Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain, (Wed, Jan 14th)

This diary documents a Lumma Stealer infection observed on 2026-01-14 where, after data exfiltration, the host retrieves a Pastebin-hosted PowerShell command (https://pastebin.com/raw/xRmmdinT) that executes content from fileless-market.cc via mshta. The follow-up activity creates numerous scheduled tasks that repeatedly execute the same mshta call, producing sustained HTTPS C2 traffic (dozens of TCP streams) to fileless-market.cc, and the report includes relevant IOCs and screenshots of traffic and the Task Scheduler.