Analysis
- user interaction
yes - max time kernel
84s - max time network
103s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 03:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
h6cz3u.zip
Resource
win10v2004-20260513-en
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
h6cz3u.zip
Resource
win11ltsc2024-20260709-en
8 signatures
900 seconds
General
- Target h6cz3u.zip
- Size 3.6MB
- Sample260820-dybpssbb92
- SHA256 c3177c78177edf0575519330708ebba51dbc38c5ed7d6d949f552dac0e2c6a78
- MD5 707151ed8b00f54ca19067955dfc501d
- SHA1 ff4e0d915540f70d9d90f3380dc59960976d5479
- SHA512 e1eeaebac602be6e181e21af2d39959de7a41d19da4161e6ed5a15bc10cdd42ad3a182d3e04e9ef700558ea0bad4db557394352f21db65a952a887dda88bb7dc
- SSDEEP 98304:9MkoOgVZrMRIoe3Kv9IQC+iZAxoyJxB44vM/I6:9b1WZrMRuQef+iKmyJxk/X
- TLSH T1F4063360D8D91271FF9FAACCB973ACE9E44686F7DBAC84F6D050785A141C4C21CB94B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 4 IoCs
flow pid Process 10 904 backgroundTaskHost.exe 11 3904 svc_cache_904.exe 13 896 svc_cache_3904.exe 14 5960 svc_cache_896.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
pid Process 1180 backgroundTaskHost.exe 5760 backgroundTaskHost.exe 904 backgroundTaskHost.exe 3904 svc_cache_904.exe 896 svc_cache_3904.exe 5960 svc_cache_896.exe 1260 backgroundTaskHost.exe 4768 backgroundTaskHost.exe 5948 backgroundTaskHost.exe 4488 backgroundTaskHost.exe 2640 backgroundTaskHost.exe 2068 backgroundTaskHost.exe 5036 backgroundTaskHost.exe 1816 backgroundTaskHost.exe 5240 backgroundTaskHost.exe 5940 backgroundTaskHost.exe 4788 backgroundTaskHost.exe 3660 backgroundTaskHost.exe 5992 backgroundTaskHost.exe 4908 backgroundTaskHost.exe 5312 backgroundTaskHost.exe 2224 backgroundTaskHost.exe 2576 backgroundTaskHost.exe 1288 backgroundTaskHost.exe 5176 backgroundTaskHost.exe 3624 backgroundTaskHost.exe 5224 backgroundTaskHost.exe 1340 backgroundTaskHost.exe 3496 backgroundTaskHost.exe 4216 backgroundTaskHost.exe 2396 backgroundTaskHost.exe 3180 backgroundTaskHost.exe 5788 backgroundTaskHost.exe 2704 backgroundTaskHost.exe 2344 backgroundTaskHost.exe 4280 backgroundTaskHost.exe 3292 backgroundTaskHost.exe 1884 backgroundTaskHost.exe 4468 backgroundTaskHost.exe 5188 backgroundTaskHost.exe 3096 backgroundTaskHost.exe 2724 backgroundTaskHost.exe 5792 backgroundTaskHost.exe 4516 backgroundTaskHost.exe 3744 backgroundTaskHost.exe 2920 backgroundTaskHost.exe 3964 backgroundTaskHost.exe 2660 backgroundTaskHost.exe 2372 backgroundTaskHost.exe 4128 backgroundTaskHost.exe 756 backgroundTaskHost.exe 3188 backgroundTaskHost.exe 4760 backgroundTaskHost.exe 5132 backgroundTaskHost.exe 1512 backgroundTaskHost.exe 5836 backgroundTaskHost.exe 3444 backgroundTaskHost.exe 2808 backgroundTaskHost.exe 2904 backgroundTaskHost.exe 2464 backgroundTaskHost.exe 5104 backgroundTaskHost.exe 3812 backgroundTaskHost.exe 4308 backgroundTaskHost.exe 424 backgroundTaskHost.exe - Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{67F16C50-6B61-4521-8AE7-616799FA0D79}\LocalServer32 LycronCrypter.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Windows.RuntimeHost.7\ = "Background Task Host" LycronCrypter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ NOTEPAD.EXE Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{67F16C50-6B61-4521-8AE7-616799FA0D79} LycronCrypter.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67F16C50-6B61-4521-8AE7-616799FA0D79}\ = "Background Task Host" LycronCrypter.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67F16C50-6B61-4521-8AE7-616799FA0D79}\LocalServer32\ = "\"C:\\ProgramData\\SystemApps\\TaskHost_LyPw\\backgroundTaskHost.exe\" -Embedding" LycronCrypter.exe Key created \REGISTRY\MACHINE\Software\Classes\Microsoft.Windows.RuntimeHost.7 LycronCrypter.exe Key created \REGISTRY\MACHINE\Software\Classes\Microsoft.Windows.RuntimeHost.7\CLSID LycronCrypter.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Windows.RuntimeHost.7\CLSID\ = "{67F16C50-6B61-4521-8AE7-616799FA0D79}" LycronCrypter.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ NOTEPAD.EXE - Opens file in notepad (likely ransom note) 2 IoCs
pid Process 4428 NOTEPAD.EXE 3008 NOTEPAD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4768 backgroundTaskHost.exe 4768 backgroundTaskHost.exe 5948 backgroundTaskHost.exe 5948 backgroundTaskHost.exe 4488 backgroundTaskHost.exe 4488 backgroundTaskHost.exe 2640 backgroundTaskHost.exe 2640 backgroundTaskHost.exe 2068 backgroundTaskHost.exe 2068 backgroundTaskHost.exe 5036 backgroundTaskHost.exe 5036 backgroundTaskHost.exe 1816 backgroundTaskHost.exe 1816 backgroundTaskHost.exe 5240 backgroundTaskHost.exe 5240 backgroundTaskHost.exe 5940 backgroundTaskHost.exe 5940 backgroundTaskHost.exe 4788 backgroundTaskHost.exe 4788 backgroundTaskHost.exe 3660 backgroundTaskHost.exe 3660 backgroundTaskHost.exe 5992 backgroundTaskHost.exe 5992 backgroundTaskHost.exe 4908 backgroundTaskHost.exe 4908 backgroundTaskHost.exe 5312 backgroundTaskHost.exe 5312 backgroundTaskHost.exe 2224 backgroundTaskHost.exe 2224 backgroundTaskHost.exe 2576 backgroundTaskHost.exe 2576 backgroundTaskHost.exe 1288 backgroundTaskHost.exe 1288 backgroundTaskHost.exe 5176 backgroundTaskHost.exe 5176 backgroundTaskHost.exe 3624 backgroundTaskHost.exe 3624 backgroundTaskHost.exe 5224 backgroundTaskHost.exe 5224 backgroundTaskHost.exe 1340 backgroundTaskHost.exe 1340 backgroundTaskHost.exe 3496 backgroundTaskHost.exe 3496 backgroundTaskHost.exe 4216 backgroundTaskHost.exe 4216 backgroundTaskHost.exe 2396 backgroundTaskHost.exe 2396 backgroundTaskHost.exe 3180 backgroundTaskHost.exe 3180 backgroundTaskHost.exe 5788 backgroundTaskHost.exe 5788 backgroundTaskHost.exe 2704 backgroundTaskHost.exe 2704 backgroundTaskHost.exe 2344 backgroundTaskHost.exe 2344 backgroundTaskHost.exe 4280 backgroundTaskHost.exe 4280 backgroundTaskHost.exe 3292 backgroundTaskHost.exe 3292 backgroundTaskHost.exe 1884 backgroundTaskHost.exe 1884 backgroundTaskHost.exe 4468 backgroundTaskHost.exe 4468 backgroundTaskHost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1260 backgroundTaskHost.exe Token: SeImpersonatePrivilege 1260 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 1260 backgroundTaskHost.exe Token: SeDebugPrivilege 4768 backgroundTaskHost.exe Token: SeImpersonatePrivilege 4768 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 4768 backgroundTaskHost.exe Token: SeDebugPrivilege 5948 backgroundTaskHost.exe Token: SeImpersonatePrivilege 5948 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 5948 backgroundTaskHost.exe Token: SeDebugPrivilege 4488 backgroundTaskHost.exe Token: SeImpersonatePrivilege 4488 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 4488 backgroundTaskHost.exe Token: SeDebugPrivilege 2640 backgroundTaskHost.exe Token: SeImpersonatePrivilege 2640 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 2640 backgroundTaskHost.exe Token: SeDebugPrivilege 2068 backgroundTaskHost.exe Token: SeImpersonatePrivilege 2068 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 2068 backgroundTaskHost.exe Token: SeDebugPrivilege 5036 backgroundTaskHost.exe Token: SeImpersonatePrivilege 5036 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 5036 backgroundTaskHost.exe Token: SeDebugPrivilege 1816 backgroundTaskHost.exe Token: SeImpersonatePrivilege 1816 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 1816 backgroundTaskHost.exe Token: SeDebugPrivilege 5240 backgroundTaskHost.exe Token: SeImpersonatePrivilege 5240 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 5240 backgroundTaskHost.exe Token: SeDebugPrivilege 5940 backgroundTaskHost.exe Token: SeImpersonatePrivilege 5940 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 5940 backgroundTaskHost.exe Token: SeDebugPrivilege 4788 backgroundTaskHost.exe Token: SeImpersonatePrivilege 4788 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 4788 backgroundTaskHost.exe Token: SeDebugPrivilege 3660 backgroundTaskHost.exe Token: SeImpersonatePrivilege 3660 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 3660 backgroundTaskHost.exe Token: SeDebugPrivilege 5992 backgroundTaskHost.exe Token: SeImpersonatePrivilege 5992 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 5992 backgroundTaskHost.exe Token: SeDebugPrivilege 4908 backgroundTaskHost.exe Token: SeImpersonatePrivilege 4908 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 4908 backgroundTaskHost.exe Token: SeDebugPrivilege 5312 backgroundTaskHost.exe Token: SeImpersonatePrivilege 5312 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 5312 backgroundTaskHost.exe Token: SeDebugPrivilege 2224 backgroundTaskHost.exe Token: SeImpersonatePrivilege 2224 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 2224 backgroundTaskHost.exe Token: SeDebugPrivilege 2576 backgroundTaskHost.exe Token: SeImpersonatePrivilege 2576 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 2576 backgroundTaskHost.exe Token: SeDebugPrivilege 1288 backgroundTaskHost.exe Token: SeImpersonatePrivilege 1288 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 1288 backgroundTaskHost.exe Token: SeDebugPrivilege 5176 backgroundTaskHost.exe Token: SeImpersonatePrivilege 5176 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 5176 backgroundTaskHost.exe Token: SeDebugPrivilege 3624 backgroundTaskHost.exe Token: SeImpersonatePrivilege 3624 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 3624 backgroundTaskHost.exe Token: SeDebugPrivilege 5224 backgroundTaskHost.exe Token: SeImpersonatePrivilege 5224 backgroundTaskHost.exe Token: SeAssignPrimaryTokenPrivilege 5224 backgroundTaskHost.exe Token: SeDebugPrivilege 1340 backgroundTaskHost.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3344 wrote to memory of 1180 3344 LycronCrypter.exe 92 PID 1180 wrote to memory of 5760 1180 backgroundTaskHost.exe 93 PID 1180 wrote to memory of 904 1180 backgroundTaskHost.exe 99 PID 904 wrote to memory of 3904 904 backgroundTaskHost.exe 100 PID 3904 wrote to memory of 896 3904 svc_cache_904.exe 101 PID 896 wrote to memory of 5960 896 svc_cache_3904.exe 102 PID 5960 wrote to memory of 3172 5960 svc_cache_896.exe 347
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\h6cz3u.zip1⤵PID:5156
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1236
-
C:\Users\Admin\Desktop\LycronCrypter\LycronCrypter.exe"C:\Users\Admin\Desktop\LycronCrypter\LycronCrypter.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"3⤵
- Executes dropped EXE
PID:5760
-
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\ProgramData\SystemApps\TaskHost_LyPw\svc_cache_904.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\svc_cache_904.exe"4⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\ProgramData\SystemApps\TaskHost_LyPw\svc_cache_3904.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\svc_cache_3904.exe"5⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\ProgramData\SystemApps\TaskHost_LyPw\svc_cache_896.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\svc_cache_896.exe"6⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\ProgramData\SystemApps\TaskHost_LyPw\svc_cache_5960.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\svc_cache_5960.exe"7⤵PID:3172
-
-
-
-
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\LycronCrypter\README.txt1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
PID:4428
-
C:\Users\Admin\Desktop\LycronCrypter\LycronCrypter.exe"C:\Users\Admin\Desktop\LycronCrypter\LycronCrypter.exe"1⤵PID:3444
-
C:\Users\Admin\Desktop\LycronCrypter\LycronCrypter.exe"C:\Users\Admin\Desktop\LycronCrypter\LycronCrypter.exe"1⤵PID:3336
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\LycronCrypter\README.txt1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
PID:3008
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1260 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5948 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4488 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2640 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2068 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5036 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1816 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5240 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding10⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5940 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4788 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding12⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3660 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5992 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding14⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5312 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding16⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2224 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2576 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding18⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1288 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5176 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding20⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3624 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5224 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding22⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1340 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3496 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding24⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4216 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2396 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding26⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3180 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5788 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding28⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2704 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2344 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding30⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4280 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3292 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding32⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1884 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4468 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding34⤵
- Executes dropped EXE
PID:5188 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding35⤵
- Executes dropped EXE
PID:3096 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding36⤵
- Executes dropped EXE
PID:2724 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding37⤵
- Executes dropped EXE
PID:5792 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding38⤵
- Executes dropped EXE
PID:4516 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding39⤵
- Executes dropped EXE
PID:3744 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding40⤵
- Executes dropped EXE
PID:2920 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding41⤵
- Executes dropped EXE
PID:3964 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding42⤵
- Executes dropped EXE
PID:2660 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding43⤵
- Executes dropped EXE
PID:2372 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding44⤵
- Executes dropped EXE
PID:4128 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding45⤵
- Executes dropped EXE
PID:756 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding46⤵
- Executes dropped EXE
PID:3188 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding47⤵
- Executes dropped EXE
PID:4760 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding48⤵
- Executes dropped EXE
PID:5132 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding49⤵
- Executes dropped EXE
PID:1512 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding50⤵
- Executes dropped EXE
PID:5836 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding51⤵
- Executes dropped EXE
PID:3444 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding52⤵
- Executes dropped EXE
PID:2808 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding53⤵
- Executes dropped EXE
PID:2904 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding54⤵
- Executes dropped EXE
PID:2464 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding55⤵
- Executes dropped EXE
PID:5104 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding56⤵
- Executes dropped EXE
PID:3812 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding57⤵
- Executes dropped EXE
PID:4308 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding58⤵
- Executes dropped EXE
PID:424 -
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding59⤵PID:4616
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding60⤵PID:5080
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding61⤵PID:3084
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding62⤵PID:1356
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding63⤵PID:1388
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding64⤵PID:1448
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding65⤵PID:4272
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding66⤵PID:4992
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding67⤵PID:3732
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding68⤵PID:1264
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding69⤵PID:2476
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding70⤵PID:4268
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding71⤵PID:2876
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding72⤵PID:3168
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding73⤵PID:1968
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding74⤵PID:2992
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding75⤵PID:1988
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding76⤵PID:3060
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding77⤵PID:4296
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding78⤵PID:4808
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding79⤵PID:2260
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding80⤵PID:936
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding81⤵PID:2472
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding82⤵PID:5264
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding83⤵PID:5248
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding84⤵PID:4524
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding85⤵PID:1676
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding86⤵PID:4208
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding87⤵PID:4672
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding88⤵PID:4732
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding89⤵PID:5872
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding90⤵PID:980
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding91⤵PID:796
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding92⤵PID:3132
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding93⤵PID:5752
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding94⤵PID:5092
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding95⤵PID:4576
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding96⤵PID:3664
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding97⤵PID:3356
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding98⤵PID:5936
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding99⤵PID:4212
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding100⤵PID:4984
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding101⤵PID:1220
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding102⤵PID:5920
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding103⤵PID:3396
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding104⤵PID:4560
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding105⤵PID:5896
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding106⤵PID:2052
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding107⤵PID:4328
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding108⤵PID:4240
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding109⤵PID:3092
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding110⤵PID:3828
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding111⤵PID:1036
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding112⤵PID:1912
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding113⤵PID:5400
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding114⤵PID:3288
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding115⤵PID:764
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding116⤵PID:5904
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding117⤵PID:3920
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding118⤵PID:2444
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding119⤵PID:6004
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding120⤵PID:1392
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding121⤵PID:1516
-
C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe"C:\ProgramData\SystemApps\TaskHost_LyPw\backgroundTaskHost.exe" -Embedding122⤵PID:2872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-