d8c3078fb6ba0a29661d8db7c4c2223a96098d929538f1319eb0220f33873d3c

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.0MB
Sample260802-brscvs1gqa
SHA256 d8c3078fb6ba0a29661d8db7c4c2223a96098d929538f1319eb0220f33873d3c
MD5 0a1f6a87561da211b31b1f306982ade2
SHA1 a42ee62713d37d3d278b7e4db63c195e85bf6528
SHA512 73c59a0098752de2ebf0baa7669efc74b6854439f406e5d22143a466e0a793f1a264435881338868bc56ce0b93468be8912393e8b07255dc72f977a4b66bd6a9
SSDEEP 49152:/DHLzjHMBld3mt15oQT0ZFw/UaGXTCim/Vs/qHtUvxoW7ZJjx2wqJchjjb+Wj6RL:/DrXsPU4Ds3WeB2sYE
TLSH
T12C763803ECA514E9C1AED1358A739552BB617C894B3163D72B90F6283F77BE0ADB9304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2416	powershell.exe
2856	powershell.exe
2364	powershell.exe
2932	powershell.exe
3900	powershell.exe
2536	powershell.exe
2720	powershell.exe
2116	powershell.exe
2836	powershell.exe
3476	powershell.exe
3364	powershell.exe
2324	powershell.exe
3008	powershell.exe
4232	powershell.exe
4768	powershell.exe
864	powershell.exe
4880	powershell.exe
2708	powershell.exe
2324	powershell.exe
4112	powershell.exe
1968	powershell.exe
368	powershell.exe
2932	powershell.exe
4196	powershell.exe
4736	powershell.exe
4104	powershell.exe
3912	powershell.exe
380	powershell.exe
2932	powershell.exe
840	powershell.exe
2572	powershell.exe
628	powershell.exe
3784	powershell.exe
2708	powershell.exe
4196	powershell.exe
3064	powershell.exe
860	powershell.exe
2068	powershell.exe
3020	powershell.exe
412	powershell.exe
3452	powershell.exe
4620	powershell.exe
4748	powershell.exe
2576	powershell.exe
3296	powershell.exe
2368	powershell.exe
1448	powershell.exe
4732	powershell.exe
2412	powershell.exe
3788	powershell.exe
2808	powershell.exe
3064	powershell.exe
4252	powershell.exe
2824	powershell.exe
3116	powershell.exe
3964	powershell.exe
4196	powershell.exe
640	powershell.exe
4888	powershell.exe
532	powershell.exe
1476	powershell.exe
2704	powershell.exe
3028	powershell.exe
1104	powershell.exe

Creates a file in the Startup directory 1 TTPs 41 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4852	agent.exe

Adds Run key to start application 2 TTPs 41 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 41 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2856	schtasks.exe
4384	schtasks.exe
4828	schtasks.exe
2944	schtasks.exe
1372	schtasks.exe
4768	schtasks.exe
4072	schtasks.exe
864	schtasks.exe
868	schtasks.exe
3208	schtasks.exe
1768	schtasks.exe
1704	schtasks.exe
2060	schtasks.exe
1136	schtasks.exe
3436	schtasks.exe
2808	schtasks.exe
3212	schtasks.exe
2364	schtasks.exe
540	schtasks.exe
1264	schtasks.exe
4792	schtasks.exe
3504	schtasks.exe
2116	schtasks.exe
4704	schtasks.exe
2508	schtasks.exe
3912	schtasks.exe
812	schtasks.exe
4084	schtasks.exe
4336	schtasks.exe
1660	schtasks.exe
4656	schtasks.exe
2632	schtasks.exe
1716	schtasks.exe
1144	schtasks.exe
2056	schtasks.exe
1604	schtasks.exe
3020	schtasks.exe
60	schtasks.exe
1344	schtasks.exe
4512	schtasks.exe
3436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2416	powershell.exe
2416	powershell.exe
3296	powershell.exe
3296	powershell.exe
3624	powershell.exe
3624	powershell.exe
3008	powershell.exe
3008	powershell.exe
2720	powershell.exe
2720	powershell.exe
4604	powershell.exe
4604	powershell.exe
2704	powershell.exe
2704	powershell.exe
2808	powershell.exe
2808	powershell.exe
4736	powershell.exe
4736	powershell.exe
4620	powershell.exe
4620	powershell.exe
3784	powershell.exe
3784	powershell.exe
4232	powershell.exe
4232	powershell.exe
4104	powershell.exe
4104	powershell.exe
3912	powershell.exe
3912	powershell.exe
3964	powershell.exe
3964	powershell.exe
2368	powershell.exe
2368	powershell.exe
2068	powershell.exe
2068	powershell.exe
4748	powershell.exe
4748	powershell.exe
1448	powershell.exe
1448	powershell.exe
4068	powershell.exe
4068	powershell.exe
4768	powershell.exe
4768	powershell.exe
2536	powershell.exe
2536	powershell.exe
3064	powershell.exe
3064	powershell.exe
4352	powershell.exe
4352	powershell.exe
436	powershell.exe
436	powershell.exe
3044	powershell.exe
3044	powershell.exe
864	powershell.exe
864	powershell.exe
4196	powershell.exe
4196	powershell.exe
3028	powershell.exe
3028	powershell.exe
2708	powershell.exe
2708	powershell.exe
2464	powershell.exe
2464	powershell.exe
3476	powershell.exe
3476	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	3296	powershell.exe
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	4604	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	4620	powershell.exe
Token: SeDebugPrivilege	3784	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	4104	powershell.exe
Token: SeDebugPrivilege	3912	powershell.exe
Token: SeDebugPrivilege	3964	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	2068	powershell.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	4068	powershell.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	436	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	4196	powershell.exe
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeDebugPrivilege	1104	powershell.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeDebugPrivilege	380	powershell.exe
Token: SeDebugPrivilege	4252	powershell.exe
Token: SeDebugPrivilege	4876	powershell.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	4880	powershell.exe
Token: SeDebugPrivilege	4620	powershell.exe
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	4196	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	4732	powershell.exe
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeDebugPrivilege	3900	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeDebugPrivilege	368	powershell.exe
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	640	powershell.exe
Token: SeDebugPrivilege	3116	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	3364	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2904	2388	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	87
PID 2904 wrote to memory of 2416	2904	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	88
PID 2904 wrote to memory of 2856	2904	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	90
PID 2388 wrote to memory of 2136	2388	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 2904 wrote to memory of 1808	2904	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 2904 wrote to memory of 3296	2904	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	98
PID 2904 wrote to memory of 3788	2904	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	102
PID 2136 wrote to memory of 3008	2136	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	104
PID 2388 wrote to memory of 4928	2388	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	106
PID 4928 wrote to memory of 2720	4928	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	107
PID 4928 wrote to memory of 3504	4928	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	109
PID 4928 wrote to memory of 1132	4928	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	111
PID 2388 wrote to memory of 2336	2388	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	113
PID 4928 wrote to memory of 4604	4928	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	114
PID 4928 wrote to memory of 1056	4928	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	116
PID 2388 wrote to memory of 4224	2388	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	118
PID 4224 wrote to memory of 2704	4224	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	119
PID 4224 wrote to memory of 2116	4224	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	121
PID 2388 wrote to memory of 4196	2388	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	123
PID 4224 wrote to memory of 2856	4224	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	124
PID 4224 wrote to memory of 2808	4224	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	126
PID 4224 wrote to memory of 1080	4224	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	128
PID 2388 wrote to memory of 2352	2388	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	131
PID 2352 wrote to memory of 4736	2352	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	132
PID 2388 wrote to memory of 1356	2388	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	134
PID 2352 wrote to memory of 60	2352	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	135
PID 2352 wrote to memory of 3964	2352	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	137
PID 2352 wrote to memory of 4620	2352	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	139
PID 2352 wrote to memory of 3084	2352	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	141
PID 2388 wrote to memory of 4728	2388	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	143
PID 4728 wrote to memory of 3784	4728	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	144
PID 2388 wrote to memory of 1956	2388	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	146
PID 4728 wrote to memory of 864	4728	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	147
PID 4728 wrote to memory of 4220	4728	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	149
PID 4728 wrote to memory of 4232	4728	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	151
PID 4728 wrote to memory of 2640	4728	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	153
PID 2388 wrote to memory of 4076	2388	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	155
PID 4076 wrote to memory of 4104	4076	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	156
PID 2388 wrote to memory of 3436	2388	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	158
PID 4076 wrote to memory of 1344	4076	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	159
PID 4076 wrote to memory of 4448	4076	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	161
PID 4076 wrote to memory of 3912	4076	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	163
PID 4076 wrote to memory of 1480	4076	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	165
PID 2388 wrote to memory of 4468	2388	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	167
PID 4468 wrote to memory of 3964	4468	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	168
PID 2388 wrote to memory of 4768	2388	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	170
PID 4468 wrote to memory of 1144	4468	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	171
PID 4468 wrote to memory of 3084	4468	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	173
PID 4468 wrote to memory of 2368	4468	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	175
PID 4468 wrote to memory of 4644	4468	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	177
PID 2388 wrote to memory of 1204	2388	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	179
PID 2388 wrote to memory of 2640	2388	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	186
PID 2388 wrote to memory of 5080	2388	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	193
PID 5080 wrote to memory of 1448	5080	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	194
PID 5080 wrote to memory of 3436	5080	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	196
PID 5080 wrote to memory of 1736	5080	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	198
PID 2388 wrote to memory of 744	2388	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	200
PID 5080 wrote to memory of 4068	5080	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	201
PID 5080 wrote to memory of 3084	5080	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	203
PID 2388 wrote to memory of 3244	2388	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	208
PID 3244 wrote to memory of 4768	3244	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	209
PID 2388 wrote to memory of 4044	2388	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	211
PID 3244 wrote to memory of 4828	3244	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	212
PID 3244 wrote to memory of 3096	3244	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	214

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2856
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:1808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3296
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:3788
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3008
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2720
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3504
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:1132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4604
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:1056
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:2336
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2116
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:2856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2808
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:1080
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:4196
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4736
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:60
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:3964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4620
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:3084
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:1356
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3784
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:864
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:4220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4232
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:2640
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:1956
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4104
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1344
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:4448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3912
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:1480
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:3436
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3964
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1144
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:3084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2368
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:4644
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:4768
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:1204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2068
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4384
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:4856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4748
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:3184
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:2640
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3436
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:1736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4068
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:3084
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:744
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4768
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4828
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:3096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2536
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:2068
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:4044
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:4652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4704
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4352
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:3380
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:1076
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:4616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:436
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:868
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:4828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3044
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:2536
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:1808
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:3528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:864
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1660
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:2228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4196
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:4472
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:2944
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:1448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3028
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4792
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:1852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:3792
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:3212
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:3764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2464
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2808
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3476
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:980
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:4732
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:4016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2944
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:4456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:3024
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:3288
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:1644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:380
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2508
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:2716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4252
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:1964
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:2536
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:4868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:4876
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3208
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:1512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:864
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:2804
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:1328
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:4052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4512
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:1884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4620
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:4192
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:4264
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:1036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2116
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4656
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:2056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4668
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:2548
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:3912
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:4196
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1768
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:2584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2932
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:4660
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:812
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:4192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:3520
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1372
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:3064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4732
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:860
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:3476
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:1608
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2412
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3212
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:2704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2932
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:1252
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:4304
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:4700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2576
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2056
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:5116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:840
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:1600
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:2464
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:4300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:3900
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1604
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:3212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1968
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:1492
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:1676
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:3684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:4744
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2632
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:4244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:368
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:3844
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:1456
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:4704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:3020
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3436
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:1884
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:2584
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:4792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1716
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:4384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:640
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:2116
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:2992
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:4860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:3116
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4768
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2464
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:2668
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:2836
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:4912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2856
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1704
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:4288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2932
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:4384
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:2764
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:2160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2364
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:4380
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3364
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:960
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:3788
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    PID:4196
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4072
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:3760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2836
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:4856
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:1056
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:4820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Creates a file in the Startup directory
    PID:3792
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2060
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:3044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:412
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:2096
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:4112
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:3456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    PID:4888
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3912
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:3216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    PID:3400
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:4752
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:1312
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:5004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    PID:2324
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1136
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:1600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3452
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:2880
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:3220
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:2272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    PID:532
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4084
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:4276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2364
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:5116
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:3824
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:2996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    PID:3788
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4336
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:2412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1476
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:2824
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:436
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:3936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    PID:2324
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:540
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:2880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:860
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:5060
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:1744
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:3384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    PID:4112
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1264
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:4440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2572
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:3864
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:4600
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:4336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Creates a file in the Startup directory
    PID:4648
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:812
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:1952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    PID:2584
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:2036
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:3960
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:4288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    PID:628
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3020
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    PID:3364
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:1652
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:3436

C:\Users\Admin\AppData\Local\CompanyName\Agent\agent.exe
C:\Users\Admin\AppData\Local\CompanyName\Agent\agent.exe
1⤵
- Executes dropped EXE
PID:4852

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.exe

Path C:\Users\Admin\AppData\Local\CompanyName\Agent\agent.exe
Size 7.0MB
SHA256 d8c3078fb6ba0a29661d8db7c4c2223a96098d929538f1319eb0220f33873d3c
MD5 0a1f6a87561da211b31b1f306982ade2
SHA1 a42ee62713d37d3d278b7e4db63c195e85bf6528
SHA512 73c59a0098752de2ebf0baa7669efc74b6854439f406e5d22143a466e0a793f1a264435881338868bc56ce0b93468be8912393e8b07255dc72f977a4b66bd6a9
SSDEEP 49152:/DHLzjHMBld3mt15oQT0ZFw/UaGXTCim/Vs/qHtUvxoW7ZJjx2wqJchjjb+Wj6RL:/DrXsPU4Ds3WeB2sYE
TLSH
T12C763803ECA514E9C1AED1358A739552BB617C894B3163D72B90F6283F77BE0ADB9304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.enc

Path C:\Users\Admin\AppData\Local\CompanyName\Agent\config.enc
Size 431B
SHA256 4cb2861ad564f63a376b37f48a4560f6dca429263232ab1331883718e8c8cf6e
MD5 f03dbb2981d28adb756f6196d93eb461
SHA1 e65b83cbdfe4d76752f1ffabecad4d717d942e43
SHA512 39cbf25ec4eff4d459ba3af4f6faefcda8606a69092c582d11e70040046958bdea2f1f4f66898bf1a86e6ef5a219f7b1bf94a4bdf3131fa272808ff3474808cf
TLSH
T121E0A32C41850B32AA009F7A3ED5B64A7E4D5459443862563A6683EB566C29E5381873
MD5 SHA1 SHA512 TLSH

Submit Download

autostart_status.json

Path C:\Users\Admin\AppData\Local\CompanyName\Agent\state\autostart_status.json
Size 193B
SHA256 870cd95e246c70c294534259576bedfc1b2c52eaa4db00d4248da4810e833c32
MD5 4072b7d8d24903a4316994ff5d24e5be
SHA1 80fff0d2497df805f5aeb31ebcf4833f73b07494
SHA512 476e5385b800e1c03235c2ede34ce65270f1193f317c3fb3c9f59aaa7d7e55c48602ca99911fd93bb56e3758c5523e5e6394c3a728ed561dd1b8bcd0013b74ae
TLSH
T166C0222054225D3A9700EADA93226F4200370E3AEAF8110538A0581C569312CC4D680B
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor_session.json

Path C:\Users\Admin\AppData\Local\CompanyName\Agent\state\supervisor_session.json
Size 66B
SHA256 98d6572ebbd83697133f898ca869082752a149a98eb3772ff0babde72f09644a
MD5 902864387c4ff9e15a2fdadcae390165
SHA1 ceb7d3a81b0867ea617b7903fe32903ba2fb798d
SHA512 481cd9d2791ab6948daaa5975c0d3b24045ff5fce146b39c3e164e9f2adf7332cfeb5bd438f1a8d8bff8b0613bda5e814a7aaf50ee6ea3b079dce30f9bf80d81
TLSH
T10BA00261B3806F51DC613C4121435E86CA40844E8B771EA1D8BD2C80451438051CB21C
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
TLSH
T170334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download