Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 00:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_9f6d6a998f90dfc89761dcbf150fc2bc_cobalt-strike_icedid_ryuk.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_9f6d6a998f90dfc89761dcbf150fc2bc_cobalt-strike_icedid_ryuk.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
General
- Target 2026-08-19_9f6d6a998f90dfc89761dcbf150fc2bc_cobalt-strike_icedid_ryuk.exe
- Size 170KB
- Sample260820-ab93asbr4t
- SHA256 38a95a8479051a511cdfec97d7ab88ebe116ffc1a084a54888c54f1a0ac2e8a3
- MD5 9f6d6a998f90dfc89761dcbf150fc2bc
- SHA1 d0db7ea14a495468f77bccfb4526384d63aca5ba
- SHA512 140f17a4f1292819ac6de38c8afb3a5abd9057f5e9f663176f1117f5d2031b98737fa5167f8804f71598465d72d340b25232697a9ec813e1f00af243334191ff
- SSDEEP 3072:JmXlsXCel7r9+vDpf1flr+Rf5U1xbff5eLRJyxjEbCNt+FdjsZLG4T4yufbPlEGD:JYM3lXSptYRyICNt+njsc42BHwnPiaQ
- TLSH T10F040744F29E50E8E0768138A5A24751BAF37C1507645FFF06A44F6AAEE3AC07D3BB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 5 IoCs
flow pid Process 5 6120 backgroundTaskHost.exe 6 936 svc_cache_6120.exe 12 5796 backgroundTaskHost.exe 13 2128 svc_cache_5796.exe 16 6336 backgroundTaskHost.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
pid Process 1492 backgroundTaskHost.exe 6120 backgroundTaskHost.exe 936 svc_cache_6120.exe 4808 svc_cache_936.exe 5796 backgroundTaskHost.exe 2128 svc_cache_5796.exe 4548 svc_cache_2128.exe 244 backgroundTaskHost.exe 4836 backgroundTaskHost.exe 5620 backgroundTaskHost.exe 2820 backgroundTaskHost.exe 6108 backgroundTaskHost.exe 5956 backgroundTaskHost.exe 2928 backgroundTaskHost.exe 1152 backgroundTaskHost.exe 3752 backgroundTaskHost.exe 908 backgroundTaskHost.exe 4620 backgroundTaskHost.exe 2772 backgroundTaskHost.exe 5528 backgroundTaskHost.exe 1196 backgroundTaskHost.exe 3052 backgroundTaskHost.exe 3564 backgroundTaskHost.exe 3224 backgroundTaskHost.exe 4956 backgroundTaskHost.exe 1852 backgroundTaskHost.exe 4560 backgroundTaskHost.exe 4352 backgroundTaskHost.exe 4004 backgroundTaskHost.exe 4328 backgroundTaskHost.exe 2444 backgroundTaskHost.exe 1192 backgroundTaskHost.exe 5980 backgroundTaskHost.exe 4780 backgroundTaskHost.exe 5768 backgroundTaskHost.exe 1300 backgroundTaskHost.exe 3440 backgroundTaskHost.exe 5948 backgroundTaskHost.exe 1988 backgroundTaskHost.exe 3936 backgroundTaskHost.exe 4688 backgroundTaskHost.exe 4440 backgroundTaskHost.exe 2612 backgroundTaskHost.exe 3060 backgroundTaskHost.exe 1444 backgroundTaskHost.exe 6016 backgroundTaskHost.exe 1608 backgroundTaskHost.exe 6124 backgroundTaskHost.exe 4952 backgroundTaskHost.exe 3000 backgroundTaskHost.exe 4884 backgroundTaskHost.exe 2708 backgroundTaskHost.exe 4968 backgroundTaskHost.exe 1896 backgroundTaskHost.exe 4584 backgroundTaskHost.exe 3132 backgroundTaskHost.exe 3112 backgroundTaskHost.exe 2764 backgroundTaskHost.exe 1552 backgroundTaskHost.exe 6116 backgroundTaskHost.exe 2668 backgroundTaskHost.exe 6112 backgroundTaskHost.exe 1436 backgroundTaskHost.exe 3576 backgroundTaskHost.exe - Modifies registry class 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{67F16C50-6B61-4521-8AE7-616799FA0D79}\LocalServer32 2026-08-19_9f6d6a998f90dfc89761dcbf150fc2bc_cobalt-strike_icedid_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67F16C50-6B61-4521-8AE7-616799FA0D79}\LocalServer32\ = "\"C:\\ProgramData\\SystemApps\\TaskHost_LyPw\\backgroundTaskHost.exe\" -Embedding" 2026-08-19_9f6d6a998f90dfc89761dcbf150fc2bc_cobalt-strike_icedid_ryuk.exe Key created \REGISTRY\MACHINE\Software\Classes\Microsoft.Windows.RuntimeHost.7 2026-08-19_9f6d6a998f90dfc89761dcbf150fc2bc_cobalt-strike_icedid_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Windows.RuntimeHost.7\ = "Background Task Host" 2026-08-19_9f6d6a998f90dfc89761dcbf150fc2bc_cobalt-strike_icedid_ryuk.exe Key created \REGISTRY\MACHINE\Software\Classes\Microsoft.Windows.RuntimeHost.7\CLSID 2026-08-19_9f6d6a998f90dfc89761dcbf150fc2bc_cobalt-strike_icedid_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Windows.RuntimeHost.7\CLSID\ = "{67F16C50-6B61-4521-8AE7-616799FA0D79}" 2026-08-19_9f6d6a998f90dfc89761dcbf150fc2bc_cobalt-strike_icedid_ryuk.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{67F16C50-6B61-4521-8AE7-616799FA0D79} 2026-08-19_9f6d6a998f90dfc89761dcbf150fc2bc_cobalt-strike_icedid_ryuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67F16C50-6B61-4521-8AE7-616799FA0D79}\ = "Background Task Host" 2026-08-19_9f6d6a998f90dfc89761dcbf150fc2bc_cobalt-strike_icedid_ryuk.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4836 backgroundTaskHost.exe 4836 backgroundTaskHost.exe 5620 backgroundTaskHost.exe 5620 backgroundTaskHost.exe 2820 backgroundTaskHost.exe 2820 backgroundTaskHost.exe 6108 backgroundTaskHost.exe 6108 backgroundTaskHost.exe 5956 backgroundTaskHost.exe 5956 backgroundTaskHost.exe 2928 backgroundTaskHost.exe 2928 backgroundTaskHost.exe 1152 backgroundTaskHost.exe 1152 backgroundTaskHost.exe 3752 backgroundTaskHost.exe 3752 backgroundTaskHost.exe 908 backgroundTaskHost.exe 908 backgroundTaskHost.exe 4620 backgroundTaskHost.exe 4620 backgroundTaskHost.exe 2772 backgroundTaskHost.exe 2772 backgroundTaskHost.exe 5528 backgroundTaskHost.exe 5528 backgroundTaskHost.exe 1196 backgroundTaskHost.exe 1196 backgroundTaskHost.exe 3052 backgroundTaskHost.exe 3052 backgroundTaskHost.exe 3564 backgroundTaskHost.exe 3564 backgroundTaskHost.exe 3224 backgroundTaskHost.exe 3224 backgroundTaskHost.exe 4956 backgroundTaskHost.exe 4956 backgroundTaskHost.exe 1852 backgroundTaskHost.exe 1852 backgroundTaskHost.exe 4560 backgroundTaskHost.exe 4560 backgroundTaskHost.exe 4352 backgroundTaskHost.exe 4352 backgroundTaskHost.exe 4004 backgroundTaskHost.exe 4004 backgroundTaskHost.exe 4328 backgroundTaskHost.exe 4328 backgroundTaskHost.exe 2444 backgroundTaskHost.exe 2444 backgroundTaskHost.exe 1192 backgroundTaskHost.exe 1192 backgroundTaskHost.exe 5980 backgroundTaskHost.exe 5980 backgroundTaskHost.exe 4780 backgroundTaskHost.exe 4780 backgroundTaskHost.exe 5768 backgroundTaskHost.exe 5768 backgroundTaskHost.exe 1300 backgroundTaskHost.exe 1300 backgroundTaskHost.exe 3440 backgroundTaskHost.exe 3440 backgroundTaskHost.exe 5948 backgroundTaskHost.exe 5948 backgroundTaskHost.exe 1988 backgroundTaskHost.exe 1988 backgroundTaskHost.exe 3936 backgroundTaskHost.exe 3936 backgroundTaskHost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 244 backgroundTaskHost.exe Token: SeImpersonatePrivilege 244 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 244 backgroundTaskHost.exe Token: SeDebugPrivilege 4836 backgroundTaskHost.exe Token: SeImpersonatePrivilege 4836 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 4836 backgroundTaskHost.exe Token: SeDebugPrivilege 5620 backgroundTaskHost.exe Token: SeImpersonatePrivilege 5620 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 5620 backgroundTaskHost.exe Token: SeDebugPrivilege 2820 backgroundTaskHost.exe Token: SeImpersonatePrivilege 2820 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 2820 backgroundTaskHost.exe Token: SeDebugPrivilege 6108 backgroundTaskHost.exe Token: SeImpersonatePrivilege 6108 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 6108 backgroundTaskHost.exe Token: SeDebugPrivilege 5956 backgroundTaskHost.exe Token: SeImpersonatePrivilege 5956 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 5956 backgroundTaskHost.exe Token: SeDebugPrivilege 2928 backgroundTaskHost.exe Token: SeImpersonatePrivilege 2928 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 2928 backgroundTaskHost.exe Token: SeDebugPrivilege 1152 backgroundTaskHost.exe Token: SeImpersonatePrivilege 1152 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 1152 backgroundTaskHost.exe Token: SeDebugPrivilege 3752 backgroundTaskHost.exe Token: SeImpersonatePrivilege 3752 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 3752 backgroundTaskHost.exe Token: SeDebugPrivilege 908 backgroundTaskHost.exe Token: SeImpersonatePrivilege 908 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 908 backgroundTaskHost.exe Token: SeDebugPrivilege 4620 backgroundTaskHost.exe Token: SeImpersonatePrivilege 4620 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 4620 backgroundTaskHost.exe Token: SeDebugPrivilege 2772 backgroundTaskHost.exe Token: SeImpersonatePrivilege 2772 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 2772 backgroundTaskHost.exe Token: SeDebugPrivilege 5528 backgroundTaskHost.exe Token: SeImpersonatePrivilege 5528 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 5528 backgroundTaskHost.exe Token: SeDebugPrivilege 1196 backgroundTaskHost.exe Token: SeImpersonatePrivilege 1196 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 1196 backgroundTaskHost.exe Token: SeDebugPrivilege 3052 backgroundTaskHost.exe Token: SeImpersonatePrivilege 3052 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 3052 backgroundTaskHost.exe Token: SeDebugPrivilege 3564 backgroundTaskHost.exe Token: SeImpersonatePrivilege 3564 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 3564 backgroundTaskHost.exe Token: SeDebugPrivilege 3224 backgroundTaskHost.exe Token: SeImpersonatePrivilege 3224 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 3224 backgroundTaskHost.exe Token: SeDebugPrivilege 4956 backgroundTaskHost.exe Token: SeImpersonatePrivilege 4956 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 4956 backgroundTaskHost.exe Token: SeDebugPrivilege 1852 backgroundTaskHost.exe Token: SeImpersonatePrivilege 1852 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 1852 backgroundTaskHost.exe Token: SeDebugPrivilege 4560 backgroundTaskHost.exe Token: SeImpersonatePrivilege 4560 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 4560 backgroundTaskHost.exe Token: SeDebugPrivilege 4352 backgroundTaskHost.exe Token: SeImpersonatePrivilege 4352 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 4352 backgroundTaskHost.exe Token: SeDebugPrivilege 4004 backgroundTaskHost.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5668 wrote to memory of 1492 5668 2026-08-19_9f6d6a998f90dfc89761dcbf150fc2bc_cobalt-strike_icedid_ryuk.exe 89 PID 1492 wrote to memory of 6120 1492 backgroundTaskHost.exe 90 PID 6120 wrote to memory of 936 6120 backgroundTaskHost.exe 91 PID 936 wrote to memory of 4808 936 svc_cache_6120.exe 92 PID 1492 wrote to memory of 5796 1492 backgroundTaskHost.exe 94 PID 5796 wrote to memory of 2128 5796 backgroundTaskHost.exe 95 PID 2128 wrote to memory of 4548 2128 svc_cache_5796.exe 96 PID 1492 wrote to memory of 6336 1492 backgroundTaskHost.exe 687 PID 6336 wrote to memory of 6972 6336 backgroundTaskHost.exe 1359
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_9f6d6a998f90dfc89761dcbf150fc2bc_cobalt-strike_icedid_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_9f6d6a998f90dfc89761dcbf150fc2bc_cobalt-strike_icedid_ryuk.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\ProgramData\SystemApps\TaskHost_LyPw\svc_cache_6120.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\svc_cache_6120.exe"4⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\ProgramData\SystemApps\TaskHost_LyPw\svc_cache_936.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\svc_cache_936.exe"5⤵
- Executes dropped EXE
PID:4808
-
-
-
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\ProgramData\SystemApps\TaskHost_LyPw\svc_cache_5796.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\svc_cache_5796.exe"4⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\ProgramData\SystemApps\TaskHost_LyPw\svc_cache_2128.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\svc_cache_2128.exe"5⤵
- Executes dropped EXE
PID:4548
-
-
-
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"3⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:6336 -
C:\ProgramData\SystemApps\TaskHost_LyPw\svc_cache_6336.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\svc_cache_6336.exe"4⤵PID:6972
-
-
-
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:244 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5620 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6108 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5956 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2928 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1152 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3752 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding10⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:908 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4620 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding12⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2772 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5528 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding14⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3052 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding16⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3564 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3224 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding18⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4956 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1852 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding20⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4352 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding22⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4004 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4328 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding24⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2444 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1192 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding26⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5980 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4780 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding28⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5768 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1300 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding30⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3440 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5948 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding32⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1988 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3936 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding34⤵
- Executes dropped EXE
PID:4688 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding35⤵
- Executes dropped EXE
PID:4440 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding36⤵
- Executes dropped EXE
PID:2612 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding37⤵
- Executes dropped EXE
PID:3060 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding38⤵
- Executes dropped EXE
PID:1444 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding39⤵
- Executes dropped EXE
PID:6016 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding40⤵
- Executes dropped EXE
PID:1608 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding41⤵
- Executes dropped EXE
PID:6124 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding42⤵
- Executes dropped EXE
PID:4952 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding43⤵
- Executes dropped EXE
PID:3000 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding44⤵
- Executes dropped EXE
PID:4884 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding45⤵
- Executes dropped EXE
PID:2708 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding46⤵
- Executes dropped EXE
PID:4968 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding47⤵
- Executes dropped EXE
PID:1896 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding48⤵
- Executes dropped EXE
PID:4584 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding49⤵
- Executes dropped EXE
PID:3132 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding50⤵
- Executes dropped EXE
PID:3112 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding51⤵
- Executes dropped EXE
PID:2764 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding52⤵
- Executes dropped EXE
PID:1552 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding53⤵
- Executes dropped EXE
PID:6116 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding54⤵
- Executes dropped EXE
PID:2668 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding55⤵
- Executes dropped EXE
PID:6112 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding56⤵
- Executes dropped EXE
PID:1436 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding57⤵
- Executes dropped EXE
PID:3576 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding58⤵PID:2664
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding59⤵PID:1716
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding60⤵PID:5676
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding61⤵PID:2292
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding62⤵PID:6140
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding63⤵PID:5488
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding64⤵PID:4608
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding65⤵PID:5016
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding66⤵PID:5512
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding67⤵PID:3560
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding68⤵PID:3636
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding69⤵PID:4360
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding70⤵PID:1016
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding71⤵PID:3176
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding72⤵PID:1764
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding73⤵PID:5596
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding74⤵PID:3012
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding75⤵PID:2460
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding76⤵PID:5252
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding77⤵PID:2548
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding78⤵PID:2340
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding79⤵PID:6040
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding80⤵PID:3648
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding81⤵PID:5940
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding82⤵PID:5880
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding83⤵PID:1920
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding84⤵PID:3772
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding85⤵PID:5532
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding86⤵PID:4476
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding87⤵PID:5764
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding88⤵PID:3592
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding89⤵PID:3124
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding90⤵PID:5072
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding91⤵PID:3724
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding92⤵PID:424
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding93⤵PID:5408
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding94⤵PID:5572
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding95⤵PID:4948
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding96⤵PID:4924
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding97⤵PID:4348
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding98⤵PID:5092
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding99⤵PID:5568
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding100⤵PID:2348
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding101⤵PID:4164
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding102⤵PID:1288
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding103⤵PID:200
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding104⤵PID:1524
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding105⤵PID:5524
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding106⤵PID:3140
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding107⤵PID:3068
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding108⤵PID:1392
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding109⤵PID:5968
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding110⤵PID:5888
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding111⤵PID:572
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding112⤵PID:248
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding113⤵PID:5560
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding114⤵PID:4708
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding115⤵PID:3428
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding116⤵PID:1780
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding117⤵PID:1076
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding118⤵PID:5452
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding119⤵PID:5444
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding120⤵PID:3684
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding121⤵PID:4480
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding122⤵PID:5740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-