d8c3078fb6ba0a29661d8db7c4c2223a96098d929538f1319eb0220f33873d3c

Analysis

max time kernel
106s
max time network
12s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.0MB
Sample260802-brscvs1gqa
SHA256 d8c3078fb6ba0a29661d8db7c4c2223a96098d929538f1319eb0220f33873d3c
MD5 0a1f6a87561da211b31b1f306982ade2
SHA1 a42ee62713d37d3d278b7e4db63c195e85bf6528
SHA512 73c59a0098752de2ebf0baa7669efc74b6854439f406e5d22143a466e0a793f1a264435881338868bc56ce0b93468be8912393e8b07255dc72f977a4b66bd6a9
SSDEEP 49152:/DHLzjHMBld3mt15oQT0ZFw/UaGXTCim/Vs/qHtUvxoW7ZJjx2wqJchjjb+Wj6RL:/DrXsPU4Ds3WeB2sYE
TLSH
T12C763803ECA514E9C1AED1358A739552BB617C894B3163D72B90F6283F77BE0ADB9304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6016	powershell.exe
5508	powershell.exe
3036	powershell.exe
2504	powershell.exe
2248	powershell.exe
1504	powershell.exe
4340	powershell.exe
2864	powershell.exe
3340	powershell.exe
2864	powershell.exe
2332	powershell.exe
932	powershell.exe
4776	powershell.exe
724	powershell.exe
2416	powershell.exe
1740	powershell.exe
476	powershell.exe
1196	powershell.exe
6068	powershell.exe
3524	powershell.exe
2188	powershell.exe
5080	powershell.exe
5856	powershell.exe
1696	powershell.exe
2288	powershell.exe
1724	powershell.exe
4948	powershell.exe
2724	powershell.exe
4440	powershell.exe
4800	powershell.exe
4708	powershell.exe
3508	powershell.exe
2900	powershell.exe
4696	powershell.exe
5300	powershell.exe
4084	powershell.exe
4432	powershell.exe
252	powershell.exe
2532	powershell.exe
5928	powershell.exe
1404	powershell.exe
1260	powershell.exe
3308	powershell.exe
5448	powershell.exe
3604	powershell.exe
5328	powershell.exe
1236	powershell.exe
1044	powershell.exe
2416	powershell.exe
5800	powershell.exe
2996	powershell.exe
992	powershell.exe
2000	powershell.exe
4976	powershell.exe
1800	powershell.exe
3288	powershell.exe
1000	powershell.exe
3120	powershell.exe
4600	powershell.exe
5516	powershell.exe
1036	powershell.exe
1220	powershell.exe
4100	powershell.exe
2296	powershell.exe

Creates a file in the Startup directory 1 TTPs 27 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2960	agent.exe

Adds Run key to start application 2 TTPs 27 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\CompanyEndpointMonitor = "C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe -child=supervisor"	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	1	Go-http-client/1.1

Scheduled Task/Job: Scheduled Task 1 TTPs 38 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6020	schtasks.exe
2916	schtasks.exe
1924	schtasks.exe
2548	schtasks.exe
5544	schtasks.exe
3804	schtasks.exe
4248	schtasks.exe
5476	schtasks.exe
3196	schtasks.exe
1724	schtasks.exe
1676	schtasks.exe
5552	schtasks.exe
5348	schtasks.exe
2964	schtasks.exe
4784	schtasks.exe
3160	schtasks.exe
3460	schtasks.exe
2544	schtasks.exe
5492	schtasks.exe
5080	schtasks.exe
1152	schtasks.exe
828	schtasks.exe
5664	schtasks.exe
2996	schtasks.exe
4992	schtasks.exe
3912	schtasks.exe
5168	schtasks.exe
1616	schtasks.exe
4676	schtasks.exe
5264	schtasks.exe
3044	schtasks.exe
248	schtasks.exe
4548	schtasks.exe
2248	schtasks.exe
2512	schtasks.exe
2444	schtasks.exe
2732	schtasks.exe
4336	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1220	powershell.exe
1220	powershell.exe
1220	powershell.exe
1740	powershell.exe
1740	powershell.exe
1740	powershell.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
2952	powershell.exe
2952	powershell.exe
2952	powershell.exe
724	powershell.exe
724	powershell.exe
724	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
4100	powershell.exe
4100	powershell.exe
4100	powershell.exe
3508	powershell.exe
3508	powershell.exe
3508	powershell.exe
2864	powershell.exe
2864	powershell.exe
2864	powershell.exe
1404	powershell.exe
1404	powershell.exe
1404	powershell.exe
3340	powershell.exe
3340	powershell.exe
3340	powershell.exe
1724	powershell.exe
1724	powershell.exe
1724	powershell.exe
476	powershell.exe
476	powershell.exe
476	powershell.exe
5856	powershell.exe
5856	powershell.exe
5856	powershell.exe
4432	powershell.exe
4432	powershell.exe
4432	powershell.exe
1196	powershell.exe
1196	powershell.exe
1196	powershell.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
4948	powershell.exe
4948	powershell.exe
4948	powershell.exe
1260	powershell.exe
1260	powershell.exe
1260	powershell.exe
3308	powershell.exe
3308	powershell.exe
3308	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
3528	powershell.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeDebugPrivilege	1220	powershell.exe
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	724	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	3340	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	476	powershell.exe
Token: SeDebugPrivilege	5856	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	1196	powershell.exe
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeDebugPrivilege	1260	powershell.exe
Token: SeDebugPrivilege	3308	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	3528	powershell.exe
Token: SeDebugPrivilege	1800	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeDebugPrivilege	244	powershell.exe
Token: SeDebugPrivilege	5448	powershell.exe
Token: SeDebugPrivilege	3604	powershell.exe
Token: SeDebugPrivilege	3288	powershell.exe
Token: SeDebugPrivilege	5800	powershell.exe
Token: SeDebugPrivilege	1000	powershell.exe
Token: SeDebugPrivilege	1252	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	6068	powershell.exe
Token: SeDebugPrivilege	252	powershell.exe
Token: SeDebugPrivilege	4340	powershell.exe
Token: SeDebugPrivilege	3120	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeDebugPrivilege	6016	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	992	powershell.exe
Token: SeDebugPrivilege	5508	powershell.exe
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	4168	powershell.exe
Token: SeDebugPrivilege	992	powershell.exe
Token: SeDebugPrivilege	5300	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	5328	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	4084	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 2888	3348	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 2888 wrote to memory of 1220	2888	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	90
PID 3348 wrote to memory of 3116	3348	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 2888 wrote to memory of 5348	2888	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	94
PID 2888 wrote to memory of 3288	2888	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 2888 wrote to memory of 1740	2888	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	98
PID 3116 wrote to memory of 2416	3116	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	100
PID 3116 wrote to memory of 824	3116	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	104
PID 2888 wrote to memory of 5504	2888	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	105
PID 3348 wrote to memory of 1004	3348	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	110
PID 1004 wrote to memory of 724	1004	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	111
PID 1004 wrote to memory of 1924	1004	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	113
PID 1004 wrote to memory of 264	1004	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	115
PID 3348 wrote to memory of 2248	3348	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	117
PID 1004 wrote to memory of 4708	1004	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	118
PID 1004 wrote to memory of 3804	1004	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	120
PID 3348 wrote to memory of 2584	3348	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	122
PID 2584 wrote to memory of 4100	2584	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	123
PID 2584 wrote to memory of 2548	2584	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	125
PID 3348 wrote to memory of 4316	3348	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	127
PID 2584 wrote to memory of 5144	2584	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	128
PID 2584 wrote to memory of 3508	2584	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	130
PID 2584 wrote to memory of 1272	2584	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	132
PID 3348 wrote to memory of 3544	3348	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	134
PID 3544 wrote to memory of 2864	3544	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	135
PID 3544 wrote to memory of 1616	3544	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	137
PID 3348 wrote to memory of 2024	3348	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	140
PID 3544 wrote to memory of 1328	3544	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	141
PID 3544 wrote to memory of 1404	3544	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	143
PID 3544 wrote to memory of 4844	3544	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	145
PID 3348 wrote to memory of 1532	3348	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	147
PID 1532 wrote to memory of 3340	1532	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	148
PID 1532 wrote to memory of 6020	1532	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	150
PID 1532 wrote to memory of 4188	1532	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	152
PID 3348 wrote to memory of 3112	3348	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	154
PID 1532 wrote to memory of 1724	1532	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	155
PID 1532 wrote to memory of 1640	1532	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	157
PID 3348 wrote to memory of 4376	3348	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	159
PID 4376 wrote to memory of 476	4376	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	160
PID 4376 wrote to memory of 5544	4376	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	162
PID 4376 wrote to memory of 4580	4376	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	164
PID 3348 wrote to memory of 4944	3348	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	166
PID 4376 wrote to memory of 5856	4376	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	167
PID 4376 wrote to memory of 4488	4376	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	169
PID 3348 wrote to memory of 4112	3348	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	172
PID 4112 wrote to memory of 4432	4112	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	173
PID 4112 wrote to memory of 2964	4112	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	175
PID 4112 wrote to memory of 3244	4112	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	177
PID 3348 wrote to memory of 2972	3348	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	179
PID 4112 wrote to memory of 1196	4112	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	180
PID 4112 wrote to memory of 4248	4112	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	223
PID 3348 wrote to memory of 5624	3348	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	184
PID 5624 wrote to memory of 2416	5624	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	185
PID 5624 wrote to memory of 2544	5624	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	230
PID 5624 wrote to memory of 4268	5624	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	189
PID 3348 wrote to memory of 3748	3348	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	191
PID 5624 wrote to memory of 4948	5624	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	192
PID 5624 wrote to memory of 264	5624	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	236
PID 3348 wrote to memory of 1924	3348	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	196
PID 1924 wrote to memory of 1260	1924	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	197
PID 3348 wrote to memory of 3112	3348	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	199
PID 1924 wrote to memory of 3804	1924	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	200
PID 1924 wrote to memory of 1036	1924	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	202
PID 1924 wrote to memory of 3308	1924	2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	204

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1220
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5348
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:3288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1740
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:5504
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:824
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:724
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1924
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:3804
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:2248
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4100
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2548
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:5144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:1272
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:4316
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2864
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1616
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:1328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1404
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:4844
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:2024
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3340
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6020
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:4188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:1640
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:3112
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:476
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5544
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:4580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5856
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:4488
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:4944
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2964
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:3244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1196
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:4248
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:2972
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2544
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:4268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4948
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:264
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:3748
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1260
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3804
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:1036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3308
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:596
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:3112
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:2376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2900
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5492
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:5428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3528
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:4116
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:5608
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:4932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1800
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4248
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2724
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:2544
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:4844
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:2408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1696
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3912
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:264
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:5504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:244
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:3408
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:4648
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:1056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:5448
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2248
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:5144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3604
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:4324
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:2752
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:5068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:3288
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5428
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4784
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:2308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5800
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:300
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:5936
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:4928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1000
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4676
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:1256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1252
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:4476
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:5436
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:4792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:4440
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5264
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:3408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:6068
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:5336
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:1596
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:3736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:252
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1152
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:4588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4340
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:2308
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:3144
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:3244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:3120
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2512
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:5452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2532
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:5464
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:1192
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:1068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:6016
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3160
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:2972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4600
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:5768
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:724
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:4232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:4696
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5476
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:3912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:992
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:2900
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:932
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:2256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:5508
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2444
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:4344
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3036
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:3148
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:3560
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:3260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2504
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:828
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:5400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2864
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:4832
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:3384
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:4544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2332
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3044
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:4520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2996
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:2348
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:4852
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:2620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2296
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1676
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:1204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4168
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:3912
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:800
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:1672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:992
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2732
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5300
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:2868
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:1352
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:1196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1128
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2916
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:5936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5328
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:2288
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:5480
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  - Adds Run key to start application
  PID:1280
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Creates a file in the Startup directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2000
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5080
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:1332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4084
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:1696
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:2452
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  PID:2680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    PID:5672
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2996
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5552
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:1888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1236
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:1260
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:2524
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  PID:4964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    PID:4188
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3460
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:5144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:932
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:4784
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:4508
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  PID:5912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4776
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5300
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3196
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:5864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3524
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:2632
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:4332
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  PID:4732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2288
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5664
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:6040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5928
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:3016
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:3380
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  PID:3488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4976
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1724
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:5444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    PID:700
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:2568
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:5224
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  PID:1896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2188
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:248
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    PID:2708
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:6052
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4168
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:2012
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  PID:2928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2248
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5168
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:6108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4800
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:1208
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:5096
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  PID:4560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5516
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4548
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:6000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5080
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:3696
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:912
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  PID:4380
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    PID:2812
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2996
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:2756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1036
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:2716
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:2296
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  PID:1164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    PID:940
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4992
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:5840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1044
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:992
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:5856
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=watchdog
  2⤵
  PID:2060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$s=(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\");$s.TargetPath=\"C:\\Users\\Admin\\AppData\\Local\\CompanyName\\Agent\\agent.exe\";$s.Arguments='-child=supervisor';$s.Save()"
    3⤵
    PID:4508
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN \CompanyName\EndpointMonitor /XML C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4336
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN \CompanyName\EndpointMonitor /ENABLE
    3⤵
    PID:4316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "(New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Company Monitor.lnk\").TargetPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1504
- - C:\Windows\system32\schtasks.exe
    schtasks /Query /TN \CompanyName\EndpointMonitor /XML
    3⤵
    PID:4348
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-01_0a1f6a87561da211b31b1f306982ade2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -child=worker
  2⤵
  PID:5804

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952

C:\Users\Admin\AppData\Local\CompanyName\Agent\agent.exe
C:\Users\Admin\AppData\Local\CompanyName\Agent\agent.exe
1⤵
- Executes dropped EXE
PID:2960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.exe

Path C:\Users\Admin\AppData\Local\CompanyName\Agent\agent.exe
Size 7.0MB
SHA256 d8c3078fb6ba0a29661d8db7c4c2223a96098d929538f1319eb0220f33873d3c
MD5 0a1f6a87561da211b31b1f306982ade2
SHA1 a42ee62713d37d3d278b7e4db63c195e85bf6528
SHA512 73c59a0098752de2ebf0baa7669efc74b6854439f406e5d22143a466e0a793f1a264435881338868bc56ce0b93468be8912393e8b07255dc72f977a4b66bd6a9
SSDEEP 49152:/DHLzjHMBld3mt15oQT0ZFw/UaGXTCim/Vs/qHtUvxoW7ZJjx2wqJchjjb+Wj6RL:/DrXsPU4Ds3WeB2sYE
TLSH
T12C763803ECA514E9C1AED1358A739552BB617C894B3163D72B90F6283F77BE0ADB9304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.enc

Path C:\Users\Admin\AppData\Local\CompanyName\Agent\config.enc
Size 431B
SHA256 6bfd6d016ae81e1a74e691ce072785ec38d2f8882e5404dcc9fb055464c689bd
MD5 dec4ed0bcebf527fcee8b2b5350611c0
SHA1 6835d4e83d7413256cd7fc9e04ff5198362a5e66
SHA512 37f7ac54367c0b10319b1ab12a8b2a2236cd123a569a6863548d460ce5ffe3652f5642a65932ba360f454a88a2e4a4f512fe4dd5e6ad642b80dbc1d35346419e
TLSH
T1FFE023F4077309DE0381901F09240B235FB54C0D9443A2FFB23A93380150E3A5EEF509
MD5 SHA1 SHA512 TLSH

Submit Download

autostart_status.json

Path C:\Users\Admin\AppData\Local\CompanyName\Agent\state\autostart_status.json
Size 193B
SHA256 870cd95e246c70c294534259576bedfc1b2c52eaa4db00d4248da4810e833c32
MD5 4072b7d8d24903a4316994ff5d24e5be
SHA1 80fff0d2497df805f5aeb31ebcf4833f73b07494
SHA512 476e5385b800e1c03235c2ede34ce65270f1193f317c3fb3c9f59aaa7d7e55c48602ca99911fd93bb56e3758c5523e5e6394c3a728ed561dd1b8bcd0013b74ae
TLSH
T166C0222054225D3A9700EADA93226F4200370E3AEAF8110538A0581C569312CC4D680B
MD5 SHA1 SHA512 TLSH

Submit Download

connectivity.txt

Path C:\Users\Admin\AppData\Local\CompanyName\Agent\state\connectivity.txt
Size 364B
SHA256 19246d341d2e3dce2ab47fc25b7d8f32508b1b6553a365f8ea520af9e827e0a3
MD5 8ff0f6314be0678288ed0ed18bbfe920
SHA1 58809fe6122c0397bc33690e6afb5090e3422284
SHA512 4dc2ebe2e38a313b7bb0e2cb7bc1055a558971ee4b3c1137c86a09a46a170c5c366d312f96e41f177e40d6922e9fd4b5d4d8d11d7ddea6d6bd09d099c0df894d
TLSH
T1E8E0D8200BD7645A8241F06FDA0CBD0E3E9794BE3E6341B505643D2FF9F20748339068
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor_session.json

Path C:\Users\Admin\AppData\Local\CompanyName\Agent\state\supervisor_session.json
Size 66B
SHA256 c20993785f58fc4ef517c6fea6e2ead447686e92edd9b3250968def772a8bf76
MD5 04d85422ae167435fdaf6d8553f6f417
SHA1 19ef27c11a18b3379e649b19c22f7935b9fdb567
SHA512 721712aa9a6e608e7b4958e964e7ca5ad32f5bb701adc0fb0811751dee5a5adba816730ae8020c729ba8fddafcbd330b22effe28ed8d91a3cebaba9483b3ee00
TLSH
T174A002B0B2806A91CCA12D5122435E84C940948E4B721E50D8BD2C8047217A091CB218
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 f2d08d203b14c7b04c51457c288935997a9b6b4798749b26d2ed76f793c9be01
MD5 54c53233026ab406044ca984f7332dea
SHA1 2de7cbe7779615c5b90ab5ed7564ecd81a1a026c
SHA512 c24116c0a6776343a1ca7cd485d6679a0af74e7f48f75762dac9ff2652dc08c7306d2e12a479867e2383a8f77e51589ef2fd5d525f9c15d1c8fe85f1a0aed49a
SSDEEP 1536:zKLg5GYo2hOovpfKQVCYXflJdreY8iFHzwqR40i71Yi9MQyPiMrxKi3jiRjdvRwG:zKLg5GYo2hOovpfKQVCYXflJdiYhFHzG
TLSH
T1E0636292E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dea234ed69b56a5ac20026ced884f4bb792af688a6a339fefb58f73068aaa846
MD5 705868f1da8dfb6bdcc2c97028a6df75
SHA1 0559741e798c1d22fffdf7b875373d94e6c798ae
SHA512 5f47468848b1ca69581fd73eec6fe6c5e600b11aa4fbffb514fa35c12f303d55abb81b1ef7fb4aea060ac2ea7997d91ff17a442ed06396f3c1198b0e2911d24a
TLSH
T103115733B3CC8724DC9A413650CEAC1136B687DB409ECE6BBB84D548B42F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 452eb598b2884fd99242cb5db005e3ac8e31bc9e3d58fe88ad0dd79ba08fbfd1
MD5 33f7a6fe6a1ea0bc7232e4b50743aaab
SHA1 f6389fac11178ade648f5f722858ade7790e8676
SHA512 64fed57e8e59a8d4c52029e5b9a9e95959a860dd2b01f96eda9e0484d0ae4572a4759db8892bacc9ddc3f3b2def74d2f9da00853aedc08b55520c731ed45658a
TLSH
T12C115733F3CC8724DC9A413650CEAC1136B687DB409ECE6BBB84D548B42F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 858acdb8676d64845c57816b4a70cbba05c24841677e899c3325cc692f03f82e
MD5 4ff9d2122a91f2e89bedb050b5a500f3
SHA1 e7926544cde8082758b9dea941a45382fa764043
SHA512 b670bf83d9a17e2001f796914ba6b3471d41408f797072546e5572c14a8167076807fd88f31950e52dcbf804a4456c6c6e6f68d007cc7f44825b36a9c9162c29
TLSH
T1B7115733F3CC8664D89A413650CAAC1036B7C7DB409EDE9BAB84D559B42F685CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xdngn1x4.hly.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xdngn1x4.hly.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

endpoint_task.xml

Path C:\Users\Admin\AppData\Local\Temp\endpoint_task.xml
Size 973B
SHA256 38a8a359b8c61a206fbefa2aee4a5f8f924c8927816f1229d78265c88539de11
MD5 62e290c4c398e513d2a36f4cf77c0bef
SHA1 a0c2f6b2ffae5a44f940134c1ca1488bedd4ca8e
SHA512 5a2d67c3782d33ad57030ce14d599eefe9b1eb1e972774a2faab2faaa4a0b7687563457ca9265a3cc270a1ded1da2f9f718f852ee1d2bb31e8c083bb9078ec2c
TLSH
T1D311E19069B8A162FE754A2592D392815F73931A55DB10A1F0CC0C18FF8D88B805B65D
MD5 SHA1 SHA512 TLSH

Submit Download

Company Monitor.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Monitor.lnk
Size 1KB
SHA256 73c4834e3b6f731405b3c3814e9f148457e40c28ad24e8164ffe065ce128b32a
MD5 ac4dc5ff04c5daff12be8110979ee76b
SHA1 8178c556dc188436da1195aea95ebc47f62dcf18
SHA512 5b11c7bf22000bee31e1db846e025909976537ee1d8184bfc61f89b231851bb0365d1b1d2e37c53506f683928c5628304ec358e28aa6e026a2700754b0704cb7
TLSH
T1E61149158ED61B21E7F2C7B086AA6311CBB5BC9BEBD05F0A101090883479A116EE4F2B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1220-22-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/1220-13-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/1220-18-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/1220-17-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/1220-16-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/1220-15-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/1220-14-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/1220-4-0x00007FFD5EB3F000-0x00007FFD5EB40000-memory.dmp

Download

memory/1220-5-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/1220-9-0x000001FC23400000-0x000001FC23422000-memory.dmp

Download

memory/1220-12-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/1220-11-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/1220-10-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/1220-8-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/2952-45-0x000001C3D3BF0000-0x000001C3D3C38000-memory.dmp

Download