoIswI.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\OWcEEEkc\wSQwIsoA	KqkoIswI.exe
File created	C:\Windows\SysWOW64\shell32.dll.exe	WYoswYwg.exe
File opened for modification	C:\Windows\SysWOW64\sheOptimizeEnable.exe	WYoswYwg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
3908	reg.exe
2436	reg.exe
1124	reg.exe
3012	reg.exe
188	reg.exe
3116	reg.exe
1380	reg.exe
3780	reg.exe
3872	reg.exe
3900	reg.exe
3756	reg.exe
2140	reg.exe
4008	reg.exe
2364	reg.exe
3116	reg.exe
2712	reg.exe
1556	reg.exe
1052	reg.exe
3932	reg.exe
1020	reg.exe
1580	reg.exe
2108	reg.exe
2108	reg.exe
1320	reg.exe
3908	reg.exe
1248	reg.exe
2232	reg.exe
1272	reg.exe
2564	reg.exe
3712	reg.exe
1248	reg.exe
4092	reg.exe
4060	reg.exe
1272	reg.exe
1380	reg.exe
4060	reg.exe
2316	reg.exe
3004	reg.exe
3656	reg.exe
4032	reg.exe
3872	reg.exe
1684	reg.exe
3784	reg.exe
1340	reg.exe
2108	reg.exe
1208	reg.exe
3952	reg.exe
1644	reg.exe
2744	reg.exe
3348	reg.exe
3308	reg.exe
3708	reg.exe
2160	reg.exe
3348	reg.exe
4008	reg.exe
2156	reg.exe
2212	reg.exe
2616	reg.exe
640	reg.exe
3320	reg.exe
1020	reg.exe
1380	reg.exe
4008	reg.exe
2788	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
500	3fb28b39_by_Libranalysis.exe
500	3fb28b39_by_Libranalysis.exe
500	3fb28b39_by_Libranalysis.exe
500	3fb28b39_by_Libranalysis.exe
2696	3fb28b39_by_Libranalysis.exe
2696	3fb28b39_by_Libranalysis.exe
2696	3fb28b39_by_Libranalysis.exe
2696	3fb28b39_by_Libranalysis.exe
1936	3fb28b39_by_Libranalysis.exe
1936	3fb28b39_by_Libranalysis.exe
1936	3fb28b39_by_Libranalysis.exe
1936	3fb28b39_by_Libranalysis.exe
196	3fb28b39_by_Libranalysis.exe
196	3fb28b39_by_Libranalysis.exe
196	3fb28b39_by_Libranalysis.exe
196	3fb28b39_by_Libranalysis.exe
3308	3fb28b39_by_Libranalysis.exe
3308	3fb28b39_by_Libranalysis.exe
3308	3fb28b39_by_Libranalysis.exe
3308	3fb28b39_by_Libranalysis.exe
2776	3fb28b39_by_Libranalysis.exe
2776	3fb28b39_by_Libranalysis.exe
2776	3fb28b39_by_Libranalysis.exe
2776	3fb28b39_by_Libranalysis.exe
192	3fb28b39_by_Libranalysis.exe
192	3fb28b39_by_Libranalysis.exe
192	3fb28b39_by_Libranalysis.exe
192	3fb28b39_by_Libranalysis.exe
192	3fb28b39_by_Libranalysis.exe
192	3fb28b39_by_Libranalysis.exe
192	3fb28b39_by_Libranalysis.exe
192	3fb28b39_by_Libranalysis.exe
3952	3fb28b39_by_Libranalysis.exe
3952	3fb28b39_by_Libranalysis.exe
3952	3fb28b39_by_Libranalysis.exe
3952	3fb28b39_by_Libranalysis.exe
748	3fb28b39_by_Libranalysis.exe
748	3fb28b39_by_Libranalysis.exe
748	3fb28b39_by_Libranalysis.exe
748	3fb28b39_by_Libranalysis.exe
3712	3fb28b39_by_Libranalysis.exe
3712	3fb28b39_by_Libranalysis.exe
3712	3fb28b39_by_Libranalysis.exe
3712	3fb28b39_by_Libranalysis.exe
3792	cscript.exe
3792	cscript.exe
3792	cscript.exe
3792	cscript.exe
4008	reg.exe
4008	reg.exe
4008	reg.exe
4008	reg.exe
1004	Conhost.exe
1004	Conhost.exe
1004	Conhost.exe
1004	Conhost.exe
2720	3fb28b39_by_Libranalysis.exe
2720	3fb28b39_by_Libranalysis.exe
2720	3fb28b39_by_Libranalysis.exe
2720	3fb28b39_by_Libranalysis.exe
2116	cmd.exe
2116	cmd.exe
2116	cmd.exe
2116	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2072	WYoswYwg.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe
2072	WYoswYwg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 500 wrote to memory of 1968	500	3fb28b39_by_Libranalysis.exe	75
PID 500 wrote to memory of 1968	500	3fb28b39_by_Libranalysis.exe	75
PID 500 wrote to memory of 1968	500	3fb28b39_by_Libranalysis.exe	75
PID 500 wrote to memory of 2072	500	3fb28b39_by_Libranalysis.exe	76
PID 500 wrote to memory of 2072	500	3fb28b39_by_Libranalysis.exe	76
PID 500 wrote to memory of 2072	500	3fb28b39_by_Libranalysis.exe	76
PID 500 wrote to memory of 3936	500	3fb28b39_by_Libranalysis.exe	79
PID 500 wrote to memory of 3936	500	3fb28b39_by_Libranalysis.exe	79
PID 500 wrote to memory of 3936	500	3fb28b39_by_Libranalysis.exe	79
PID 500 wrote to memory of 3320	500	3fb28b39_by_Libranalysis.exe	81
PID 500 wrote to memory of 3320	500	3fb28b39_by_Libranalysis.exe	81
PID 500 wrote to memory of 3320	500	3fb28b39_by_Libranalysis.exe	81
PID 500 wrote to memory of 188	500	3fb28b39_by_Libranalysis.exe	84
PID 500 wrote to memory of 188	500	3fb28b39_by_Libranalysis.exe	84
PID 500 wrote to memory of 188	500	3fb28b39_by_Libranalysis.exe	84
PID 500 wrote to memory of 3708	500	3fb28b39_by_Libranalysis.exe	83
PID 500 wrote to memory of 3708	500	3fb28b39_by_Libranalysis.exe	83
PID 500 wrote to memory of 3708	500	3fb28b39_by_Libranalysis.exe	83
PID 3936 wrote to memory of 2696	3936	cmd.exe	87
PID 3936 wrote to memory of 2696	3936	cmd.exe	87
PID 3936 wrote to memory of 2696	3936	cmd.exe	87
PID 2696 wrote to memory of 1236	2696	3fb28b39_by_Libranalysis.exe	88
PID 2696 wrote to memory of 1236	2696	3fb28b39_by_Libranalysis.exe	88
PID 2696 wrote to memory of 1236	2696	3fb28b39_by_Libranalysis.exe	88
PID 1236 wrote to memory of 1936	1236	cmd.exe	91
PID 1236 wrote to memory of 1936	1236	cmd.exe	91
PID 1236 wrote to memory of 1936	1236	cmd.exe	91
PID 2696 wrote to memory of 1556	2696	3fb28b39_by_Libranalysis.exe	90
PID 2696 wrote to memory of 1556	2696	3fb28b39_by_Libranalysis.exe	90
PID 2696 wrote to memory of 1556	2696	3fb28b39_by_Libranalysis.exe	90
PID 2696 wrote to memory of 3952	2696	3fb28b39_by_Libranalysis.exe	93
PID 2696 wrote to memory of 3952	2696	3fb28b39_by_Libranalysis.exe	93
PID 2696 wrote to memory of 3952	2696	3fb28b39_by_Libranalysis.exe	93
PID 2696 wrote to memory of 1052	2696	3fb28b39_by_Libranalysis.exe	98
PID 2696 wrote to memory of 1052	2696	3fb28b39_by_Libranalysis.exe	98
PID 2696 wrote to memory of 1052	2696	3fb28b39_by_Libranalysis.exe	98
PID 2696 wrote to memory of 3792	2696	3fb28b39_by_Libranalysis.exe	95
PID 2696 wrote to memory of 3792	2696	3fb28b39_by_Libranalysis.exe	95
PID 2696 wrote to memory of 3792	2696	3fb28b39_by_Libranalysis.exe	95
PID 1936 wrote to memory of 3348	1936	3fb28b39_by_Libranalysis.exe	99
PID 1936 wrote to memory of 3348	1936	3fb28b39_by_Libranalysis.exe	99
PID 1936 wrote to memory of 3348	1936	3fb28b39_by_Libranalysis.exe	99
PID 1936 wrote to memory of 1272	1936	3fb28b39_by_Libranalysis.exe	101
PID 1936 wrote to memory of 1272	1936	3fb28b39_by_Libranalysis.exe	101
PID 1936 wrote to memory of 1272	1936	3fb28b39_by_Libranalysis.exe	101
PID 1936 wrote to memory of 3756	1936	3fb28b39_by_Libranalysis.exe	102
PID 1936 wrote to memory of 3756	1936	3fb28b39_by_Libranalysis.exe	102
PID 1936 wrote to memory of 3756	1936	3fb28b39_by_Libranalysis.exe	102
PID 1936 wrote to memory of 1020	1936	3fb28b39_by_Libranalysis.exe	108
PID 1936 wrote to memory of 1020	1936	3fb28b39_by_Libranalysis.exe	108
PID 1936 wrote to memory of 1020	1936	3fb28b39_by_Libranalysis.exe	108
PID 3792 wrote to memory of 4024	3792	cmd.exe	107
PID 3792 wrote to memory of 4024	3792	cmd.exe	107
PID 3792 wrote to memory of 4024	3792	cmd.exe	107
PID 1936 wrote to memory of 2084	1936	3fb28b39_by_Libranalysis.exe	106
PID 1936 wrote to memory of 2084	1936	3fb28b39_by_Libranalysis.exe	106
PID 1936 wrote to memory of 2084	1936	3fb28b39_by_Libranalysis.exe	106
PID 3348 wrote to memory of 196	3348	cmd.exe	110
PID 3348 wrote to memory of 196	3348	cmd.exe	110
PID 3348 wrote to memory of 196	3348	cmd.exe	110
PID 2084 wrote to memory of 3712	2084	cmd.exe	111
PID 2084 wrote to memory of 3712	2084	cmd.exe	111
PID 2084 wrote to memory of 3712	2084	cmd.exe	111
PID 196 wrote to memory of 3780	196	3fb28b39_by_Libranalysis.exe	112

System policy modification 1 TTPs 10 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cmd.exe

C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:500
- C:\Users\Admin\OWcEEEkc\wSQwIsoA.exe
  "C:\Users\Admin\OWcEEEkc\wSQwIsoA.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1968
- C:\ProgramData\vIokgYcI\WYoswYwg.exe
  "C:\ProgramData\vIokgYcI\WYoswYwg.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:2072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
    C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1236
    - - C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1936
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        8⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        10⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        11⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        12⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        13⤵
        
        PID:192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        14⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        15⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        16⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        17⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        18⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        19⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        20⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        21⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        22⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        23⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        24⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        25⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        26⤵
        
        PID:1052
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        27⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        27⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        28⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        29⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        30⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        31⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        32⤵
        
        PID:1428
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        33⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        33⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        34⤵
        
        PID:1236
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        35⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        35⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        36⤵
        
        PID:2788
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        37⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        37⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        38⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        39⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        40⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        41⤵
        
        PID:632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        42⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        43⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        44⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        45⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        46⤵
        
        PID:3792
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        47⤵
        
        PID:192
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        47⤵
        
        PID:208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        48⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        49⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        50⤵
        
        PID:3000
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        51⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        51⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        52⤵
        
        PID:204
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        53⤵
        
        PID:632
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        53⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        54⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        55⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        56⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        57⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        58⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        59⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        60⤵
        Checks whether UAC is enabled
        System policy modification
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        61⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        62⤵
        
        PID:3780
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        63⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe
        
        C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis
        63⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis"
        64⤵
        
        PID:1236
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        65⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        64⤵
        
        PID:2616
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        65⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        64⤵
        Modifies registry key
        
        PID:3308
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        65⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        64⤵
        Modifies registry key
        
        PID:3712
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        65⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PCMYMIIk.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        64⤵
        Checks whether UAC is enabled
        System policy modification
        
        PID:3656
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        65⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NCQIwUkQ.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        62⤵
        
        PID:2664
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        63⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        63⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        62⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        62⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        62⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rgswYMoc.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        60⤵
        
        PID:3344
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        61⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        61⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        60⤵
        Modifies registry key
        
        PID:4032
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        61⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        60⤵
        Modifies registry key
        
        PID:1208
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        61⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        60⤵
        Modifies registry key
        
        PID:3012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sGUYQocU.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        58⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        59⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        58⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        58⤵
        Modifies registry key
        
        PID:2232
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        58⤵
        Modifies registry key
        
        PID:2712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GagEoYII.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        56⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        57⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        56⤵
        Modifies registry key
        
        PID:3656
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        56⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        56⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        54⤵
        
        PID:1320
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        55⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mokIMMMs.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        54⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        55⤵
        
        PID:856
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        54⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        54⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AKkgYQUg.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        52⤵
        
        PID:360
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        53⤵
        
        PID:188
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        52⤵
        Modifies registry key
        
        PID:3116
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        52⤵
        
        PID:208
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        52⤵
        
        PID:420
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        50⤵
        Modifies registry key
        
        PID:1272
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        51⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tUIIkUYc.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        50⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        51⤵
        
        PID:580
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        50⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        50⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        48⤵
        
        PID:4008
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        49⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        48⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        48⤵
        
        PID:2696
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        49⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vWUEAQQg.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        48⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        49⤵
        
        PID:3760
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        48⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        46⤵
        Modifies registry key
        
        PID:1380
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        47⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        46⤵
        Modifies registry key
        
        PID:1124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kgUsMIEs.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        46⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2116
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        47⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        47⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        46⤵
        Modifies registry key
        
        PID:2788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cWsUckEM.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        44⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        45⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        44⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        44⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        44⤵
        Modifies registry key
        
        PID:4008
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        42⤵
        
        PID:1124
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        43⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        42⤵
        Modifies registry key
        
        PID:640
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        42⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yIUgAsoQ.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        42⤵
        
        PID:188
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        43⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BuEwQMYE.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        40⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        41⤵
        
        PID:420
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        40⤵
        Modifies registry key
        
        PID:3348
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        40⤵
        Modifies registry key
        
        PID:3004
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        40⤵
        Modifies registry key
        
        PID:4060
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        38⤵
        Modifies registry key
        
        PID:2160
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        38⤵
        Modifies registry key
        
        PID:2744
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        39⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zAQQIUoE.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        38⤵
        Checks whether UAC is enabled
        System policy modification
        
        PID:1248
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        39⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        38⤵
        Modifies registry key
        
        PID:2364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pGgMYcQw.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        36⤵
        
        PID:3792
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        37⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        37⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        36⤵
        Modifies registry key
        
        PID:1248
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        36⤵
        Modifies registry key
        
        PID:2616
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        36⤵
        Modifies registry key
        
        PID:4092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yQcwwAAA.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        34⤵
        
        PID:188
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        35⤵
        
        PID:632
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        35⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        34⤵
        Modifies registry key
        
        PID:2212
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        34⤵
        Modifies registry key
        
        PID:2316
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        34⤵
        Modifies registry key
        
        PID:3780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YosEEAIc.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        32⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        33⤵
        
        PID:640
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        32⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        32⤵
        
        PID:192
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        32⤵
        Modifies registry key
        
        PID:2436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fgAQYkkg.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        30⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        31⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3792
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        30⤵
        Modifies registry key
        
        PID:3908
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        30⤵
        
        PID:204
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        30⤵
        Modifies registry key
        
        PID:2156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TmEkYQgc.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        28⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        29⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        28⤵
        Modifies registry key
        
        PID:1380
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        28⤵
        Modifies registry key
        Suspicious behavior: EnumeratesProcesses
        
        PID:4008
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        28⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fUQIUkoE.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        26⤵
        Checks whether UAC is enabled
        System policy modification
        
        PID:3872
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        27⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        26⤵
        Modifies registry key
        
        PID:3900
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        26⤵
        Modifies registry key
        
        PID:1684
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        26⤵
        Modifies registry key
        
        PID:3908
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        27⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lAscIwEM.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        24⤵
        
        PID:2744
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        25⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        25⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        24⤵
        Modifies registry key
        
        PID:2108
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        24⤵
        Modifies registry key
        
        PID:3116
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        24⤵
        Modifies registry key
        
        PID:1248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QIosEMsU.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        22⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        23⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        22⤵
        Modifies registry key
        
        PID:2108
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        22⤵
        Modifies registry key
        
        PID:4008
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        22⤵
        Modifies registry key
        
        PID:1320
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        20⤵
        Modifies registry key
        
        PID:3872
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        20⤵
        Modifies registry key
        
        PID:188
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        20⤵
        Modifies registry key
        
        PID:1340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CusQAAsY.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        20⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        21⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        18⤵
        Modifies registry key
        
        PID:3932
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        18⤵
        Modifies registry key
        
        PID:2108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\acIgswIU.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        18⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        19⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        18⤵
        Modifies registry key
        
        PID:3784
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        16⤵
        Modifies registry key
        
        PID:2140
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        16⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        16⤵
        Modifies registry key
        
        PID:4060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CMooAkAc.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        16⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        17⤵
        
        PID:420
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        14⤵
        
        PID:3860
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        15⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        14⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        14⤵
        Modifies registry key
        
        PID:3348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vgYsMMoY.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        14⤵
        Checks whether UAC is enabled
        System policy modification
        
        PID:2564
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        15⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        12⤵
        Modifies registry key
        
        PID:1020
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        12⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        12⤵
        Modifies registry key
        
        PID:1580
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        13⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VAwoAIIM.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        12⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        13⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        10⤵
        Modifies registry key
        
        PID:3872
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        10⤵
        Modifies registry key
        
        PID:1380
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        10⤵
        Modifies registry key
        
        PID:2564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zyAEcYcc.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        10⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        11⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        8⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        8⤵
        Modifies registry key
        
        PID:1644
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        8⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PgQooMUI.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        8⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        9⤵
        
        PID:3908
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        6⤵
        Modifies registry key
        
        PID:1272
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        6⤵
        Modifies registry key
        
        PID:3756
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UMkcQIQg.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        7⤵
        
        PID:3712
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        6⤵
        Modifies registry key
        
        PID:1020
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:1556
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      Modifies registry key
      PID:3952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mqsUIIsA.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3792
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        
        PID:4024
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:1052
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:3320
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - Modifies registry key
  PID:3708
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  PID:188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ucUIkQwA.bat" "C:\Users\Admin\AppData\Local\Temp\3fb28b39_by_Libranalysis.exe""
  2⤵
  PID:580
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3004
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:4036

C:\ProgramData\fAokMsQE\KqkoIswI.exe
C:\ProgramData\fAokMsQE\KqkoIswI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2684