Executes dropped EXE

Indirect Command Execution

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

Loads dropped DLL

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Enumerates processes with tasklist

Suspicious use of NtSetInformationThreadHideFromDebugger