1d99b417e05221313f6859a7ede3b247393d0a391e25eceb72a9381ecc134409

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_ae03b795f9b9f92e03ec7b28c87594c2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 2.6MB
Sample260705-appzaafw3x
SHA256 1d99b417e05221313f6859a7ede3b247393d0a391e25eceb72a9381ecc134409
MD5 ae03b795f9b9f92e03ec7b28c87594c2
SHA1 c2f94a31f8b4f3b179a13df7130e05ec7e0896d7
SHA512 818bb78f5447605ed48d46f843fc68ec88f5316cf52af9d636ca61faf9ebd0c87c9eb70f4ec9d2530e411497c43991c5960cb432fd8f3ce77996f41f8fb866c6
SSDEEP 49152:vbE2KbE2KbE2KbE2KbE2KbE2KbE2KbE2eKjKWQc2b1FVgbjrjxPe1pbPSQm1Flo4:/KjKWQckVgtev5mnlNLB
TLSH
T150C58D84BAE94CE2E961627D49E7D2775B3CF6E04A138F57A728B5371B13F8178C4202
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 8 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	2026-07-04_ae03b795f9b9f92e03ec7b28c87594c2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_ACABCBAAAABBBABBACCABBBCABBAACCBACCBBAACBAABBBCBCBBAACC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BCCCACACCBCBABBCCBABBCAAABACCABCACACAABBBBBCBABAACBACAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe

Executes dropped EXE 58 IoCs

pid	Process
60	svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe
2068	svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe
5116	svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe
4364	svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe
3400	svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe
4868	svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe
5080	svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe
4588	svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe
312	svchost_CBBACABBBCBBACACABBBBBCBAACBBCBCCACCACBABABBCBAACAACCCB.exe
1632	svchost_BBBBAAAAABBBBACBBCCACCCBACABCABCBBCBAACBABACAACCBBBCCCC.exe
1660	svchost_CABBBABCBACBBAABBBCBCACBBBACCCCBACBAACBCCACAAACBAABBBAB.exe
632	svchost_CABBACBBCCCBCCCBAAABCBBCACBAAABCABABACAACBBACBCBBCCACCA.exe
3056	svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe
1232	svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe
3824	svchost_BBBBACABCAAAAACCCCCABBCCCABABCBBBCCCABCCAABBACACCBBBACB.exe
2448	svchost_CBCCBBCAACCCABBCAAAACCABCAACCCBACACACBCCCCACCAABABCBBCB.exe
4192	svchost_BCABACACBACBCBBACAACAAABCBBCBBCCCABBAACBABCAABCBABBCCCC.exe
4452	svchost_ACABCBAAAABBBABBACCABBBCABBAACCBACCBBAACBAABBBCBCBBAACC.exe
988	svchost_ACABCBAAAABBBABBACCABBBCABBAACCBACCBBAACBAABBBCBCBBAACC.exe
4988	svchost_AACCBCBCAACABBAACABABBBBCCBBBBCABCBABBCBCAACBBABABACACB.exe
3104	svchost_AACCBCCBBCBCBABCAABBBCBACCCBBCACCCCCCCBCACCBBBABBCAABBB.exe
3244	svchost_AACCCCAABCBCBACBCBBBAAACBCABCBCABAABBBACACCCABBABBBBCAC.exe
1964	svchost_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBA.exe
2952	svchost_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBA.exe
2572	svchost_ABBAAACCCCCCBABBCCACBCABCBAACCBACBCBCBBBACACBCCACBBCBCC.exe
4768	svchost_BBCCCBABABABCACCBABBBACAABABCBABCBBCCCABBACBBAABAACCBBA.exe
3172	svchost_CBAACABBAAAABACCABBBABCCACBACACBBACBBBCAACBBBCBAAACAACA.exe
2128	svchost_AAACBBAABBACBBBCBAAABABACCBABBAAACBACCCCBACBBBCAABAABCB.exe
5344	svchost_ACCCBCAACABCCBACCAABCABAABBCCBBABCCABBCCBABBCBBCBABACCA.exe
5728	svchost_BBCBBCBABBCCACABBACACCACAABACBCBBBBACABBCABAAAABCBABCBA.exe
6056	svchost_BCCCACACCBCBABBCCBABBCAAABACCABCACACAABBBBBCBABAACBACAA.exe
6072	svchost_BCCCACACCBCBABBCCBABBCAAABACCABCACACAABBBBBCBABAACBACAA.exe
1500	svchost_BACCBBAAAAACCAAACBCCCCACAABCCACBBAAACCACAABAACBBABBBBBC.exe
4220	svchost_ABBCABABCACABBBBAACBCBCBBCBACCCCBBABBBBBCCAACBBBACAABBB.exe
5780	svchost_BAAABBBCBBCCACCBCBACACBAACBBACBABBACABBABBBBACBCABCBCAC.exe
5172	svchost_BACBAABBAABACBCACCCABCBAAACCBBABCCBCCCACCBCBBCCBBAABABB.exe
5660	svchost_AAACBBBBABAABBAAACABCBABBCBBACCBAACABBCCBBBBAABABABBACB.exe
1060	svchost_AAACBBBBABAABBAAACABCBABBCBBACCBAACABBCCBBBBAABABABBACB.exe
5452	svchost_CBAAABACAACCBACACAACCCCCBABCBBBCCCBACABCCBACABCBACCABCC.exe
5832	svchost_ABABBACBACABBCCACBBCAACCCBABAABBACACCBBBBACCBBBABBCBABB.exe
6100	svchost_ABABBACBACABBCCACBBCAACCCBABAABBACACCBBBBACCBBBABBCBABB.exe
5444	svchost_CBAACCBABAAAACBBACAACCCCABBBBBAAABCCCCCCBAACBBCBBCCABBB.exe
216	svchost_CAACBBCBCCBCCABCCBCBCBCACCBBCBBCBBCABBBCCBCACBBCCBACCAC.exe
5564	svchost_BCABCBABCBCACCBBABCACCCBAABACCAAAACAACBCCACBACAACBCBABB.exe
5252	svchost_BBCCAABABAABAAABCACBBACBBBBABCCBBAABBCBABCACCCAABACCCAA.exe
5552	svchost_BACABAAAAABBACABCCAACCBABAAAABBBABABAAACCCACCAACCAAAAAA.exe
3356	svchost_BACABAAAAABBACABCCAACCBABAAAABBBABABAAACCCACCAACCAAAAAA.exe
5388	svchost_BACABAAAAABBACABCCAACCBABAAAABBBABABAAACCCACCAACCAAAAAA.exe
5352	svchost_CCCCACBCABAAACCAAABBBABCCCCBACCAACACBCBCCAACBCBAAACBCAA.exe
5316	svchost_AAABBCCCCABACBCABCAAAAAABBCBCCABBCAABAAAACACCCACABCBBBB.exe
3932	svchost_CCBACABCAAAABCCACCBABACABAAAABBACBACCCCCCBABAAAAAACBCBC.exe
6020	svchost_CCBACABCAAAABCCACCBABACABAAAABBACBACCCCCCBABAAAAAACBCBC.exe
5180	svchost_ACAABAAACCABABAAABABBAACBCAABCBACBBACAACABCCCCBACCCBCCA.exe
2936	svchost_ACAABAAACCABABAAABABBAACBCAABCBACBBACAACABCCCCBACCCBCCA.exe
5640	svchost_BAAABBBAABABCCBCCABAACABBBCCCBCBBBBACCBCABAACABAABCBABB.exe
5136	svchost_ABBCBBBAACBBBCBBBCBABBAABCCBBCABBCACAAACCACBAAAABCBAAAC.exe
5020	svchost_BAABBBACCBACBCACBAABCBACBACCABCCACABBABBBACBCACCACBACAC.exe
5300	svchost_ABACBABBABBCBAABCABABCABCABBABAACBABBCABBAABBCBCBCBAABA.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe"	svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCABACACBACBCBBACAACAAABCBBCBBCCCABBAACBABCAABCBABBCCCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABACACBACBCBBACAACAAABCBBCBBCCCABBAACBABCAABCBABBCCCC.exe"	svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBA.exe"	svchost_ACABCBAAAABBBABBACCABBBCABBAACCBACCBBAACBAABBBCBCBBAACC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe"	2026-07-04_ae03b795f9b9f92e03ec7b28c87594c2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CABBBABCBACBBAABBBCBCACBBBACCCCBACBAACBCCACAAACBAABBBABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBBABCBACBBAABBBCBCACBBBACCCCBACBAACBCCACAAACBAABBBAB.exe"	svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe"	svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AAACBBBBABAABBAAACABCBABBCBBACCBAACABBCCBBBBAABABABBACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACBBBBABAABBAAACABCBABBCBBACCBAACABBCCBBBBAABABABBACB.exe"	svchost_BCCCACACCBCBABBCCBABBCAAABACCABCACACAABBBBBCBABAACBACAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CACCABBABBCBCBABBCBAABCCBABACAAAABABBCACCBAABAABBBCBBAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACABAAAAABBACABCCAACCBABAAAABBBABABAAACCCACCAACCAAAAAA.exe"	svchost_ABABBACBACABBCCACBBCAACCCBABAABBACACCBBBBACCBBBABBCBABB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BAABBBACCBACBCACBAABCBACBACCABCCACABBABBBACBCACCACBACACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABBBACCBACBCACBAABCBACBACCABCCACABBABBBACBCACCACBACAC.exe"	svchost_CCBACABCAAAABCCACCBABACABAAAABBACBACCCCCCBABAAAAAACBCBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe"	svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5580	sc.exe
4872	sc.exe
5712	sc.exe
5568	sc.exe
5124	sc.exe
6032	sc.exe
2124	sc.exe
5092	sc.exe
3448	sc.exe
4472	sc.exe
2624	sc.exe
1796	sc.exe
3884	sc.exe
5188	sc.exe
5504	sc.exe
376	sc.exe
5852	sc.exe
6092	sc.exe
2624	sc.exe
4328	sc.exe
4984	sc.exe
5404	sc.exe
6136	sc.exe
1748	sc.exe
4284	sc.exe
4672	sc.exe
5220	sc.exe
1356	sc.exe
1580	sc.exe
4888	sc.exe
1524	sc.exe
2340	sc.exe
3964	sc.exe
5260	sc.exe
5332	sc.exe
5800	sc.exe
1264	sc.exe
1968	sc.exe
604	sc.exe
1692	sc.exe
1196	sc.exe
3796	sc.exe
4596	sc.exe
6132	sc.exe
1008	sc.exe
728	sc.exe
3284	sc.exe
2416	sc.exe
5648	sc.exe
5568	sc.exe
4496	sc.exe
456	sc.exe
4996	sc.exe
4324	sc.exe
3680	sc.exe
4224	sc.exe
2984	sc.exe
5760	sc.exe
5776	sc.exe
1040	sc.exe
4152	sc.exe
1048	sc.exe
1284	sc.exe
4672	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBAAACCCCCCBABBCCACBCABCBAACCBACBCBCBBBACACBCCACBBCBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCBBCAACCCABBCAAAACCABCAACCCBACACACBCCCCACCAABABCBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBACABCAAAAACCCCCABBCCCABABCBBBCCCABCCAABBACACCBBBACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBACABCAAAABCCACCBABACABAAAABBACBACCCCCCBABAAAAAACBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACBBAABBACBBBCBAAABABACCBABBAAACBACCCCBACBBBCAABAABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAACABBAAAABACCABBBABCCACBACACBBACBBBCAACBBBCBAAACAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4760	schtasks.exe
5920	schtasks.exe
6124	schtasks.exe
2756	schtasks.exe
4012	schtasks.exe
2572	schtasks.exe
412	schtasks.exe
5876	schtasks.exe
5556	schtasks.exe
5488	schtasks.exe
4368	schtasks.exe
3524	schtasks.exe
2836	schtasks.exe
1856	schtasks.exe
1644	schtasks.exe
4796	schtasks.exe
5632	schtasks.exe
564	schtasks.exe
2180	schtasks.exe
1048	schtasks.exe
4304	schtasks.exe
5576	schtasks.exe
2308	schtasks.exe
2232	schtasks.exe
3628	schtasks.exe
4284	schtasks.exe
2624	schtasks.exe
4212	schtasks.exe
4788	schtasks.exe
5176	schtasks.exe
1228	schtasks.exe
5508	schtasks.exe
2756	schtasks.exe
5136	schtasks.exe
5440	schtasks.exe
3292	schtasks.exe
3960	schtasks.exe
1960	schtasks.exe
2080	schtasks.exe
440	schtasks.exe
1720	schtasks.exe
5440	schtasks.exe
5420	schtasks.exe
1484	schtasks.exe
4028	schtasks.exe
1564	schtasks.exe
3132	schtasks.exe
1268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3800	2026-07-04_ae03b795f9b9f92e03ec7b28c87594c2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
3800	2026-07-04_ae03b795f9b9f92e03ec7b28c87594c2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
2068	svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe
2068	svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe
60	svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe
60	svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe
3400	svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe
3400	svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe
4868	svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe
4868	svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe
3800	2026-07-04_ae03b795f9b9f92e03ec7b28c87594c2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
3800	2026-07-04_ae03b795f9b9f92e03ec7b28c87594c2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4364	svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe
4364	svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe
5116	svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe
5116	svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe
312	svchost_CBBACABBBCBBACACABBBBBCBAACBBCBCCACCACBABABBCBAACAACCCB.exe
312	svchost_CBBACABBBCBBACACABBBBBCBAACBBCBCCACCACBABABBCBAACAACCCB.exe
5080	svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe
5080	svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe
60	svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe
60	svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe
4588	svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe
4588	svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe
3400	svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe
3400	svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe
1632	svchost_BBBBAAAAABBBBACBBCCACCCBACABCABCBBCBAACBABACAACCBBBCCCC.exe
1632	svchost_BBBBAAAAABBBBACBBCCACCCBACABCABCBBCBAACBABACAACCBBBCCCC.exe
3056	svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe
3056	svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe
1660	svchost_CABBBABCBACBBAABBBCBCACBBBACCCCBACBAACBCCACAAACBAABBBAB.exe
1660	svchost_CABBBABCBACBBAABBBCBCACBBBACCCCBACBAACBCCACAAACBAABBBAB.exe
1232	svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe
1232	svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe
4364	svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe
4364	svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe
632	svchost_CABBACBBCCCBCCCBAAABCBBCACBAAABCABABACAACBBACBCBBCCACCA.exe
632	svchost_CABBACBBCCCBCCCBAAABCBBCACBAAABCABABACAACBBACBCBBCCACCA.exe
3824	svchost_BBBBACABCAAAAACCCCCABBCCCABABCBBBCCCABCCAABBACACCBBBACB.exe
3824	svchost_BBBBACABCAAAAACCCCCABBCCCABABCBBBCCCABCCAABBACACCBBBACB.exe
988	svchost_ACABCBAAAABBBABBACCABBBCABBAACCBACCBBAACBAABBBCBCBBAACC.exe
4452	svchost_ACABCBAAAABBBABBACCABBBCABBAACCBACCBBAACBAABBBCBCBBAACC.exe
988	svchost_ACABCBAAAABBBABBACCABBBCABBAACCBACCBBAACBAABBBCBCBBAACC.exe
4452	svchost_ACABCBAAAABBBABBACCABBBCABBAACCBACCBBAACBAABBBCBCBBAACC.exe
4988	svchost_AACCBCBCAACABBAACABABBBBCCBBBBCABCBABBCBCAACBBABABACACB.exe
4988	svchost_AACCBCBCAACABBAACABABBBBCCBBBBCABCBABBCBCAACBBABABACACB.exe
2952	svchost_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBA.exe
2952	svchost_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBA.exe
5080	svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe
5080	svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe
2572	svchost_ABBAAACCCCCCBABBCCACBCABCBAACCBACBCBCBBBACACBCCACBBCBCC.exe
2572	svchost_ABBAAACCCCCCBABBCCACBCABCBAACCBACBCBCBBBACACBCCACBBCBCC.exe
2448	svchost_CBCCBBCAACCCABBCAAAACCABCAACCCBACACACBCCCCACCAABABCBBCB.exe
2448	svchost_CBCCBBCAACCCABBCAAAACCABCAACCCBACACACBCCCCACCAABABCBBCB.exe
4192	svchost_BCABACACBACBCBBACAACAAABCBBCBBCCCABBAACBABCAABCBABBCCCC.exe
4192	svchost_BCABACACBACBCBBACAACAAABCBBCBBCCCABBAACBABCAABCBABBCCCC.exe
3056	svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe
3056	svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe
3172	svchost_CBAACABBAAAABACCABBBABCCACBACACBBACBBBCAACBBBCBAAACAACA.exe
3172	svchost_CBAACABBAAAABACCABBBABCCACBACACBBACBBBCAACBBBCBAAACAACA.exe
4768	svchost_BBCCCBABABABCACCBABBBACAABABCBABCBBCCCABBACBBAABAACCBBA.exe
4768	svchost_BBCCCBABABABCACCBABBBACAABABCBABCBBCCCABBACBBAABAACCBBA.exe
3104	svchost_AACCBCCBBCBCBABCAABBBCBACCCBBCACCCCCCCBCACCBBBABBCAABBB.exe
3104	svchost_AACCBCCBBCBCBABCAABBBCBACCCBBCACCCCCCCBCACCBBBABBCAABBB.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	3800	2026-07-04_ae03b795f9b9f92e03ec7b28c87594c2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2068	svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe
Token: SeDebugPrivilege	60	svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe
Token: SeDebugPrivilege	3400	svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe
Token: SeDebugPrivilege	4868	svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe
Token: SeDebugPrivilege	4364	svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe
Token: SeDebugPrivilege	5116	svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe
Token: SeDebugPrivilege	312	svchost_CBBACABBBCBBACACABBBBBCBAACBBCBCCACCACBABABBCBAACAACCCB.exe
Token: SeDebugPrivilege	5080	svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe
Token: SeDebugPrivilege	4588	svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe
Token: SeDebugPrivilege	1632	svchost_BBBBAAAAABBBBACBBCCACCCBACABCABCBBCBAACBABACAACCBBBCCCC.exe
Token: SeDebugPrivilege	3056	svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe
Token: SeDebugPrivilege	1660	svchost_CABBBABCBACBBAABBBCBCACBBBACCCCBACBAACBCCACAAACBAABBBAB.exe
Token: SeDebugPrivilege	1232	svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe
Token: SeDebugPrivilege	632	svchost_CABBACBBCCCBCCCBAAABCBBCACBAAABCABABACAACBBACBCBBCCACCA.exe
Token: SeDebugPrivilege	3824	svchost_BBBBACABCAAAAACCCCCABBCCCABABCBBBCCCABCCAABBACACCBBBACB.exe
Token: SeDebugPrivilege	988	svchost_ACABCBAAAABBBABBACCABBBCABBAACCBACCBBAACBAABBBCBCBBAACC.exe
Token: SeDebugPrivilege	4452	svchost_ACABCBAAAABBBABBACCABBBCABBAACCBACCBBAACBAABBBCBCBBAACC.exe
Token: SeDebugPrivilege	4988	svchost_AACCBCBCAACABBAACABABBBBCCBBBBCABCBABBCBCAACBBABABACACB.exe
Token: SeDebugPrivilege	2952	svchost_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBA.exe
Token: SeDebugPrivilege	2572	svchost_ABBAAACCCCCCBABBCCACBCABCBAACCBACBCBCBBBACACBCCACBBCBCC.exe
Token: SeDebugPrivilege	2448	svchost_CBCCBBCAACCCABBCAAAACCABCAACCCBACACACBCCCCACCAABABCBBCB.exe
Token: SeDebugPrivilege	4192	svchost_BCABACACBACBCBBACAACAAABCBBCBBCCCABBAACBABCAABCBABBCCCC.exe
Token: SeDebugPrivilege	3172	svchost_CBAACABBAAAABACCABBBABCCACBACACBBACBBBCAACBBBCBAAACAACA.exe
Token: SeDebugPrivilege	4768	svchost_BBCCCBABABABCACCBABBBACAABABCBABCBBCCCABBACBBAABAACCBBA.exe
Token: SeDebugPrivilege	3104	svchost_AACCBCCBBCBCBABCAABBBCBACCCBBCACCCCCCCBCACCBBBABBCAABBB.exe
Token: SeDebugPrivilege	3244	svchost_AACCCCAABCBCBACBCBBBAAACBCABCBCABAABBBACACCCABBABBBBCAC.exe
Token: SeDebugPrivilege	2128	svchost_AAACBBAABBACBBBCBAAABABACCBABBAAACBACCCCBACBBBCAABAABCB.exe
Token: SeDebugPrivilege	5728	svchost_BBCBBCBABBCCACABBACACCACAABACBCBBBBACABBCABAAAABCBABCBA.exe
Token: SeDebugPrivilege	6056	svchost_BCCCACACCBCBABBCCBABBCAAABACCABCACACAABBBBBCBABAACBACAA.exe
Token: SeDebugPrivilege	6072	svchost_BCCCACACCBCBABBCCBABBCAAABACCABCACACAABBBBBCBABAACBACAA.exe
Token: SeDebugPrivilege	1964	svchost_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBA.exe
Token: SeDebugPrivilege	1500	svchost_BACCBBAAAAACCAAACBCCCCACAABCCACBBAAACCACAABAACBBABBBBBC.exe
Token: SeDebugPrivilege	5344	svchost_ACCCBCAACABCCBACCAABCABAABBCCBBABCCABBCCBABBCBBCBABACCA.exe
Token: SeDebugPrivilege	4220	svchost_ABBCABABCACABBBBAACBCBCBBCBACCCCBBABBBBBCCAACBBBACAABBB.exe
Token: SeDebugPrivilege	5780	svchost_BAAABBBCBBCCACCBCBACACBAACBBACBABBACABBABBBBACBCABCBCAC.exe
Token: SeDebugPrivilege	5172	svchost_BACBAABBAABACBCACCCABCBAAACCBBABCCBCCCACCBCBBCCBBAABABB.exe
Token: SeDebugPrivilege	5832	svchost_ABABBACBACABBCCACBBCAACCCBABAABBACACCBBBBACCBBBABBCBABB.exe
Token: SeDebugPrivilege	6100	svchost_ABABBACBACABBCCACBBCAACCCBABAABBACACCBBBBACCBBBABBCBABB.exe
Token: SeDebugPrivilege	5564	svchost_BCABCBABCBCACCBBABCACCCBAABACCAAAACAACBCCACBACAACBCBABB.exe
Token: SeDebugPrivilege	5660	svchost_AAACBBBBABAABBAAACABCBABBCBBACCBAACABBCCBBBBAABABABBACB.exe
Token: SeDebugPrivilege	1060	svchost_AAACBBBBABAABBAAACABCBABBCBBACCBAACABBCCBBBBAABABABBACB.exe
Token: SeDebugPrivilege	5252	svchost_BBCCAABABAABAAABCACBBACBBBBABCCBBAABBCBABCACCCAABACCCAA.exe
Token: SeDebugPrivilege	5452	svchost_CBAAABACAACCBACACAACCCCCBABCBBBCCCBACABCCBACABCBACCABCC.exe
Token: SeDebugPrivilege	5316	svchost_AAABBCCCCABACBCABCAAAAAABBCBCCABBCAABAAAACACCCACABCBBBB.exe
Token: SeDebugPrivilege	5444	svchost_CBAACCBABAAAACBBACAACCCCABBBBBAAABCCCCCCBAACBBCBBCCABBB.exe
Token: SeDebugPrivilege	3932	svchost_CCBACABCAAAABCCACCBABACABAAAABBACBACCCCCCBABAAAAAACBCBC.exe
Token: SeDebugPrivilege	6020	svchost_CCBACABCAAAABCCACCBABACABAAAABBACBACCCCCCBABAAAAAACBCBC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 4756	3800	2026-07-04_ae03b795f9b9f92e03ec7b28c87594c2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	92
PID 4756 wrote to memory of 3960	4756	cmd.exe	94
PID 3800 wrote to memory of 3008	3800	2026-07-04_ae03b795f9b9f92e03ec7b28c87594c2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	95
PID 3008 wrote to memory of 1264	3008	cmd.exe	98
PID 3800 wrote to memory of 3940	3800	2026-07-04_ae03b795f9b9f92e03ec7b28c87594c2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	99
PID 3940 wrote to memory of 2452	3940	cmd.exe	103
PID 2068 wrote to memory of 928	2068	svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe	108
PID 928 wrote to memory of 1268	928	cmd.exe	110
PID 2068 wrote to memory of 1828	2068	svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe	111
PID 1828 wrote to memory of 1968	1828	cmd.exe	114
PID 2068 wrote to memory of 2460	2068	svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe	115
PID 2460 wrote to memory of 876	2460	cmd.exe	117
PID 60 wrote to memory of 4632	60	svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe	120
PID 4632 wrote to memory of 4212	4632	cmd.exe	123
PID 60 wrote to memory of 2816	60	svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe	124
PID 2816 wrote to memory of 2624	2816	cmd.exe	127
PID 60 wrote to memory of 2396	60	svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe	128
PID 2396 wrote to memory of 4152	2396	cmd.exe	131
PID 3400 wrote to memory of 4428	3400	svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe	134
PID 4428 wrote to memory of 3524	4428	cmd.exe	136
PID 3400 wrote to memory of 2120	3400	svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe	137
PID 2120 wrote to memory of 2128	2120	cmd.exe	140
PID 3400 wrote to memory of 1376	3400	svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe	141
PID 1376 wrote to memory of 2340	1376	cmd.exe	144
PID 4868 wrote to memory of 4816	4868	svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe	146
PID 4816 wrote to memory of 1960	4816	cmd.exe	148
PID 4868 wrote to memory of 4272	4868	svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe	149
PID 4272 wrote to memory of 3248	4272	cmd.exe	151
PID 4868 wrote to memory of 2960	4868	svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe	152
PID 2960 wrote to memory of 4996	2960	cmd.exe	154
PID 4364 wrote to memory of 4292	4364	svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe	156
PID 5116 wrote to memory of 5044	5116	svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe	158
PID 4292 wrote to memory of 4788	4292	cmd.exe	160
PID 5044 wrote to memory of 2080	5044	cmd.exe	161
PID 4364 wrote to memory of 4100	4364	svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe	162
PID 5116 wrote to memory of 2284	5116	svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe	164
PID 2284 wrote to memory of 2576	2284	cmd.exe	166
PID 4100 wrote to memory of 4000	4100	cmd.exe	167
PID 5116 wrote to memory of 3440	5116	svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe	168
PID 4364 wrote to memory of 3856	4364	svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe	170
PID 3440 wrote to memory of 1524	3440	cmd.exe	172
PID 3856 wrote to memory of 4872	3856	cmd.exe	175
PID 312 wrote to memory of 3896	312	svchost_CBBACABBBCBBACACABBBBBCBAACBBCBCCACCACBABABBCBAACAACCCB.exe	177
PID 3896 wrote to memory of 440	3896	cmd.exe	179
PID 312 wrote to memory of 2428	312	svchost_CBBACABBBCBBACACABBBBBCBAACBBCBCCACCACBABABBCBAACAACCCB.exe	180
PID 2428 wrote to memory of 2124	2428	cmd.exe	182
PID 312 wrote to memory of 4208	312	svchost_CBBACABBBCBBACACABBBBBCBAACBBCBCCACCACBABABBCBAACAACCCB.exe	183
PID 4208 wrote to memory of 2624	4208	cmd.exe	185
PID 5080 wrote to memory of 2076	5080	svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe	188
PID 2076 wrote to memory of 2180	2076	cmd.exe	191
PID 5080 wrote to memory of 4000	5080	svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe	192
PID 4000 wrote to memory of 3248	4000	cmd.exe	195
PID 5080 wrote to memory of 1740	5080	svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe	196
PID 1740 wrote to memory of 640	1740	cmd.exe	198
PID 4588 wrote to memory of 2052	4588	svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe	200
PID 2052 wrote to memory of 4760	2052	cmd.exe	202
PID 4588 wrote to memory of 1932	4588	svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe	203
PID 1932 wrote to memory of 4324	1932	cmd.exe	205
PID 4588 wrote to memory of 3320	4588	svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe	206
PID 3320 wrote to memory of 4284	3320	cmd.exe	208
PID 1632 wrote to memory of 1756	1632	svchost_BBBBAAAAABBBBACBBCCACCCBACABCABCBBCBAACBABACAACCBBBCCCC.exe	210
PID 3056 wrote to memory of 4864	3056	svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe	212
PID 1756 wrote to memory of 1720	1756	cmd.exe	214
PID 4864 wrote to memory of 3292	4864	cmd.exe	215

C:\Users\Admin\AppData\Local\Temp\2026-07-04_ae03b795f9b9f92e03ec7b28c87594c2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_ae03b795f9b9f92e03ec7b28c87594c2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAACAACBBACBBBAABABCBAACABCCACCACABAACBCCBBBBCBAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAACAACBBACBBBAABABCBAACABCCACCACABAACBCCBBBBCBAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCBBBCABAACAABCAABABAAABBBAACCBBACCACAABCCABACBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe" start= auto displayName= "UserDataSvc_CCCBBBCABAACAABCAABABAAABBBAACCBBACCACAABCCABACBAAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCBBBCABAACAABCAABABAAABBBAACCBBACCACAABCCABACBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe" start= auto displayName= "UserDataSvc_CCCBBBCABAACAABCAABABAAABBBAACCBBACCACAABCCABACBAAB"
    3⤵
    - Launches sc.exe
    PID:1264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCBBBCABAACAABCAABABAAABBBAACCBBACCACAABCCABACBAAB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCBBBCABAACAABCAABABAAABBBAACCBBACCACAABCCABACBAAB"
    3⤵
    PID:2452

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:60
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCBACBCBBABABBABCAAABACCCABCCBCBBCBAAACCBAABBACBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCBACBCBBABABBABCAAABACCCABCCBCBBCBAAACCBAABBACBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBCAAACBBACCBCACABBBBCABCCABCCABACACABCAAABCCCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe" start= auto displayName= "UserDataSvc_ABCBCAAACBBACCBCACABBBBCABCCABCCABACACABCAAABCCCBCC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBCAAACBBACCBCACABBBBCABCCABCCABACACABCAAABCCCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe" start= auto displayName= "UserDataSvc_ABCBCAAACBBACCBCACABBBBCABCCABCCABACACABCAAABCCCBCC"
    3⤵
    - Launches sc.exe
    PID:2624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBCAAACBBACCBCACABBBBCABCCABCCABACACABCAAABCCCBCC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBCAAACBBACCBCACABBBBCABCCABCCABACACABCAAABCCCBCC"
    3⤵
    - Launches sc.exe
    PID:4152

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBCCCACBBCACCBACBACCCAABBBCCACCBCBCAACCAABBCCBAAAABBBCACACBBBACCBCBCAABBABBCBCCCCBAABCAAABBBCCBAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBCCCACBBCACCBACBACCCAABBBCCACCBCBCAACCAABBCCBAAAABBBCACACBBBACCBCBCAABBABBCBCCCCBAABCAAABBBCCBAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABAAACCACBCCCACBCCBBBBCCCCABAAACBACBBABCAACBBAAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe" start= auto displayName= "UserDataSvc_BABAAACCACBCCCACBCCBBBBCCCCABAAACBACBBABCAACBBAAACA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABAAACCACBCCCACBCCBBBBCCCCABAAACBACBBABCAACBBAAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe" start= auto displayName= "UserDataSvc_BABAAACCACBCCCACBCCBBBBCCCCABAAACBACBBABCAACBBAAACA"
    3⤵
    - Launches sc.exe
    PID:1968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABAAACCACBCCCACBCCBBBBCCCCABAAACBACBBABCAACBBAAACA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABAAACCACBCCCACBCCBBBBCCCCABAAACBACBBABCAACBBAAACA"
    3⤵
    PID:876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBABBCAACCBCCCACABABAAAABBBACBCABCBCBCAABBABBCBBBBCCACABBABABCABABBCCBCABAAAACBBBCACAAABABBBABABACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBAAAAABBBBACBBCCACCCBACABCABCBBCBAACBABACAACCBBBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBABBCAACCBCCCACABABAAAABBBACBCABCBCBCAABBABBCBBBBCCACABBABABCABABBCCBCABAAAACBBBCACAAABABBBABABACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBAAAAABBBBACBBCCACCCBACABCABCBBCBAACBABACAACCBBBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABACAABBCBBCCAAAACCBABCBABCBCAACCAAACCBBBCAAABBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBAAAAABBBBACBBCCACCCBACABCABCBBCBAACBABACAACCBBBCCCC.exe" start= auto displayName= "UserDataSvc_CAABACAABBCBBCCAAAACCBABCBABCBCAACCAAACCBBBCAAABBBA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABACAABBCBBCCAAAACCBABCBABCBCAACCAAACCBBBCAAABBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBAAAAABBBBACBBCCACCCBACABCABCBBCBAACBABACAACCBBBCCCC.exe" start= auto displayName= "UserDataSvc_CAABACAABBCBBCCAAAACCBABCBABCBCAACCAAACCBBBCAAABBBA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABACAABBCBBCCAAAACCBABCBABCBCAACCAAACCBBBCAAABBBA"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABACAABBCBBCCAAAACCBABCBABCBCAACCAAACCBBBCAAABBBA"
    3⤵
    - Launches sc.exe
    PID:1524

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABAACCAABACCBBBBABAABABBBACBCABBABCCBBABABACCABBAAAA.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBBABCBACBBAABBBCBCACBBBACCCCBACBAACBCCACAAACBAABBBABBCCBCBBCCACAABBCACCACABABBAAABBBABBACACCBCCBABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCBACBBAABBBCBCACBBBACCCCBACBAACBCCACAAACBAABBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBBABCBACBBAABBBCBCACBBBACCCCBACBAACBCCACAAACBAABBBABBCCBCBBCCACAABBCACCACABABBAAABBBABBACACCBCCBABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCBACBBAABBBCBCACBBBACCCCBACBAACBCCACAAACBAABBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABACBAAABCCCBABACBACABCCCBAACCAABAABACCCCBAACABABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCBACBBAABBBCBCACBBBACCCCBACBAACBCCACAAACBAABBBAB.exe" start= auto displayName= "UserDataSvc_CABACBAAABCCCBABACBACABCCCBAACCAABAABACCCCBAACABABC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABACBAAABCCCBABACBACABCCCBAACCAABAABACCCCBAACABABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCBACBBAABBBCBCACBBBACCCCBACBAACBCCACAAACBAABBBAB.exe" start= auto displayName= "UserDataSvc_CABACBAAABCCCBABACBACABCCCBAACCAABAABACCCCBAACABABC"
    3⤵
    PID:4000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABACBAAABCCCBABACBACABCCCBAACCAABAABACCCCBAACABABC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABACBAAABCCCBABACBACABCCCBAACCAABAABACCCCBAACABABC"
    3⤵
    - Launches sc.exe
    PID:4872

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACACCCBACAAAAABAACABCBCBACAAAAAAACABCCABBABABCCBABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACACCCBACAAAAABAACABCBCBACAAAAAAACABCCABBABABCCBABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABABABBABACAAABACCBCBBCCAABAABCBBAACCCBACCCCBBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe" start= auto displayName= "UserDataSvc_ACABABABBABACAAABACCBCBBCCAABAABCBBAACCCBACCCCBBBBA"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABABABBABACAAABACCBCBBCCAABAABCBBAACCCBACCCCBBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe" start= auto displayName= "UserDataSvc_ACABABABBABACAAABACCBCBBCCAABAABCBBAACCCBACCCCBBBBA"
    3⤵
    PID:2128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABABABBABACAAABACCBCBBCCAABAABCBBAACCCBACCCCBBBBA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABABABBABACAAABACCBCBBCCAABAABCBBAACCCBACCCCBBBBA"
    3⤵
    PID:2340

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBBABBBBACBBACBBABBBCCBCBABACBBCCCACABBBCABAABBCCB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACABBBCBBACACABBBBBCBAACBBCBCCACCACBABABBCBAACAACCCBCCABCCBCAACCACBAACABABACCCAACAAAABBBAAACBBBBBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACABBBCBBACACABBBBBCBAACBBCBCCACCACBABABBCBAACAACCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACABBBCBBACACABBBBBCBAACBBCBCCACCACBABABBCBAACAACCCBCCABCCBCAACCACBAACABABACCCAACAAAABBBAAACBBBBBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACABBBCBBACACABBBBBCBAACBBCBCCACCACBABABBCBAACAACCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBACCAABBCBCABCABBAABCAACBAACABCCACCABABAABACAACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACABBBCBBACACABBBBBCBAACBBCBCCACCACBABABBCBAACAACCCB.exe" start= auto displayName= "UserDataSvc_CBBACCAABBCBCABCABBAABCAACBAACABCCACCABABAABACAACBC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBACCAABBCBCABCABBAABCAACBAACABCCACCABABAABACAACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACABBBCBBACACABBBBBCBAACBBCBCCACCACBABABBCBAACAACCCB.exe" start= auto displayName= "UserDataSvc_CBBACCAABBCBCABCABBAABCAACBAACABCCACCABABAABACAACBC"
    3⤵
    PID:3248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBACCAABBCBCABCABBAABCAACBAACABCCACCABABAABACAACBC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBACCAABBCBCABCABBAABCAACBAACABCCACCABABAABACAACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAABCABBCACBCBCCBABBACCABBBABCCBABAAACAAACBCCBCAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAABCABBCACBCBCCBABBACCABBBABCCBABAAACAAACBCCBCAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABBBBCABACBBBAABBBBCAABBCAAACBACABBAACCACAABCABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe" start= auto displayName= "UserDataSvc_BBABBBBCABACBBBAABBBBCAABBCAAACBACABBAACCACAABCABCC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBABBBBCABACBBBAABBBBCAABBCAAACBACABBAACCACAABCABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe" start= auto displayName= "UserDataSvc_BBABBBBCABACBBBAABBBBCAABBCAAACBACABBAACCACAABCABCC"
    3⤵
    PID:3248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABBBBCABACBBBAABBBBCAABBCAAACBACABBAACCACAABCABCC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBABBBBCABACBBBAABBBBCAABBCAAACBACABBAACCACAABCABCC"
    3⤵
    PID:640

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBAAAACCBAAACCACBACAAAACBCABAABABBCACBAAABBCCAAACAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBACABCAAAAACCCCCABBCCCABABCBBBCCCABCCAABBACACCBBBACBBBCACBABAABBBBACACBABCBBBCBBABCAABAABAACACCABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBACABCAAAAACCCCCABBCCCABABCBBBCCCABCCAABBACACCBBBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBACABCAAAAACCCCCABBCCCABABCBBBCCCABCCAABBACACCBBBACBBBCACBABAABBBBACACBABCBBBCBBABCAABAABAACACCABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBACABCAAAAACCCCCABBCCCABABCBBBCCCABCCAABBACACCBBBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBACCAAAABBAABBBBBBCBBCACCBABBBCBCCCABBBCBBBBACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBACABCAAAAACCCCCABBCCCABABCBBBCCCABCCAABBACACCBBBACB.exe" start= auto displayName= "UserDataSvc_BACBACCAAAABBAABBBBBBCBBCACCBABBBCBCCCABBBCBBBBACCC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBACCAAAABBAABBBBBBCBBCACCBABBBCBCCCABBBCBBBBACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBACABCAAAAACCCCCABBCCCABABCBBBCCCABCCAABBACACCBBBACB.exe" start= auto displayName= "UserDataSvc_BACBACCAAAABBAABBBBBBCBBCACCBABBBCBCCCABBBCBBBBACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBACCAAAABBAABBBBBBCBBCACCBABBBCBCCCABBBCBBBBACCC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBACCAAAABBAABBBBBBCBBCACCBABBBCBCCCABBBCBBBBACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4284

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACABBBCBBACACABBBBBCBAACBBCBCCACCACBABABBCBAACAACCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACABBBCBBACACABBBBBCBAACBBCBCCACCACBABABBCBAACAACCCB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBACBBCCCBCCCBAAABCBBCACBAAABCABABACAACBBACBCBBCCACCAACBAABCBBCBAAACAABCAAACCBCABAACBCACCBAAACAAACBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACBBCCCBCCCBAAABCBBCACBAAABCABABACAACBBACBCBBCCACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBACBBCCCBCCCBAAABCBBCACBAAABCABABACAACBBACBCBBCCACCAACBAABCBBCBAAACAABCAAACCBCABAACBCACCBAAACAAACBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACBBCCCBCCCBAAABCBBCACBAAABCABABACAACBBACBCBBCCACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCACBBCCCBBCBBACCBCACCBACCCCBBCAACBCBBBCABBABCBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACBBCCCBCCCBAAABCBBCACBAAABCABABACAACBBACBCBBCCACCA.exe" start= auto displayName= "UserDataSvc_BCCACBBCCCBBCBBACCBCACCBACCCCBBCAACBCBBBCABBABCBBBA"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCACBBCCCBBCBBACCBCACCBACCCCBBCAACBCBBBCABBABCBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACBBCCCBCCCBAAABCBBCACBAAABCABABACAACBBACBCBBCCACCA.exe" start= auto displayName= "UserDataSvc_BCCACBBCCCBBCBBACCBCACCBACCCCBBCAACBCBBBCABBABCBBBA"
    3⤵
    - Launches sc.exe
    PID:2124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCACBBCCCBBCBBACCBCACCBACCCCBBCAACBCBBBCABBABCBBBA"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCACBBCCCBBCBBACCBCACCBACCCCBBCAACBCBBBCABBABCBBBA"
    3⤵
    - Launches sc.exe
    PID:2624

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBAAAAABBBBACBBCCACCCBACABCABCBBCBAACBABACAACCBBBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBAAAAABBBBACBBCCACCCBACABCABCBBCBAACBABACAACCBBBCCCC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCBBCAACCCABBCAAAACCABCAACCCBACACACBCCCCACCAABABCBBCBACAABACABBAACCCACABBCCACABCBACCCBBABABAABBACBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBBCAACCCABBCAAAACCABCAACCCBACACACBCCCCACCAABABCBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCBBCAACCCABBCAAAACCABCAACCCBACACACBCCCCACCAABABCBBCBACAABACABBAACCCACABBCCACABCBACCCBBABABAABBACBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBBCAACCCABBCAAAACCABCAACCCBACACACBCCCCACCAABABCBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABABABACBBBBBCBABBCACBCAAAAAACCCBCACAAABCACCACCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBBCAACCCABBCAAAACCABCAACCCBACACACBCCCCACCAABABCBBCB.exe" start= auto displayName= "UserDataSvc_AABABABACBBBBBCBABBCACBCAAAAAACCCBCACAAABCACCACCBBC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4376
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABABABACBBBBBCBABBCACBCAAAAAACCCBCACAAABCACCACCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBBCAACCCABBCAAAACCABCAACCCBACACACBCCCCACCAABABCBBCB.exe" start= auto displayName= "UserDataSvc_AABABABACBBBBBCBABBCACBCAAAAAACCCBCACAAABCACCACCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABABABACBBBBBCBABBCACBCAAAAAACCCBCACAAABCACCACCBBC"
  2⤵
  PID:3344
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABABABACBBBBBCBABBCACBCAAAAAACCCBCACAAABCACCACCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCBACBBAABBBCBCACBBBACCCCBACBAACBCCACAAACBAABBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCBACBBAABBBCBCACBBBACCCCBACBAACBCCACAAACBAABBBAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABCBAAAABBBABBACCABBBCABBAACCBACCBBAACBAABBBCBCBBAACCBCCACBBABCBABCCABABBCBCAACCCACAACCBBCAAACAACBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBAAAABBBABBACCABBBCABBAACCBACCBBAACBAABBBCBCBBAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABCBAAAABBBABBACCABBBCABBAACCBACCBBAACBAABBBCBCBBAACCBCCACBBABCBABCCABABBCBCAACCCACAACCBBCAAACAACBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBAAAABBBABBACCABBBCABBAACCBACCBBAACBAABBBCBCBBAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABCAABAAABBBAABABCBACBBBBBBCABABBABBAACACAABBBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBAAAABBBABBACCABBBCABBAACCBACCBBAACBAABBBCBCBBAACC.exe" start= auto displayName= "UserDataSvc_BCABCAABAAABBBAABABCBACBBBBBBCABABBABBAACACAABBBBAC"
  2⤵
  PID:4904
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABCAABAAABBBAABABCBACBBBBBBCABABBABBAACACAABBBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBAAAABBBABBACCABBBCABBAACCBACCBBAACBAABBBCBCBBAACC.exe" start= auto displayName= "UserDataSvc_BCABCAABAAABBBAABABCBACBBBBBBCABABBABBAACACAABBBBAC"
    3⤵
    - Launches sc.exe
    PID:2340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABCAABAAABBBAABABCBACBBBBBBCABABBABBAACACAABBBBAC"
  2⤵
  PID:3788
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABCAABAAABBBAABABCBACBBBBBBCABABBABBAACACAABBBBAC"
    3⤵
    - Launches sc.exe
    PID:5092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACBBCCCBCCCBAAABCBBCACBAAABCABABACAACBBACBCBBCCACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACBBCCCBCCCBAAABCBBCACBAAABCABABACAACBBACBCBBCCACCA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBCCBBCBCBABCAABBBCBACCCBBCACCCCCCCBCACCBBBABBCAABBBCAACABABCABCBCCCCCBCACBCABCBBBBBACBBBCAAABACBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCCBBCBCBABCAABBBCBACCCBBCACCCCCCCBCACCBBBABBCAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBCCBBCBCBABCAABBBCBACCCBBCACCCCCCCBCACCBBBABBCAABBBCAACABABCABCBCCCCCBCACBCABCBBBBBACBBBCAAABACBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCCBBCBCBABCAABBBCBACCCBBCACCCCCCCBCACCBBBABBCAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABACAACCCCCCCCBABCCCACBABBBBBCABBACAACCBAABBBABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCCBBCBCBABCAABBBCBACCCBBCACCCCCCCBCACCBBBABBCAABBB.exe" start= auto displayName= "UserDataSvc_CBABACAACCCCCCCCBABCCCACBABBBBBCABBACAACCBAABBBABBB"
  2⤵
  PID:1168
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABACAACCCCCCCCBABCCCACBABBBBBCABBACAACCBAABBBABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCCBBCBCBABCAABBBCBACCCBBCACCCCCCCBCACCBBBABBCAABBB.exe" start= auto displayName= "UserDataSvc_CBABACAACCCCCCCCBABCCCACBABBBBBCABBACAACCBAABBBABBB"
    3⤵
    - Launches sc.exe
    PID:1692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABACAACCCCCCCCBABCCCACBABBBBBCABBACAACCBAABBBABBB"
  2⤵
  PID:3032
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABACAACCCCCCCCBABCCCACBABBBBBCABBACAACCBAABBBABBB"
    3⤵
    - Launches sc.exe
    PID:3448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABACACBACBCBBACAACAAABCBBCBBCCCABBAACBABCAABCBABBCCCCBCAABBACBACABAAACCBCCCBABBCABBBACAABACCBBBCBBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACACBACBCBBACAACAAABCBBCBBCCCABBAACBABCAABCBABBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABACACBACBCBBACAACAAABCBBCBBCCCABBAACBABCAABCBABBCCCCBCAABBACBACABAAACCBCCCBABBCABBBACAABACCBBBCBBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACACBACBCBBACAACAAABCBBCBBCCCABBAACBABCAABCBABBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCBACBCCCCAABCBBBBBBAAAABBCCCBBBCABCCABBBCBCBCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACACBACBCBBACAACAAABCBBCBBCCCABBAACBABCAABCBABBCCCC.exe" start= auto displayName= "UserDataSvc_CBCCBACBCCCCAABCBBBBBBAAAABBCCCBBBCABCCABBBCBCBCBCB"
  2⤵
  PID:816
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCBACBCCCCAABCBBBBBBAAAABBCCCBBBCABCCABBBCBCBCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACACBACBCBBACAACAAABCBBCBBCCCABBAACBABCAABCBABBCCCC.exe" start= auto displayName= "UserDataSvc_CBCCBACBCCCCAABCBBBBBBAAAABBCCCBBBCABCCABBBCBCBCBCB"
    3⤵
    - Launches sc.exe
    PID:4328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCBACBCCCCAABCBBBBBBAAAABBCCCBBBCABCCABBBCBCBCBCB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2636
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCCBACBCCCCAABCBBBBBBAAAABBCCCBBBCABCCABBBCBCBCBCB"
    3⤵
    - Launches sc.exe
    PID:3680

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABABACCAACCACBABCBAABBABABBBBBCCACABAAABBBCCABCACBAA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBCBCAACABBAACABABBBBCCBBBBCABCBABBCBCAACBBABABACACBACAABCACBCABAABBACABBBBACACCABBBBACBCBABACBACAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCBCAACABBAACABABBBBCCBBBBCABCBABBCBCAACBBABABACACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBCBCAACABBAACABABBBBCCBBBBCABCBABBCBCAACBBABABACACBACAABCACBCABAABBACABBBBACACCABBBBACBCBABACBACAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCBCAACABBAACABABBBBCCBBBBCABCBABBCBCAACBBABABACACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAAAAABBACACBABACABAACABBCCBAABCAABACBBCABCAACABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCBCAACABBAACABABBBBCCBBBBCABCBABBCBCAACBBABABACACB.exe" start= auto displayName= "UserDataSvc_BCAAAAABBACACBABACABAACABBCCBAABCAABACBBCABCAACABBA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4996
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCAAAAABBACACBABACABAACABBCCBAABCAABACBBCABCAACABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCBCAACABBAACABABBBBCCBBBBCABCBABBCBCAACBBABABACACB.exe" start= auto displayName= "UserDataSvc_BCAAAAABBACACBABACABAACABBCCBAABCAABACBBCABCAACABBA"
    3⤵
    - Launches sc.exe
    PID:1008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAAAAABBACACBABACABAACABBCCBAABCAABACBBCABCAACABBA"
  2⤵
  PID:2072
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCAAAAABBACACBABACABAACABBCCBAABCAABACBBCABCAACABBA"
    3⤵
    - Launches sc.exe
    PID:1356

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBACABCAAAAACCCCCABBCCCABABCBBBCCCABCCAABBACACCBBBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBACABCAAAAACCCCCABBCCCABABCBBBCCCABCCAABBACACCBBBACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCCAABCBCBACBCBBBAAACBCABCBCABAABBBACACCCABBABBBBCACAACCAAAABACBCAAAABCBABABCAAABBCAAAAAACBAABBBBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCAABCBCBACBCBBBAAACBCABCBCABAABBBACACCCABBABBBBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCCAABCBCBACBCBBBAAACBCABCBCABAABBBACACCCABBABBBBCACAACCAAAABACBCAAAABCBABABCAAABBCAAAAAACBAABBBBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCAABCBCBACBCBBBAAACBCABCBCABAABBBACACCCABBABBBBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCACAAACABBAABACBBCBABBAABCCBCCCBCCABCBCBBCCBBBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCAABCBCBACBCBBBAAACBCABCBCABAABBBACACCCABBABBBBCAC.exe" start= auto displayName= "UserDataSvc_BCCACAAACABBAABACBBCBABBAABCCBCCCBCCABCBCBBCCBBBBBB"
  2⤵
  PID:3424
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCACAAACABBAABACBBCBABBAABCCBCCCBCCABCBCBBCCBBBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCAABCBCBACBCBBBAAACBCABCBCABAABBBACACCCABBABBBBCAC.exe" start= auto displayName= "UserDataSvc_BCCACAAACABBAABACBBCBABBAABCCBCCCBCCABCBCBBCCBBBBBB"
    3⤵
    - Launches sc.exe
    PID:1196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCACAAACABBAABACBBCBABBAABCCBCCCBCCABCBCBBCCBBBBBB"
  2⤵
  PID:4688
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCACAAACABBAABACBBCBABBAABCCBCCCBCCABCBCBBCCBBBBBB"
    3⤵
    PID:4448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBBCAACCCABBCAAAACCABCAACCCBACACACBCCCCACCAABABCBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBBCAACCCABBCAAAACCABCAACCCBACACACBCCCCACCAABABCBBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABCAAAAACBABCCBCCACABCBABBBCBCCCACBCABACAABBABABBBCCCBACCBAABCBCABCBCAAACBCBACABCCAABACAABCBACBACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBAABBACBBBCBAAABABACCBABBAAACBACCCCBACBBBCAABAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABCAAAAACBABCCBCCACABCBABBBCBCCCACBCABACAABBABABBBCCCBACCBAABCBCABCBCAAACBCBACABCCAABACAABCBACBACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBAABBACBBBCBAAABABACCBABBAAACBACCCCBACBBBCAABAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABCBBCBBACACCCAAABAABBCBBCACCCBCCBCABACCCBABBBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBAABBACBBBCBAAABABACCBABBAAACBACCCCBACBBBCAABAABCB.exe" start= auto displayName= "UserDataSvc_BCABCBBCBBACACCCAAABAABBCBBCACCCBCCBCABACCCBABBBBCB"
  2⤵
  PID:3792
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABCBBCBBACACCCAAABAABBCBBCACCCBCCBCABACCCBABBBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBAABBACBBBCBAAABABACCBABBAAACBACCCCBACBBBCAABAABCB.exe" start= auto displayName= "UserDataSvc_BCABCBBCBBACACCCAAABAABBCBBCACCCBCCBCABACCCBABBBBCB"
    3⤵
    - Launches sc.exe
    PID:3284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABCBBCBBACACCCAAABAABBCBBCACCCBCCBCABACCCBABBBBCB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:640
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABCBBCBBACACCCAAABAABBCBBCACCCBCCBCABACCCBABBBBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACACBACBCBBACAACAAABCBBCBBCCCABBAACBABCAABCBABBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACACBACBCBBACAACAAABCBBCBBCCCABBAACBABCAABCBABBCCCC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCBCAACABCCBACCAABCABAABBCCBBABCCABBCCBABBCBBCBABACCABACCCCACBABACABBBCCBACBCCACCBAABBABACCABABCBCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCAACABCCBACCAABCABAABBCCBBABCCABBCCBABBCBBCBABACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCBCAACABCCBACCAABCABAABBCCBBABCCABBCCBABBCBBCBABACCABACCCCACBABACABBBCCBACBCCACCBAABBABACCABABCBCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCAACABCCBACCAABCABAABBCCBBABCCABBCCBABBCBBCBABACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACCBCBCCACCCBBABACAAACBABBABAACCCBBBCBCAACAABBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCAACABCCBACCAABCABAABBCCBBABCCABBCCBABBCBBCBABACCA.exe" start= auto displayName= "UserDataSvc_ABACCBCBCCACCCBBABACAAACBABBABAACCCBBBCBCAACAABBBAB"
  2⤵
  PID:5212
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACCBCBCCACCCBBABACAAACBABBABAACCCBBBCBCAACAABBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCAACABCCBACCAABCABAABBCCBBABCCABBCCBABBCBBCBABACCA.exe" start= auto displayName= "UserDataSvc_ABACCBCBCCACCCBBABACAAACBABBABAACCCBBBCBCAACAABBBAB"
    3⤵
    - Launches sc.exe
    PID:5260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACCBCBCCACCCBBABACAAACBABBABAACCCBBBCBCAACAABBBAB"
  2⤵
  PID:5280
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACCBCBCCACCCBBABACAAACBABBABAACCCBBBCBCAACAABBBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5332

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBAAAABBBABBACCABBBCABBAACCBACCBBAACBAABBBCBCBBAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBAAAABBBABBACCABBBCABBAACCBACCBBAACBAABBBCBCBBAACC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBACBACABCCBBAACBCCBABAAABBCAABCBBCAAAABBBAAACBBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBACBACABCCBBAACBCCBABAAABBCAABCBBCAAAABBBAAACBBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCABCCCBABABAACCABCCBBCCCCCACBBCAAABCACCCCBACABABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBA.exe" start= auto displayName= "UserDataSvc_ACCABCCCBABABAACCABCCBBCCCCCACBBCAAABCACCCCBACABABC"
  2⤵
  PID:4764
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCABCCCBABABAACCABCCBBCCCCCACBBCAAABCACCCCBACABABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBA.exe" start= auto displayName= "UserDataSvc_ACCABCCCBABABAACCABCCBBCCCCCACBBCAAABCACCCCBACABABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCABCCCBABABAACCABCCBBCCCCCACBBCAAABCACCCCBACABABC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1744
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCABCCCBABABAACCABCCBBCCCCCACBBCAAABCACCCCBACABABC"
    3⤵
    PID:2720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBAAAABBBABBACCABBBCABBAACCBACCBBAACBAABBBCBCBBAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBAAAABBBABBACCABBBCABBAACCBACCBBAACBAABBBCBCBBAACC.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBACBACABCCBBAACBCCBABAAABBCAABCBBCAAAABBBAAACBBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBACBACABCCBBAACBCCBABAAABBCAABCBBCAAAABBBAAACBBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABACACCCCABBAACAABBBCCBABCABBABACCAAAABCABABCCCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBA.exe" start= auto displayName= "UserDataSvc_AABACACCCCABBAACAABBBCCBABCABBABACCAAAABCABABCCCBBC"
  2⤵
  PID:2504
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABACACCCCABBAACAABBBCCBABCABBABACCAAAABCABABCCCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBA.exe" start= auto displayName= "UserDataSvc_AABACACCCCABBAACAABBBCCBABCABBABACCAAAABCABABCCCBBC"
    3⤵
    PID:1308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABACACCCCABBAACAABBBCCBABCABBABACCAAAABCABABCCCBBC"
  2⤵
  PID:3028
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABACACCCCABBAACAABBBCCBABCABBABACCAAAABCABABCCCBBC"
    3⤵
    - Launches sc.exe
    PID:1048

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCBCAACABBAACABABBBBCCBBBBCABCBABBCBCAACBBABABACACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCBCAACABBAACABABBBBCCBBBBCABCBABBCBCAACBBABABACACB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBAAACCCCCCBABBCCACBCABCBAACCBACBCBCBBBACACBCCACBBCBCCBCABCBBCBABCBABACBACCABCBCBBACCCBBCBACCAACCABABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAAACCCCCCBABBCCACBCABCBAACCBACBCBCBBBACACBCCACBBCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBAAACCCCCCBABBCCACBCABCBAACCBACBCBCBBBACACBCCACBBCBCCBCABCBBCBABCBABACBACCABCBCBBACCCBBCBACCAACCABABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAAACCCCCCBABBCCACBCABCBAACCBACBCBCBBBACACBCCACBBCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCBABCCAACBACCCCCAACCCBCACBABBCCBCBCABAACBBBCACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAAACCCCCCBABBCCACBCABCBAACCBACBCBCBBBACACBCCACBBCBCC.exe" start= auto displayName= "UserDataSvc_CACCBABCCAACBACCCCCAACCCBCACBABBCCBCBCABAACBBBCACCB"
  2⤵
  PID:4468
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCBABCCAACBACCCCCAACCCBCACBABBCCBCBCABAACBBBCACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAAACCCCCCBABBCCACBCABCBAACCBACBCBCBBBACACBCCACBBCBCC.exe" start= auto displayName= "UserDataSvc_CACCBABCCAACBACCCCCAACCCBCACBABBCCBCBCABAACBBBCACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCBABCCAACBACCCCCAACCCBCACBABBCCBCBCABAACBBBCACCB"
  2⤵
  PID:4072
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACCBABCCAACBACCCCCAACCCBCACBABBCCBCBCABAACBBBCACCB"
    3⤵
    - Launches sc.exe
    PID:3796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCCBBCBCBABCAABBBCBACCCBBCACCCCCCCBCACCBBBABBCAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCCBBCBCBABCAABBBCBACCCBBCACCCCCCCBCACCBBBABBCAABBB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABBCCBCAABACBACAACBCBCCBBCBACABBCABAACCABCCACACBBBACBAAACACACCCCAACCABCBCACBCCBABCBCCCAAABACAACCACBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBAAAAACCAAACBCCCCACAABCCACBBAAACCACAABAACBBABBBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABBCCBCAABACBACAACBCBCCBBCBACABBCABAACCABCCACACBBBACBAAACACACCCCAACCABCBCACBCCBABCBCCCAAABACAACCACBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBAAAAACCAAACBCCCCACAABCCACBBAAACCACAABAACBBABBBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAACABBBABBACABABCCACAAAACCCBABCCBCBCBBBABAAACCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBAAAAACCAAACBCCCCACAABCCACBBAAACCACAABAACBBABBBBBC.exe" start= auto displayName= "UserDataSvc_AAAACABBBABBACABABCCACAAAACCCBABCCBCBCBBBABAAACCCBC"
  2⤵
  PID:5148
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAACABBBABBACABABCCACAAAACCCBABCCBCBCBBBABAAACCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBAAAAACCAAACBCCCCACAABCCACBBAAACCACAABAACBBABBBBBC.exe" start= auto displayName= "UserDataSvc_AAAACABBBABBACABABCCACAAAACCCBABCCBCBCBBBABAAACCCBC"
    3⤵
    PID:5248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAACABBBABBACABABCCACAAAACCCBABCCBCBCBBBABAAACCCBC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5296
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAAACABBBABBACABABCCACAAAACCCBABCCBCBCBBBABAAACCCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4596

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCAABCBCBACBCBBBAAACBCABCBCABAABBBACACCCABBABBBBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCAABCBCBACBCBBBAAACBCABCBCABAABBBACACCCABBABBBBCAC.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCABABCACABBBBAACBCBCBBCBACCCCBBABBBBBCCAACBBBACAABBBABCBCABACACAAACAABACACBCACCABCCAABBAAACCAAAACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCABABCACABBBBAACBCBCBBCBACCCCBBABBBBBCCAACBBBACAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCABABCACABBBBAACBCBCBBCBACCCCBBABBBBBCCAACBBBACAABBBABCBCABACACAAACAABACACBCACCABCCAABBAAACCAAAACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCABABCACABBBBAACBCBCBBCBACCCCBBABBBBBCCAACBBBACAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBACBAABACABABAABBABAAAABABCACBBCBBCCACAACAABCABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCABABCACABBBBAACBCBCBBCBACCCCBBABBBBBCCAACBBBACAABBB.exe" start= auto displayName= "UserDataSvc_ABBACBAABACABABAABBABAAAABABCACBBCBBCCACAACAABCABAA"
  2⤵
  PID:5484
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBACBAABACABABAABBABAAAABABCACBBCBBCCACAACAABCABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCABABCACABBBBAACBCBCBBCBACCCCBBABBBBBCCAACBBBACAABBB.exe" start= auto displayName= "UserDataSvc_ABBACBAABACABABAABBABAAAABABCACBBCBBCCACAACAABCABAA"
    3⤵
    - Launches sc.exe
    PID:5568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBACBAABACABABAABBABAAAABABCACBBCBBCCACAACAABCABAA"
  2⤵
  PID:5616
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBACBAABACABABAABBABAAAABABCACBBCBBCCACAACAABCABAA"
    3⤵
    - Launches sc.exe
    PID:2984

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAABACAACCBACACAACCCCCBABCBBBCCCBACABCCBACABCBACCABCCCBBACABCAAABCAACCBBAACCBABACBCCACBBCCACACBACBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABACAACCBACACAACCCCCBABCBBBCCCBACABCCBACABCBACCABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAABACAACCBACACAACCCCCBABCBBBCCCBACABCCBACABCBACCABCCCBBACABCAAABCAACCBBAACCBABACBCCACBBCCACACBACBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABACAACCBACACAACCCCCBABCBBBCCCBACABCCBACABCBACCABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBAABCAABCCCBABABAABACBAAAABBCCCBCABACBCBCACACCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABACAACCBACACAACCCCCBABCBBBCCCBACABCCBACABCBACCABCC.exe" start= auto displayName= "UserDataSvc_CBCBAABCAABCCCBABABAABACBAAAABBCCCBCABACBCBCACACCBA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6112
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBAABCAABCCCBABABAABACBAAAABBCCCBCABACBCBCACACCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABACAACCBACACAACCCCCBABCBBBCCCBACABCCBACABCBACCABCC.exe" start= auto displayName= "UserDataSvc_CBCBAABCAABCCCBABABAABACBAAAABBCCCBCABACBCBCACACCBA"
    3⤵
    - Launches sc.exe
    PID:5220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBAABCAABCCCBABABAABACBAAAABBCCCBCABACBCBCACACCBA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5240
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBAABCAABCCCBABABAABACBAAAABBCCCBCABACBCBCACACCBA"
    3⤵
    - Launches sc.exe
    PID:4496

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABAACCCACABCBCACAACCCACCAABBCBBAABAAACCABCBBBCBBBBA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCCBABABABCACCBABBBACAABABCBABCBBCCCABBACBBAABAACCBBAACBBACCAACBCABBBCBCBACABAACCBBAABCACBBBAACABCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBABABABCACCBABBBACAABABCBABCBBCCCABBACBBAABAACCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCCBABABABCACCBABBBACAABABCBABCBBCCCABBACBBAABAACCBBAACBBACCAACBCABBBCBCBACABAACCBBAABCACBBBAACABCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBABABABCACCBABBBACAABABCBABCBBCCCABBACBBAABAACCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBBABABAABBCBACBCACCABBCCCCACAACCACCCBBACBACBABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBABABABCACCBABBBACAABABCBABCBBCCCABBACBBAABAACCBBA.exe" start= auto displayName= "UserDataSvc_CACBBABABAABBCBACBCACCABBCCCCACAACCACCCBBACBACBABCC"
  2⤵
  PID:1824
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBBABABAABBCBACBCACCABBCCCCACAACCACCCBBACBACBABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBABABABCACCBABBBACAABABCBABCBBCCCABBACBBAABAACCBBA.exe" start= auto displayName= "UserDataSvc_CACBBABABAABBCBACBCACCABBCCCCACAACCACCCBBACBACBABCC"
    3⤵
    - Launches sc.exe
    PID:4224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBBABABAABBCBACBCACCABBCCCCACAACCACCCBBACBACBABCC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2496
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBBABABAABBCBACBCACCABBCCCCACAACCACCCBBACBACBABCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1580

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAAACCCCCCBABBCCACBCABCBAACCBACBCBCBBBACACBCCACBBCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAAACCCCCCBABBCCACBCABCBAACCBACBCBCBBBACACBCCACBBCBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAACABBAAAABACCABBBABCCACBACACBBACBBBCAACBBBCBAAACAACABBCABBCAABBCCAAAAACABBAABABBBCBACABBBCBBACBBBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACABBAAAABACCABBBABCCACBACACBBACBBBCAACBBBCBAAACAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAACABBAAAABACCABBBABCCACBACACBBACBBBCAACBBBCBAAACAACABBCABBCAABBCCAAAAACABBAABABBBCBACABBBCBBACBBBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACABBAAAABACCABBBABCCACBACACBBACBBBCAACBBBCBAAACAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAAABACCBBCCCCACCCACCCACBABAACCAABABCBBCCACABCCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACABBAAAABACCABBBABCCACBACACBBACBBBCAACBBBCBAAACAACA.exe" start= auto displayName= "UserDataSvc_BAAAABACCBBCCCCACCCACCCACBABAACCAABABCBBCCACABCCABA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3528
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAAAABACCBBCCCCACCCACCCACBABAACCAABABCBBCCACABCCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACABBAAAABACCABBBABCCACBACACBBACBBBCAACBBBCBAAACAACA.exe" start= auto displayName= "UserDataSvc_BAAAABACCBBCCCCACCCACCCACBABAACCAABABCBBCCACABCCABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAAABACCBBCCCCACCCACCCACBABAACCAABABCBBCCACABCCABA"
  2⤵
  PID:228
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAAAABACCBBCCCCACCCACCCACBABAACCAABABCBBCCACABCCABA"
    3⤵
    - Launches sc.exe
    PID:728

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBABABABCACCBABBBACAABABCBABCBBCCCABBACBBAABAACCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBABABABCACCBABBBACAABABCBABCBBCCCABBACBBAABAACCBBA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCACACCBCBABBCCBABBCAAABACCABCACACAABBBBBCBABAACBACAABBABCCBBBACBBABBBBBBACACCBBCAACCCBBCACCABABBACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCACACCBCBABBCCBABBCAAABACCABCACACAABBBBBCBABAACBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCACACCBCBABBCCBABBCAAABACCABCACACAABBBBBCBABAACBACAABBABCCBBBACBBABBBBBBACACCBBCAACCCBBCACCABABBACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCACACCBCBABBCCBABBCAAABACCABCACACAABBBBBCBABAACBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCBAABACBBBBCBBAACBBABBBCAACCAAACCBCAACABAACBBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCACACCBCBABBCCBABBCAAABACCABCACACAABBBBBCBABAACBACAA.exe" start= auto displayName= "UserDataSvc_CCCCBAABACBBBBCBBAACBBABBBCAACCAAACCBCAACABAACBBAAA"
  2⤵
  PID:5896
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCBAABACBBBBCBBAACBBABBBCAACCAAACCBCAACABAACBBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCACACCBCBABBCCBABBCAAABACCABCACACAABBBBBCBABAACBACAA.exe" start= auto displayName= "UserDataSvc_CCCCBAABACBBBBCBBAACBBABBBCAACCAAACCBCAACABAACBBAAA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCBAABACBBBBCBBAACBBABBBCAACCAAACCBCAACABAACBBAAA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5996
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCBAABACBBBBCBBAACBBABBBCAACCAAACCBCAACABAACBBAAA"
    3⤵
    PID:6048

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACABBAAAABACCABBBABCCACBACACBBACBBBCAACBBBCBAAACAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACABBAAAABACCABBBABCCACBACACBBACBBBCAACBBBCBAAACAACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBBCBABBCCACABBACACCACAABACBCBBBBACABBCABAAAABCBABCBABBBCBBCCAAAABAABBCBBBACBCAACABAABAAACACACCAAAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBABBCCACABBACACCACAABACBCBBBBACABBCABAAAABCBABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5524
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBBCBABBCCACABBACACCACAABACBCBBBBACABBCABAAAABCBABCBABBBCBBCCAAAABAABBCBBBACBCAACABAABAAACACACCAAAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBABBCCACABBACACCACAABACBCBBBBACABBCABAAAABCBABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCABACCCABCACBBABBCCCAACBCBABCBABCBABBCAACACACABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBABBCCACABBACACCACAABACBCBBBBACABBCABAAAABCBABCBA.exe" start= auto displayName= "UserDataSvc_ACCCABACCCABCACBBABBCCCAACBCBABCBABCBABBCAACACACABB"
  2⤵
  PID:5596
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCABACCCABCACBBABBCCCAACBCBABCBABCBABBCAACACACABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBABBCCACABBACACCACAABACBCBBBBACABBCABAAAABCBABCBA.exe" start= auto displayName= "UserDataSvc_ACCCABACCCABCACBBABBCCCAACBCBABCBABCBABBCAACACACABB"
    3⤵
    - Launches sc.exe
    PID:5648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCABACCCABCACBBABBCCCAACBCBABCBABCBABBCAACACACABB"
  2⤵
  PID:5664
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCABACCCABCACBBABBCCCAACBCBABCBABCBABBCAACACACABB"
    3⤵
    - Launches sc.exe
    PID:5712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBAABBACBBBCBAAABABACCBABBAAACBACCCCBACBBBCAABAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBAABBACBBBCBAAABABACCBABBAAACBACCCCBACBBBCAABAABCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAABBBCBBCCACCBCBACACBAACBBACBABBACABBABBBBACBCABCBCACAAABBCBBCCCCCCACCCAABCBBCCCACACACBACCCAACACCBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBBCBBCCACCBCBACACBAACBBACBABBACABBABBBBACBCABCBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAABBBCBBCCACCBCBACACBAACBBACBABBACABBABBBBACBCABCBCACAAABBCBBCCCCCCACCCAABCBBCCCACACACBACCCAACACCBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBBCBBCCACCBCBACACBAACBBACBABBACABBABBBBACBCABCBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBBAABCABCACBAABACABBBACBBCBCAABABBCABCCAABBACCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBBCBBCCACCBCBACACBAACBBACBABBACABBABBBBACBCABCBCAC.exe" start= auto displayName= "UserDataSvc_CBCBBAABCABCACBAABACABBBACBBCBCAABABBCABCCAABBACCAC"
  2⤵
  PID:5636
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBBAABCABCACBAABACABBBACBBCBCAABABBCABCCAABBACCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBBCBBCCACCBCBACACBAACBBACBABBACABBABBBBACBCABCBCAC.exe" start= auto displayName= "UserDataSvc_CBCBBAABCABCACBAABACABBBACBBCBCAABABBCABCCAABBACCAC"
    3⤵
    - Launches sc.exe
    PID:5760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBBAABCABCACBAABACABBBACBBCBCAABABBCABCCAABBACCAC"
  2⤵
  PID:2628
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBBAABCABCACBAABACABBBACBBCBCAABABBCABCCAABBACCAC"
    3⤵
    - Launches sc.exe
    PID:4888

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCAACABCCBACCAABCABAABBCCBBABCCABBCCBABBCBBCBABACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCAACABCCBACCAABCABAABBCCBBABCCABBCCBABBCBBCBABACCA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAACCBABAAAACBBACAACCCCABBBBBAAABCCCCCCBAACBBCBBCCABBBAABAACBAAACBABCACCBCBBBCBBABAAAAAACABAABBCACBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCBABAAAACBBACAACCCCABBBBBAAABCCCCCCBAACBBCBBCCABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAACCBABAAAACBBACAACCCCABBBBBAAABCCCCCCBAACBBCBBCCABBBAABAACBAAACBABCACCBCBBBCBBABAAAAAACABAABBCACBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCBABAAAACBBACAACCCCABBBBBAAABCCCCCCBAACBBCBBCCABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACAACBBABCCCCCCABABABAAABACABCBCCBCCCACBCCABAAABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCBABAAAACBBACAACCCCABBBBBAAABCCCCCCBAACBBCBBCCABBB.exe" start= auto displayName= "UserDataSvc_CACAACBBABCCCCCCABABABAAABACABCBCCBCCCACBCCABAAABAA"
  2⤵
  PID:2220
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACAACBBABCCCCCCABABABAAABACABCBCCBCCCACBCCABAAABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCBABAAAACBBACAACCCCABBBBBAAABCCCCCCBAACBBCBBCCABBB.exe" start= auto displayName= "UserDataSvc_CACAACBBABCCCCCCABABABAAABACABCBCCBCCCACBCCABAAABAA"
    3⤵
    - Launches sc.exe
    PID:4984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACAACBBABCCCCCCABABABAAABACABCBCCBCCCACBCCABAAABAA"
  2⤵
  PID:5460
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACAACBBABCCCCCCABABABAAABACABCBCCBCCCACBCCABAAABAA"
    3⤵
    - Launches sc.exe
    PID:5568

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBABBCCACABBACACCACAABACBCBBBBACABBCABAAAABCBABCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBABBCCACABBACACCACAABACBCBBBBACABBCABAAAABCBABCBA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBCAACCCCCCCCBCACCABCBBBBCABCBCACAAABACCACCBBCBCBBCCAABCBABBCBABBABCCBBCABCCAABACACBAAABCABBACABCBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAABBAABACBCACCCABCBAAACCBBABCCBCCCACCBCBBCCBBAABABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBCAACCCCCCCCBCACCABCBBBBCABCBCACAAABACCACCBBCBCBBCCAABCBABBCBABBABCCBBCABCCAABACACBAAABCABBACABCBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAABBAABACBCACCCABCBAAACCBBABCCBCCCACCBCBBCCBBAABABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCACCBBBBAAACBCBAABCBCABCCBAAACABBCCCBCBBACCBABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAABBAABACBCACCCABCBAAACCBBABCCBCCCACCBCBBCCBBAABABB.exe" start= auto displayName= "UserDataSvc_CBCACCBBBBAAACBCBAABCBCABCCBAAACABBCCCBCBBACCBABBAC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5912
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCACCBBBBAAACBCBAABCBCABCCBAAACABBCCCBCBBACCBABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAABBAABACBCACCCABCBAAACCBBABCCBCCCACCBCBBCCBBAABABB.exe" start= auto displayName= "UserDataSvc_CBCACCBBBBAAACBCBAABCBCABCCBAAACABBCCCBCBBACCBABBAC"
    3⤵
    - Launches sc.exe
    PID:6132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCACCBBBBAAACBCBAABCBCABCCBAAACABBCCCBCBBACCBABBAC"
  2⤵
  PID:772
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCACCBBBBAAACBCBAABCBCABCCBAAACABBCCCBCBBACCBABBAC"
    3⤵
    - Launches sc.exe
    PID:5188

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCACACCBCBABBCCBABBCAAABACCABCACACAABBBBBCBABAACBACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCACACCBCBABBCCBABBCAAABACCABCACACAABBBBBCBABAACBACAA.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:6056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCBBABCBACBCCABBBBACACABCBABBCBCABBCBBBABABBCCBABBAACCBCBCBAAACBCCCACBBAAABBABBACBBBCCBABBCBBAAAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBBABAABBAAACABCBABBCBBACCBAACABBCCBBBBAABABABBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCBBABCBACBCCABBBBACACABCBABBCBCABBCBBBABABBCCBABBAACCBCBCBAAACBCCCACBBAAABBABBACBBBCCBABBCBBAAAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBBABAABBAAACABCBABBCBBACCBAACABBCCBBBBAABABABBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACCAAACACCCCCABBCBCCAACBABBACBAABAAACCAABAABBABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBBABAABBAAACABCBABBCBBACCBAACABBCCBBBBAABABABBACB.exe" start= auto displayName= "UserDataSvc_CBACCAAACACCCCCABBCBCCAACBABBACBAABAAACCAABAABBABAA"
  2⤵
  PID:5592
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACCAAACACCCCCABBCBCCAACBABBACBAABAAACCAABAABBABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBBABAABBAAACABCBABBCBBACCBAACABBCCBBBBAABABABBACB.exe" start= auto displayName= "UserDataSvc_CBACCAAACACCCCCABBCBCCAACBABBACBAABAAACCAABAABBABAA"
    3⤵
    - Launches sc.exe
    PID:376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACCAAACACCCCCABBCBCCAACBABBACBAABAAACCAABAABBABAA"
  2⤵
  PID:5028
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACCAAACACCCCCABBCBCCAACBABBACBAABAAACCAABAABBABAA"
    3⤵
    - Launches sc.exe
    PID:5776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCACACCBCBABBCCBABBCAAABACCABCACACAABBBBBCBABAACBACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCACACCBCBABBCCBABBCAAABACCABCACACAABBBBBCBABAACBACAA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCBBABCBACBCCABBBBACACABCBABBCBCABBCBBBABABBCCBABBAACCBCBCBAAACBCCCACBBAAABBABBACBBBCCBABBCBBAAAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBBABAABBAAACABCBABBCBBACCBAACABBCCBBBBAABABABBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCBBABCBACBCCABBBBACACABCBABBCBCABBCBBBABABBCCBABBAACCBCBCBAAACBCCCACBBAAABBABBACBBBCCBABBCBBAAAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBBABAABBAAACABCBABBCBBACCBAACABBCCBBBBAABABABBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCCACABACCACAABACBCACCCAACACABCBBCABCCCBBABAABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBBABAABBAAACABCBABBCBBACCBAACABBCCBBBBAABABABBACB.exe" start= auto displayName= "UserDataSvc_BBBCCACABACCACAABACBCACCCAACACABCBBCABCCCBBABAABBAB"
  2⤵
  PID:3464
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCCACABACCACAABACBCACCCAACACABCBBCABCCCBBABAABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBBABAABBAAACABCBABBCBBACCBAACABBCCBBBBAABABABBACB.exe" start= auto displayName= "UserDataSvc_BBBCCACABACCACAABACBCACCCAACACABCBBCABCCCBBABAABBAB"
    3⤵
    PID:5500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCCACABACCACAABACBCACCCAACACABCBBCABCCCBBABAABBAB"
  2⤵
  PID:5516
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCCACABACCACAABACBCACCCAACACABCBBCABCCCBBABAABBAB"
    3⤵
    - Launches sc.exe
    PID:5504

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBAAAAACCAAACBCCCCACAABCCACBBAAACCACAABAACBBABBBBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBAAAAACCAAACBCCCCACAABCCACBBAAACCACAABAACBBABBBBBC.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABBACBACABBCCACBBCAACCCBABAABBACACCBBBBACCBBBABBCBABBBCCBCBBCACCABBBABAABAAAAAABACCBAABAAAACAABACACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBACBACABBCCACBBCAACCCBABAABBACACCBBBBACCBBBABBCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABBACBACABBCCACBBCAACCCBABAABBACACCBBBBACCBBBABBCBABBBCCBCBBCACCABBBABAABAAAAAABACCBAABAAAACAABACACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBACBACABBCCACBBCAACCCBABAABBACACCBBBBACCBBBABBCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBCAABBBAABBACACABBACACBABCCBBBCCBAABBCBACBABCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBACBACABBCCACBBCAACCCBABAABBACACCBBBBACCBBBABBCBABB.exe" start= auto displayName= "UserDataSvc_BACBCAABBBAABBACACABBACACBABCCBBBCCBAABBCBACBABCABC"
  2⤵
  PID:556
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBCAABBBAABBACACABBACACBABCCBBBCCBAABBCBACBABCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBACBACABBCCACBBCAACCCBABAABBACACCBBBBACCBBBABBCBABB.exe" start= auto displayName= "UserDataSvc_BACBCAABBBAABBACACABBACACBABCCBBBCCBAABBCBACBABCABC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBCAABBBAABBACACABBACACBABCCBBBCCBAABBCBACBABCABC"
  2⤵
  PID:220
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBCAABBBAABBACACABBACACBABCCBBBCCBAABBCBACBABCABC"
    3⤵
    - Launches sc.exe
    PID:5852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCABABCACABBBBAACBCBCBBCBACCCCBBABBBBBCCAACBBBACAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCABABCACABBBBAACBCBCBBCBACCCCBBABBBBBCCAACBBBACAABBB.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBBCBCCBCCABCCBCBCBCACCBBCBBCBBCABBBCCBCACBBCCBACCACCACCCAACBBABBCABCBCAABACAACCAABACBCCCACCCAACCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBCBCCBCCABCCBCBCBCACCBBCBBCBBCABBBCCBCACBBCCBACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1308
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBBCBCCBCCABCCBCBCBCACCBBCBBCBBCABBBCCBCACBBCCBACCACCACCCAACBBABBCABCBCAABACAACCAABACBCCCACCCAACCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBCBCCBCCABCCBCBCBCACCBBCBBCBBCABBBCCBCACBBCCBACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBAAABACCBCABAACACCCABBACBACAABBACBCBCBCBACACACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBCBCCBCCABCCBCBCBCACCBBCBBCBBCABBBCCBCACBBCCBACCAC.exe" start= auto displayName= "UserDataSvc_CACBAAABACCBCABAACACCCABBACBACAABBACBCBCBCBACACACAC"
  2⤵
  PID:5760
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBAAABACCBCABAACACCCABBACBACAABBACBCBCBCBACACACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBCBCCBCCABCCBCBCBCACCBBCBBCBBCABBBCCBCACBBCCBACCAC.exe" start= auto displayName= "UserDataSvc_CACBAAABACCBCABAACACCCABBACBACAABBACBCBCBCBACACACAC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBAAABACCBCABAACACCCABBACBACAABBACBCBCBCBACACACAC"
  2⤵
  PID:5876
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBAAABACCBCABAACACCCABBACBACAABBACBCBCBCBACACACAC"
    3⤵
    - Launches sc.exe
    PID:456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBBCBBCCACCBCBACACBAACBBACBABBACABBABBBBACBCABCBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBBCBBCCACCBCBACACBAACBBACBABBACABBABBBBACBCABCBCAC.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCBABCBCACCBBABCACCCBAABACCAAAACAACBCCACBACAACBCBABBCCCBBCAACCCCACCABCAABAAABABCCBBCACBBBCACCBBBABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBABCBCACCBBABCACCCBAABACCAAAACAACBCCACBACAACBCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCBABCBCACCBBABCACCCBAABACCAAAACAACBCCACBACAACBCBABBCCCBBCAACCCCACCABCAABAAABABCCBBCACBBBCACCBBBABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBABCBCACCBBABCACCCBAABACCAAAACAACBCCACBACAACBCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCBCBACABABABBABCBCCBBBBCAAACBBCABABCAACAAAACBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBABCBCACCBBABCACCCBAABACCAAAACAACBCCACBACAACBCBABB.exe" start= auto displayName= "UserDataSvc_CBBCBCBACABABABBABCBCCBBBBCAAACBBCABABCAACAAAACBBBA"
  2⤵
  PID:204
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCBCBACABABABBABCBCCBBBBCAAACBBCABABCAACAAAACBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBABCBCACCBBABCACCCBAABACCAAAACAACBCCACBACAACBCBABB.exe" start= auto displayName= "UserDataSvc_CBBCBCBACABABABBABCBCCBBBBCAAACBBCABABCAACAAAACBBBA"
    3⤵
    - Launches sc.exe
    PID:5404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCBCBACABABABBABCBCCBBBBCAAACBBCABABCAACAAAACBBBA"
  2⤵
  PID:1752
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCBCBACABABABBABCBCCBBBBCAAACBBCABABCAACAAAACBBBA"
    3⤵
    - Launches sc.exe
    PID:1284

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAABBAABACBCACCCABCBAAACCBBABCCBCCCACCBCBBCCBBAABABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAABBAABACBCACCCABCBAAACCBBABCCBCCCACCBCBBCCBBAABABB.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCBCBCBABCACCBAACACBABCCACBBBBBABCCBBBAAAACBABBCBAAACAABACCBBAACCAACBAACABBBBBBCBCAAABBCACAABCBACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAABABAABAAABCACBBACBBBBABCCBBAABBCBABCACCCAABACCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCBCBCBABCACCBAACACBABCCACBBBBBABCCBBBAAAACBABBCBAAACAABACCBBAACCAACBAACABBBBBBCBCAAABBCACAABCBACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAABABAABAAABCACBBACBBBBABCCBBAABBCBABCACCCAABACCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAABCBCACCCBAABABBCABBAABBACBCCABBACCCACBACBACABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAABABAABAAABCACBBACBBBBABCCBBAABBCBABCACCCAABACCCAA.exe" start= auto displayName= "UserDataSvc_BAAABCBCACCCBAABABBCABBAABBACBCCABBACCCACBACBACABBB"
  2⤵
  PID:3568
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAAABCBCACCCBAABABBCABBAABBACBCCABBACCCACBACBACABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAABABAABAAABCACBBACBBBBABCCBBAABBCBABCACCCAABACCCAA.exe" start= auto displayName= "UserDataSvc_BAAABCBCACCCBAABABBCABBAABBACBCCABBACCCACBACBACABBB"
    3⤵
    - Launches sc.exe
    PID:1040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAABCBCACCCBAABABBCABBAABBACBCCABBACCCACBACBACABBB"
  2⤵
  PID:4152
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAAABCBCACCCBAABABBCABBAABBACBCCABBACCCACBACBACABBB"
    3⤵
    - Launches sc.exe
    PID:6136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBBABAABBAAACABCBABBCBBACCBAACABBCCBBBBAABABABBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBBABAABBAAACABCBABBCBBACCBAACABBCCBBBBAABABABBACB.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBCCCCABACBCABCAAAAAABBCBCCABBCAABAAAACACCCACABCBBBBCABBABACACABABAAAACBAACABABBCCAACBBBCCBACACBABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCCCCABACBCABCAAAAAABBCBCCABBCAABAAAACACCCACABCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5220
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBCCCCABACBCABCAAAAAABBCBCCABBCAABAAAACACCCACABCBBBBCABBABACACABABAAAACBAACABABBCCAACBBBCCBACACBABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCCCCABACBCABCAAAAAABBCBCCABBCAABAAAACACCCACABCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCACCCBCCBBAACBABAABBBCACAAAACACCCCBAABCACAAACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCCCCABACBCABCAAAAAABBCBCCABBCAABAAAACACCCACABCBBBB.exe" start= auto displayName= "UserDataSvc_ACBCACCCBCCBBAACBABAABBBCACAAAACACCCCBAABCACAAACBAB"
  2⤵
  PID:3956
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCACCCBCCBBAACBABAABBBCACAAAACACCCCBAABCACAAACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCCCCABACBCABCAAAAAABBCBCCABBCAABAAAACACCCACABCBBBB.exe" start= auto displayName= "UserDataSvc_ACBCACCCBCCBBAACBABAABBBCACAAAACACCCCBAABCACAAACBAB"
    3⤵
    PID:5260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCACCCBCCBBAACBABAABBBCACAAAACACCCCBAABCACAAACBAB"
  2⤵
  PID:5992
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCACCCBCCBBAACBABAABBBCACAAAACACCCCBAABCACAAACBAB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:376

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBBABAABBAAACABCBABBCBBACCBAACABBCCBBBBAABABABBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBBABAABBAAACABCBABBCBBACCBAACABBCCBBBBAABABABBACB.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACABCAAAABCCACCBABACABAAAABBACBACCCCCCBABAAAAAACBCBCACBCACBBBBCABACBBBBACABBCCBCCAACCCCCAABCCBAACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACABCAAAABCCACCBABACABAAAABBACBACCCCCCBABAAAAAACBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACABCAAAABCCACCBABACABAAAABBACBACCCCCCBABAAAAAACBCBCACBCACBBBBCABACBBBBACABBCCBCCAACCCCCAABCCBAACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACABCAAAABCCACCBABACABAAAABBACBACCCCCCBABAAAAAACBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBBACBBBACCCACCACCAAABAAAACAACBAAAABCBCBAACACCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACABCAAAABCCACCBABACABAAAABBACBACCCCCCBABAAAAAACBCBC.exe" start= auto displayName= "UserDataSvc_BCBBBACBBBACCCACCACCAAABAAAACAACBAAAABCBCBAACACCAAA"
  2⤵
  PID:2240
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBBACBBBACCCACCACCAAABAAAACAACBAAAABCBCBAACACCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACABCAAAABCCACCBABACABAAAABBACBACCCCCCBABAAAAAACBCBC.exe" start= auto displayName= "UserDataSvc_BCBBBACBBBACCCACCACCAAABAAAACAACBAAAABCBCBAACACCAAA"
    3⤵
    PID:1328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBBACBBBACCCACCACCAAABAAAACAACBAAAABCBCBAACACCAAA"
  2⤵
  PID:5016
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBBACBBBACCCACCACCAAABAAAACAACBAAAABCBCBAACACCAAA"
    3⤵
    - Launches sc.exe
    PID:6092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABACAACCBACACAACCCCCBABCBBBCCCBACABCCBACABCBACCABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABACAACCBACACAACCCCCBABCBBBCCCBACABCCBACABCBACCABCC.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAABAAACCABABAAABABBAACBCAABCBACBBACAACABCCCCBACCCBCCACBBBAACBCBBABBACBBACBACCBCCCCBACAACBAACCACBACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABAAACCABABAAABABBAACBCAABCBACBBACAACABCCCCBACCCBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAABAAACCABABAAABABBAACBCAABCBACBBACAACABCCCCBACCCBCCACBBBAACBCBBABBACBBACBACCBCCCCBACAACBAACCACBACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABAAACCABABAAABABBAACBCAABCBACBBACAACABCCCCBACCCBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABABACACACCCCCBABCBACBAAAABACBBBCABCBCBBCCACBABAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABAAACCABABAAABABBAACBCAABCBACBBACAACABCCCCBACCCBCCA.exe" start= auto displayName= "UserDataSvc_ABABACACACCCCCBABCBACBAAAABACBBBCABCBCBBCCACBABAACC"
  2⤵
  PID:3508
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABABACACACCCCCBABCBACBAAAABACBBBCABCBCBBCCACBABAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABAAACCABABAAABABBAACBCAABCBACBBACAACABCCCCBACCCBCCA.exe" start= auto displayName= "UserDataSvc_ABABACACACCCCCBABCBACBAAAABACBBBCABCBCBBCCACBABAACC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABABACACACCCCCBABCBACBAAAABACBBBCABCBCBBCCACBABAACC"
  2⤵
  PID:1892
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABABACACACCCCCBABCBACBAAAABACBBBCABCBCBBCCACBABAACC"
    3⤵
    PID:5144

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBACBACABBCCACBBCAACCCBABAABBACACCBBBBACCBBBABBCBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBACBACABBCCACBBCAACCCBABAABBACACCBBBBACCBBBABBCBABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:5832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCABBABBCBCBABBCBAABCCBABACAAAABABBCACCBAABAABBBCBBAAABCBCABCABACBCABBCCCCAAAAABBBBACCBCAAAABBBBABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAAAABBACABCCAACCBABAAAABBBABABAAACCCACCAACCAAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2188
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCABBABBCBCBABBCBAABCCBABACAAAABABBCACCBAABAABBBCBBAAABCBCABCABACBCABBCCCCAAAAABBBBACCBCAAAABBBBABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAAAABBACABCCAACCBABAAAABBBABABAAACCCACCAACCAAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACBCACACCBACBCCABBCBBCBACAACACBACBBBABBBACCACACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAAAABBACABCCAACCBABAAAABBBABABAAACCCACCAACCAAAAAA.exe" start= auto displayName= "UserDataSvc_CCACBCACACCBACBCCABBCBBCBACAACACBACBBBABBBACCACACCA"
  2⤵
  PID:4520
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCACBCACACCBACBCCABBCBBCBACAACACBACBBBABBBACCACACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAAAABBACABCCAACCBABAAAABBBABABAAACCCACCAACCAAAAAA.exe" start= auto displayName= "UserDataSvc_CCACBCACACCBACBCCABBCBBCBACAACACBACBBBABBBACCACACCA"
    3⤵
    PID:4040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACBCACACCBACBCCABBCBBCBACAACACBACBBBABBBACCACACCA"
  2⤵
  PID:3692
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCACBCACACCBACBCCABBCBBCBACAACACBACBBBABBBACCACACCA"
    3⤵
    - Launches sc.exe
    PID:4472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBACBACABBCCACBBCAACCCBABAABBACACCBBBBACCBBBABBCBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBACBACABBCCACBBCAACCCBABAABBACACCBBBBACCBBBABBCBABB.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCABBABBCBCBABBCBAABCCBABACAAAABABBCACCBAABAABBBCBBAAABCBCABCABACBCABBCCCCAAAAABBBBACCBCAAAABBBBABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAAAABBACABCCAACCBABAAAABBBABABAAACCCACCAACCAAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCABBABBCBCBABBCBAABCCBABACAAAABABBCACCBAABAABBBCBBAAABCBCABCABACBCABBCCCCAAAAABBBBACCBCAAAABBBBABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAAAABBACABCCAACCBABAAAABBBABABAAACCCACCAACCAAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBBCCCCCBCBCABBCABCCAABACBCBBAAAABABBCAAACACBCCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAAAABBACABCCAACCBABAAAABBBABABAAACCCACCAACCAAAAAA.exe" start= auto displayName= "UserDataSvc_ACBBCCCCCBCBCABBCABCCAABACBCBBAAAABABBCAAACACBCCCBA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5488
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBBCCCCCBCBCABBCABCCAABACBCBBAAAABABBCAAACACBCCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAAAABBACABCCAACCBABAAAABBBABABAAACCCACCAACCAAAAAA.exe" start= auto displayName= "UserDataSvc_ACBBCCCCCBCBCABBCABCCAABACBCBBAAAABABBCAAACACBCCCBA"
    3⤵
    - Launches sc.exe
    PID:4672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBBCCCCCBCBCABBCABCCAABACBCBBAAAABABBCAAACACBCCCBA"
  2⤵
  PID:3516
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBBCCCCCBCBCABBCABCCAABACBCBBAAAABABBCAAACACBCCCBA"
    3⤵
    PID:2316

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCBABAAAACBBACAACCCCABBBBBAAABCCCCCCBAACBBCBBCCABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCBABAAAACBBACAACCCCABBBBBAAABCCCCCCBAACBBCBBCCABBB.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBABBBBCBCCCACAABCBBBBACABAACACACBBACACBCBBABBBCABBCAAABBABAAABCACACAABCAABCCABCCBCBCCBBCBCCBBACABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBBBAACBBBCBBBCBABBAABCCBBCABBCACAAACCACBAAAABCBAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBABBBBCBCCCACAABCBBBBACABAACACACBBACACBCBBABBBCABBCAAABBABAAABCACACAABCAABCCABCCBCBCCBBCBCCBBACABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBBBAACBBBCBBBCBABBAABCCBBCABBCACAAACCACBAAAABCBAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCBBBAABBACABABBCACCBCCBAAAABBCABABBCABBCCABABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBBBAACBBBCBBBCBABBAABCCBBCABBCACAAACCACBAAAABCBAAAC.exe" start= auto displayName= "UserDataSvc_BACCBBBAABBACABABBCACCBCCBAAAABBCABABBCABBCCABABBAC"
  2⤵
  PID:1216
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCBBBAABBACABABBCACCBCCBAAAABBCABABBCABBCCABABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBBBAACBBBCBBBCBABBAABCCBBCABBCACAAACCACBAAAABCBAAAC.exe" start= auto displayName= "UserDataSvc_BACCBBBAABBACABABBCACCBCCBAAAABBCABABBCABBCCABABBAC"
    3⤵
    PID:5680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCBBBAABBACABABBCACCBCCBAAAABBCABABBCABBCCABABBAC"
  2⤵
  PID:1044
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCBBBAABBACABABBCACCBCCBAAAABBCABABBCABBCCABABBAC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3208

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBCBCCBCCABCCBCBCBCACCBBCBBCBBCABBBCCBCACBBCCBACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBCBCCBCCABCCBCBCBCACCBBCBBCBBCABBBCCBCACBBCCBACCAC.exe
1⤵
- Executes dropped EXE
PID:216

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBABCBCACCBBABCACCCBAABACCAAAACAACBCCACBACAACBCBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBABCBCACCBBABCACCCBAABACCAAAACAACBCCACBACAACBCBABB.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCCCABCBABBCCCABAACCACAABBBBCBBBACCCCCBAACAABCACCAAAACBCCAAABABCBABCACCABBBABCBBABBACAABACABAAABACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBCABAAACCAAABBBABCCCCBACCAACACBCBCCAACBCBAAACBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCCCABCBABBCCCABAACCACAABBBBCBBBACCCCCBAACAABCACCAAAACBCCAAABABCBABCACCABBBABCBBABBACAABACABAAABACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBCABAAACCAAABBBABCCCCBACCAACACBCBCCAACBCBAAACBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABABABACCACCBBBBBCBCABAAACCACCCBACCCCCBBCCCAACCCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBCABAAACCAAABBBABCCCCBACCAACACBCBCCAACBCBAAACBCAA.exe" start= auto displayName= "UserDataSvc_ABABABACCACCBBBBBCBCABAAACCACCCBACCCCCBBCCCAACCCAAC"
  2⤵
  PID:5200
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABABABACCACCBBBBBCBCABAAACCACCCBACCCCCBBCCCAACCCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBCABAAACCAAABBBABCCCCBACCAACACBCBCCAACBCBAAACBCAA.exe" start= auto displayName= "UserDataSvc_ABABABACCACCBBBBBCBCABAAACCACCCBACCCCCBBCCCAACCCAAC"
    3⤵
    PID:4304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABABABACCACCBBBBBCBCABAAACCACCCBACCCCCBBCCCAACCCAAC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3636
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABABABACCACCBBBBBCBCABAAACCACCCBACCCCCBBCCCAACCCAAC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5340

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAABABAABAAABCACBBACBBBBABCCBBAABBCBABCACCCAABACCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAABABAABAAABCACBBACBBBBABCCBBAABBCBABCACCCAABACCCAA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAABAAACCABABAAABABBAACBCAABCBACBBACAACABCCCCBACCCBCCACBBBAACBCBBABBACBBACBACCBCCCCBACAACBAACCACBACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABAAACCABABAAABABBAACBCAABCBACBBACAACABCCCCBACCCBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAABAAACCABABAAABABBAACBCAABCBACBBACAACABCCCCBACCCBCCACBBBAACBCBBABBACBBACBACCBCCCCBACAACBAACCACBACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABAAACCABABAAABABBAACBCAABCBACBBACAACABCCCCBACCCBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABACCBABACCBCABABBABACAACAACACABCCBCABACAAAAACCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABAAACCABABAAABABBAACBCAABCBACBBACAACABCCCCBACCCBCCA.exe" start= auto displayName= "UserDataSvc_BABACCBABACCBCABABBABACAACAACACABCCBCABACAAAAACCCAB"
  2⤵
  PID:6012
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABACCBABACCBCABABBABACAACAACACABCCBCABACAAAAACCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABAAACCABABAAABABBAACBCAABCBACBBACAACABCCCCBACCCBCCA.exe" start= auto displayName= "UserDataSvc_BABACCBABACCBCABABBABACAACAACACABCCBCABACAAAAACCCAB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABACCBABACCBCABABBABACAACAACACABCCBCABACAAAAACCCAB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5784
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABACCBABACCBCABABBABACAACAACACABCCBCABACAAAAACCCAB"
    3⤵
    - Launches sc.exe
    PID:5124

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAAAABBACABCCAACCBABAAAABBBABABAAACCCACCAACCAAAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAAAABBACABCCAACCBABAAAABBBABABAAACCCACCAACCAAAAAA.exe
1⤵
- Executes dropped EXE
PID:5552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAAAABBACABCCAACCBABAAAABBBABABAAACCCACCAACCAAAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAAAABBACABCCAACCBABAAAABBBABABAAACCCACCAACCAAAAAA.exe
1⤵
- Executes dropped EXE
PID:3356

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAAAABBACABCCAACCBABAAAABBBABABAAACCCACCAACCAAAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAAAABBACABCCAACCBABAAAABBBABABAAACCCACCAACCAAAAAA.exe
1⤵
- Executes dropped EXE
PID:5388

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBCABAAACCAAABBBABCCCCBACCAACACBCBCCAACBCBAAACBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBCABAAACCAAABBBABCCCCBACCAACACBCBCCAACBCBAAACBCAA.exe
1⤵
- Executes dropped EXE
PID:5352

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCCCCABACBCABCAAAAAABBCBCCABBCAABAAAACACCCACABCBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCCCCABACBCABCAAAAAABBCBCCABBCAABAAAACACCCACABCBBBB.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAABBBAABABCCBCCABAACABBBCCCBCBBBBACCBCABAACABAABCBABBACAABACBBBCBAAACBBBACCCAAACBCCCBAABCABABCACAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBBAABABCCBCCABAACABBBCCCBCBBBBACCBCABAACABAABCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4444
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAABBBAABABCCBCCABAACABBBCCCBCBBBBACCBCABAACABAABCBABBACAABACBBBCBAAACBBBACCCAAACBCCCBAABCABABCACAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBBAABABCCBCCABAACABBBCCCBCBBBBACCBCABAACABAABCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACCBCBAABACBACBBAACAAABAABAAABBAACBBCCACACACBCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBBAABABCCBCCABAACABBBCCCBCBBBBACCBCABAACABAABCBABB.exe" start= auto displayName= "UserDataSvc_BBACCBCBAABACBACBBAACAAABAABAAABBAACBBCCACACACBCCAA"
  2⤵
  PID:5672
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACCBCBAABACBACBBAACAAABAABAAABBAACBBCCACACACBCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBBAABABCCBCCABAACABBBCCCBCBBBBACCBCABAACABAABCBABB.exe" start= auto displayName= "UserDataSvc_BBACCBCBAABACBACBBAACAAABAABAAABBAACBBCCACACACBCCAA"
    3⤵
    - Launches sc.exe
    PID:6032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACCBCBAABACBACBBAACAAABAABAAABBAACBBCCACACACBCCAA"
  2⤵
  PID:5292
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBACCBCBAABACBACBBAACAAABAABAAABBAACBBCCACACACBCCAA"
    3⤵
    PID:5792

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACABCAAAABCCACCBABACABAAAABBACBACCCCCCBABAAAAAACBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACABCAAAABCCACCBABACABAAAABBACBACCCCCCBABAAAAAACBCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABABACCABBCBABACCABBCCCAACCCBAABAAABAABBBBBBBABABABCAABAACBAABABAACAACAACACBABBACACBCAAACCCACABBACBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBBACCBACBCACBAABCBACBACCABCCACABBABBBACBCACCACBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABABACCABBCBABACCABBCCCAACCCBAABAAABAABBBBBBBABABABCAABAACBAABABAACAACAACACBABBACACBCAAACCCACABBACBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBBACCBACBCACBAABCBACBACCABCCACABBABBBACBCACCACBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACCCBACABCACAABCCAACACACBCCCBAABCCACABABABBAABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBBACCBACBCACBAABCBACBACCABCCACABBABBBACBCACCACBACAC.exe" start= auto displayName= "UserDataSvc_CCACCCBACABCACAABCCAACACACBCCCBAABCCACABABABBAABBCC"
  2⤵
  PID:5836
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCACCCBACABCACAABCCAACACACBCCCBAABCCACABABABBAABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBBACCBACBCACBAABCBACBACCABCCACABBABBBACBCACCACBACAC.exe" start= auto displayName= "UserDataSvc_CCACCCBACABCACAABCCAACACACBCCCBAABCCACABABABBAABBCC"
    3⤵
    - Launches sc.exe
    PID:1748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACCCBACABCACAABCCAACACACBCCCBAABCCACABABABBAABBCC"
  2⤵
  PID:5828
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCACCCBACABCACAABCCAACACACBCCCBAABCCACABABABBAABBCC"
    3⤵
    - Launches sc.exe
    PID:5580

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACABCAAAABCCACCBABACABAAAABBACBACCCCCCBABAAAAAACBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACABCAAAABCCACCBABACABAAAABBACBACCCCCCBABAAAAAACBCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBCCACBABCABAAAABBAACACABBBCCBCBACACAAACBAACBCBABBCCBCCACBABCBCABBBAACBBBBCABBCBCCABCACBCACCCAACBACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBABBABBCBAABCABABCABCABBABAACBABBCABBAABBCBCBCBAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBCCACBABCABAAAABBAACACABBBCCBCBACACAAACBAACBCBABBCCBCCACBABCBCABBBAACBBBBCABBCBCCABCACBCACCCAACBACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBABBABBCBAABCABABCABCABBABAACBABBCABBAABBCBCBCBAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACACBABBACBCCBCAAACBCBABBAABBABCBCCAACCBABCBBBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBABBABBCBAABCABABCABCABBABAACBABBCABBAABBCBCBCBAABA.exe" start= auto displayName= "UserDataSvc_ABACACBABBACBCCBCAAACBCBABBAABBABCBCCAACCBABCBBBBCB"
  2⤵
  PID:3732
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACACBABBACBCCBCAAACBCBABBAABBABCBCCAACCBABCBBBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBABBABBCBAABCABABCABCABBABAACBABBCABBAABBCBCBCBAABA.exe" start= auto displayName= "UserDataSvc_ABACACBABBACBCCBCAAACBCBABBAABBABCBCCAACCBABCBBBBCB"
    3⤵
    PID:5888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACACBABBACBCCBCAAACBCBABBAABBABCBCCAACCBABCBBBBCB"
  2⤵
  PID:3488
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACACBABBACBCCBCAAACBCBABBAABBABCBCCAACCBABCBBBBCB"
    3⤵
    - Launches sc.exe
    PID:5800

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABAAACCABABAAABABBAACBCAABCBACBBACAACABCCCCBACCCBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABAAACCABABAAABABBAACBCAABCBACBBACAACABCCCCBACCCBCCA.exe
1⤵
- Executes dropped EXE
PID:5180

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABAAACCABABAAABABBAACBCAABCBACBBACAACABCCCCBACCCBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABAAACCABABAAABABBAACBCAABCBACBBACAACABCCCCBACCCBCCA.exe
1⤵
- Executes dropped EXE
PID:2936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBBAABABCCBCCABAACABBBCCCBCBBBBACCBCABAACABAABCBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBBAABABCCBCCABAACABBBCCCBCBBBBACCBCABAACABAABCBABB.exe
1⤵
- Executes dropped EXE
PID:5640

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBBBAACBBBCBBBCBABBAABCCBBCABBCACAAACCACBAAAABCBAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBBBAACBBBCBBBCBABBAABCCBBCABBCACAAACCACBAAAABCBAAAC.exe
1⤵
- Executes dropped EXE
PID:5136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBBACCBACBCACBAABCBACBACCABCCACABBABBBACBCACCACBACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBBACCBACBCACBAABCBACBACCABCCACABBABBBACBCACCACBACAC.exe
1⤵
- Executes dropped EXE
PID:5020

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBABBABBCBAABCABABCABCABBABAACBABBCABBAABBCBCBCBAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBABBABBCBAABCABABCABCABBABAACBABBCABBAABBCBCBCBAABA.exe
1⤵
- Executes dropped EXE
PID:5300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

virus_log.txt

Path C:\Users\Admin\AppData\Local\Temp\virus_log.txt
Size 1KB
SHA256 dbab388d094adab3eabdea4d28510e2bbdd786e543e94e87eccab72dfd6273fa
MD5 b2c913876264632409838489247b408e
SHA1 b283f8f90ba931cff2017cb7c82bbb48aedcd5f2
SHA512 30b688f307cf08e478a4b96b98263412e4f7bd9625d2fb9903ab94ba13960fb27e0ee2f7f6cee38e495f5e721641764d0cbbe6e9c31d8c90b6f1883d03f458f3
TLSH
T15041462280ABEC77711115CBBE29FF8DC5E076AF2C441B849B15871477A4872EE5E8E1
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 57e94b9b74673515d2e826c2a072bf3a14887cb4671abf0c6375077c36f59e76
MD5 937f6c84a2c7167f3df55e3201a7b826
SHA1 cabb2fce6e8ff2c81bdf5bc5f18280a0e32ad807
SHA512 06fb13fa2725bbb70b60e306ddb7ea37c711029fec4fe79bbede08720d07bf3024a94277975a3ec58974815a321177428ba63bead4bf978a4dcba355cc13b01f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 05ed267c6e1376209c89f7e39a470b850c963f28100178f796256bd37a9cac95
MD5 e08ba72bc4a6e3cbc4fd1c2e323af551
SHA1 b3357bde6cb3503b0d82e1012f44dff5db2c5d8d
SHA512 d0f82519fdd08835c27b8b35f2b6a97e8eb3809cb4f060db8d37c2e090aa790ead8459d6231132d31b17ec5b47d7b1ce0b8e97b0f7bf9939ad50c76b9f716f33
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e4ce3d38ec466c94d98ab479ca411714c54e43d7a5112272a6491e73c6e058b2
MD5 d7684fe1cfdf7a79afea27ad176bd036
SHA1 d18eedddf98d0e0ba6182ef9b7c57b73fbb386a6
SHA512 a4fa1e23c053853340db60dde739e2d9408927fe9a8e14d9e04db9ac5e785fc16567fdf6ffe43342c4720a692ee376c0c2a8bc9837fc6e8a139a724912209e06
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7e290ddbd5021073ffc1944ab182d18931733bad399a74815eefca5cb44dec30
MD5 11d98ad6c3dbfb1107aa38a97b84c848
SHA1 24150992558af37b75f6aab14d46e70e1f6ef21a
SHA512 b6b87a230e8c90966353acfe61d209fa7bfa4f93968e0482b85764d3966746290f4e0012c0f6294771c90b708c54f50f6ddf6bb9899e132b8c939ee8decb9bce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4c17f6595588384acfa6feb8a355dab3174263f4e7b4c6962e18963247fcca15
MD5 0ddccffeaaeb17b62403e328f4b3aa64
SHA1 de44aa6935785127f0676e551c3d1f4509151a84
SHA512 7b0f191076e7333f5227f2b89c291eb835b9f5ec555085302d4a139842e4c8e30f120d230cbc303da0eccff02e2c2876833dac979d5c0aaaaabc9bcdaa8ca949
MD5 SHA1 SHA512

Submit Download

svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBBAACCBBAACAAABCCACBCCBABCCCBAABACABACBBACACAACAA.exe
Size 2.6MB
SHA256 1d99b417e05221313f6859a7ede3b247393d0a391e25eceb72a9381ecc134409
MD5 ae03b795f9b9f92e03ec7b28c87594c2
SHA1 c2f94a31f8b4f3b179a13df7130e05ec7e0896d7
SHA512 818bb78f5447605ed48d46f843fc68ec88f5316cf52af9d636ca61faf9ebd0c87c9eb70f4ec9d2530e411497c43991c5960cb432fd8f3ce77996f41f8fb866c6
SSDEEP 49152:vbE2KbE2KbE2KbE2KbE2KbE2KbE2KbE2eKjKWQc2b1FVgbjrjxPe1pbPSQm1Flo4:/KjKWQckVgtev5mnlNLB
TLSH
T150C58D84BAE94CE2E961627D49E7D2775B3CF6E04A138F57A728B5371B13F8178C4202
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 82394873fbe7f40cf9441e23ea0d38b15b8c05a503e6f5eb26f4a3c5bf001a77
MD5 0f9834a3894b97c6346b26079bb64e04
SHA1 72c689a230fb8419b1ffc1908172251d310159ba
SHA512 4dc4c1d7083a2031f738ddd801b9a1a6ca47ed6f2e4a9011ad40a57dab3055f45d0d87e64f3364198d19fb4908c282d4d66d58e5e3672c2783613074be61b895
SSDEEP 96:oSZpZkcZvZI14Zb9q3ZW49q3Zd3ZdEZ89Z7+rJHZsxl8ZoZ5cZAZz14ZsuZd4uZi:JZpZrZvZI+Zo3ZG3ZdZ+ZYZ7uZsxiZo3
TLSH
T1D5A1A662F066EC63F13258CBAB1DEAC249E5739F5C8C5B44570A8318B798832DD5D8F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 4bf64c91667b4dbd9f0d0f82edefaf6cafab34a9d404cd572bef90f736aef700
MD5 7c4fe7310b7a1856073d5b6d612688e3
SHA1 2a743f8fe9fb5232729377246fc1175c2efbb603
SHA512 59ac81686d9a1e696a2735b4917b0b4d2b3c6e02be5c4842d2208cb1888fd204f6cc19e49fcfa13584cf388e98f1c685e75eb9508348614b4c7f30ed12875aa9
SSDEEP 96:oSZpZkcZvZI14Zb9q3ZW49q3Zd3ZdEZ89Z7+rJHZsxl8ZoZ5cZAZz14ZsuZd4uZg:JZpZrZvZI+Zo3ZG3ZdZ+ZYZ7uZsxiZo/
TLSH
T14CC1A662E076EC63F13268CBAB1DEAC249D5779F5C9C5B4423098318B798832DD5D8F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 9a6b3cd7ffde40d87d76a02210d6b98cb962d082b16fae9c9a188dd9731de255
MD5 be4c1a523f4010b1c55404b0385a4921
SHA1 d3442e8e4a836ebc75829db95592926d2dfbd529
SHA512 3dbd6d67d2c49a067175f13b8eb9e73f58e18e9963a12860180111e0ab868734c87a91678ae0ac778c1dd83c823fa562bb69f2cbb2f3ae37dcebd04e58ca53bd
SSDEEP 192:JZpZrZvZI+Zo3ZG3ZdZ+ZYZ7uZsxiZoZGZAZz+ZRZvZfZJ3aZWyZFZlZzZs+ZoZr:sktRxs/RazKn7m0EmcxF5wr
TLSH
T152D1A462E076EC63F13268CBAB1DEAC249D5739F9C8C5B4423098318B798932DD5D8F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 a4a260edbd623f0246517f6393ce38b534f1fffa9f054d2c3b1d400145aadca5
MD5 60facfc187c1a08e043e714011c47a6d
SHA1 921979e8038bc2a74ac36c2949fa22eaf104db6e
SHA512 ff3291920d3a2a0e7a79e69aaa1ca4fccd4cb1d91117dddba651efec09590be932d4f385b3a51e6d6aa9824ebb2ff7281dbd23b7a3fa59faac01500c07ae51be
SSDEEP 192:JZpZrZvZI+Zo3ZG3ZdZ+ZYZ7uZsxiZoZGZAZz+ZRZvZfZJ3aZWyZFZlZzZs+ZoZs:sktRxs/RazKn7m0EmcxF5wZC
TLSH
T11BD1A662E076EC63F13268CBAB1DEAC249D4739F9C8C5B4427098318B798932DD5D8F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 b08c81113203df05f0aa174c8fa29742ef02e02055c70bcf1ae628bcc5022969
MD5 704e1089669b0d72e337a504d404452f
SHA1 80bd62834bf4932e988857034af33d58937b2ce1
SHA512 925447939652c24375af1d44f6293b9d16ab0a8b2a315ddb6b9ba9ac80ce06246923137257574b85a61734f324bf8faf1f1aa1e17cc6b1c8a9440929c6fafa5d
SSDEEP 192:JZpZrZvZI+Zo3ZG3ZdZ+ZYZ7uZsxiZoZGZAZz+ZRZvZfZJ3aZWyZFZlZzZs+ZoZZ:sktRxs/RazKn7m0EmcxF5wZShlc
TLSH
T1AEE19562E066EC63F13258CBAB1DEAD249D4739F9C8C5B44270A8318B798932DD5D8F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 9bccb9b646b631c51445080c7ac1bcae4ee2c13d61c4bcbbf7cbc829e35b1bad
MD5 92a65b014cbc1fbbf861303f91c5caa5
SHA1 0b2182e2d6721134163a3bb260de034ead9e39ae
SHA512 a694b4fa34912ab397872371c179468bb39c2e56804971ab53cdb3a7e369893b1579b12658323b1f8e96684e35cf1a2a81d85a3ae1440f795df4b4929857d32f
SSDEEP 192:JZpZrZvZI+Zo3ZG3ZdZ+ZYZ7uZsxiZoZGZAZz+ZRZvZfZJ3aZWyZFZlZzZs+ZoZr:sktRxs/RazKn7m0EmcxF5wZShli
TLSH
T191E19462E076EC63F13258CBAB1DEAD249D4739F9C8C5B44270A8318B798932DD5D8F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 8KB
SHA256 8bdc4e576fba066b1c0ba8cecb73a9590e342ac5a846a7e600f9d83b3ce9479b
MD5 35333d5845068cfad35ffdec3a545544
SHA1 902e7897241df1115167d832d4059e1f86439989
SHA512 4e327d62cbddfa4fd30fff11235d7bc7da07c09b34d377b36690afad7bca40ed58edf91ae75750e62af651a2109a685dece23ca298ea9384daed2901ceb85fe0
SSDEEP 192:JZpZrZvZI+Zo3ZG3ZdZ+ZYZ7uZsxiZoZGZAZz+ZRZvZfZJ3aZWyZFZlZzZs+ZoZF:sktRxs/RazKn7m0EmcxF5wZShlKq5PnS
TLSH
T1D002A462E076EC63F13258CBAE1DEAD249D4739F9C8C5B4463098318AB98932DD5DCF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 a0c9ffe73515e4379514c8410cad273997e3a011450b2050e097df5f63176826
MD5 60deec0e5f7f6580eb71759c37c255d7
SHA1 a771116ab96c0f873f81397f28a044e428cde7db
SHA512 426979595ceb4fd18c01f9d2a5ddbb87addb0434634033db22370eaa24a64322ff989816a491a48ca00f3f42c40a487940d930361b0a701b718b8280c79aaabe
SSDEEP 192:JZpZrZvZI+Zo3ZG3ZdZ+ZYZ7uZsxiZoZGZAZz+ZRZvZfZJ3aZWyZFZlZzZs+ZoZP:sktRxs/RazKn7m0EmcxF5wZShlKq5Pn8
TLSH
T1AC22D352E076EC63B13258CBAE1DEAC149E4739F9C8C5B4467098318BB99832ED5D8F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 228ed679ae5287ffb4055f8c0a63995c7f932838ebf910f09741fa63d234970a
MD5 fdb16824cd7822da0e8a469d40321cf6
SHA1 afae11e0ac97e442e2deb4bcf69b517124b35f6e
SHA512 462bdc037664954e99afe5d94fb39c121d6f79cc81bdaa58c7747f181a7d4261775013d8284a4e322127707fba47d4385dd302fb4e9a897052bc17086dc9b81b
SSDEEP 192:JZpZrZvZI+Zo3ZG3ZdZ+ZYZ7uZsxiZoZGZAZz+ZRZvZfZJ3aZWyZFZlZzZs+ZoZX:sktRxs/RazKn7m0EmcxF5wZShlKq5PnU
TLSH
T18E22C352E076EC63B13258CBAE1DEAC149E4739F9C8C5B4467098318BB99C32ED5D8F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 89a2872b51feb686acd846e050d5fe5fcfbcdaba7ac077cfb4a993d38c40e8ee
MD5 a963b96a3a1f44191079b66d08f1e5f6
SHA1 ba7b1ea5aa8e9fe268cfee97fb1cc7e54f88eace
SHA512 296fbba33f0cfbae89a07ff510026f25e75b0424bb307b308b07b7557b8e5c7d24d247fcaa0f118156bed8006481192dafc82ca5aca03094c628d586242d8b9d
SSDEEP 192:JZpZrZvZI+Zo3ZG3ZdZ+ZYZ7uZsxiZoZGZAZz+ZRZvZfZJ3aZWyZFZlZzZs+ZoZN:sktRxs/RazKn7m0EmcxF5wZShlKq5PnK
TLSH
T12822C452E076EC63B13258CBAE1DEAC149E4739F5C8C5B4467098318BB99832DD5DCF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 11KB
SHA256 ab55a17cbaba319f201906d27da6e60b5babf93824d213cb60421a49df21ab52
MD5 2fd8bd340cb7f5a24e51a3c990c977ca
SHA1 7c92830afe7eb57ea65f2e2b7e390eca3b29841a
SHA512 2d16099af6819e14d640aa2014fdfd65176bc8bd1613bd35b9369605c0cbb3685bd6407d260ac7507ba9bc0f96ee1ac3a10738c7de123665b0faf0aa98357812
SSDEEP 192:JZpZrZvZI+Zo3ZG3ZdZ+ZYZ7uZsxiZoZGZAZz+ZRZvZfZJ3aZWyZFZlZzZs+ZoZO:sktRxs/RazKn7m0EmcxF5wZShlKq5PnX
TLSH
T1AF421812E076EC67B13158CBAE1DEAC549E4739B9C8C1B8467098318B799C32EE5DCF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 ec66cf23d12c5c548ef2d69749ad4d4ebb4488a97d713797ae9a945d4b644bce
MD5 13d42280349e86f2c2ea462f1d2f1e38
SHA1 81f840521811f04299c28ef3f7b8c0aec661ad21
SHA512 9cd8011fe9bf7bc8adeab51b66eae21388f29f745461ce0e52c1d5dcc4ab255a8453d091be28486539b0c560003fe725c93adbf1f5964c22ffd90c3fb4292388
SSDEEP 384:sktRxs/RazKn7m0EmcxF5wZShlKq5PnQf0TFWGC00SGguV7X9Q4HPPHN:sktLsJ2K7m0EmcxF5wZxq5PQf0A7lH3N
TLSH
T1E3421812E076EC67B13158CBAE1DEAC549E4739B9C8C1B8467098318B799C32EE5DCF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 13KB
SHA256 898b64cd70c5e9ca787b06d7401d7bab81cfe2aaefbc7458af7d2ce68a4ca3ea
MD5 3e2b5b69c31283d77774f03d961cb5d2
SHA1 454f417b917e31044ea8159541f7b98fdcc66a77
SHA512 85726e6523c418152151ddc26aa0d71f868b2faf2e1c5eba564de9e22e7f7b0ac5f90290adc4b96902b5300866b1227cf8d7fd37161eca87ab5e8352bc976e88
SSDEEP 384:sktRxs/RazKn7m0EmcxF5wZShlKq5PnQf0TFWGC00SGguV7X9Q4HPPHi1:sktLsJ2K7m0EmcxF5wZxq5PQf0A7lH3e
TLSH
T15C520712E076EC63F13158CBAE1DEAC549E4739B9C8C5B8467098318BB95C32EE5D8F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 13KB
SHA256 c304438f3e8c67d46001008354ecd1febc9136fa6df150da0782720fc60c86d2
MD5 9906d0ee663b79f680003a8738bd9009
SHA1 4847695e7fed8b6be5f5ea1fe1a47785f37d2cc5
SHA512 2868b775dc21dc6b68866b764d7ad8eb23bc3635fec738e8f71e30f770dee6aa296f87716f36fcaaac02881f9ce19378f923c262a4a48a9c3e73e47e8c6b09e7
SSDEEP 384:sktRxs/RazKn7m0EmcxF5wZShlKq5PnQf0TFWGC00SGguV7X9Q4HPPHi7On:sktLsJ2K7m0EmcxF5wZxq5PQf0A7lH3x
TLSH
T1AD52F722E076EC63F13158CBAE1DEAC549E4739B9C8C5B8467098318B795C32EE5D8F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 13KB
SHA256 389dcd6469d126aca57a0de9575740da60df7043893f7c14499a3218c1b6b782
MD5 2885bb9aaab0de7d1185c91a83e72f44
SHA1 715cac21bc0fb8dd025a62cd4fed91d6cffc22cc
SHA512 75f83b0f9356ab9300dc21c00e23057efaf25fd2bec013ba4d8f0e85914c960db85df6e4be8c49acea8075961be08f0fd0e8d4b44393f99c8ce38171db0e447e
SSDEEP 384:sktRxs/RazKn7m0EmcxF5wZShlKq5PnQf0TFWGC00SGguV7X9Q4HPPHi7Odk:sktLsJ2K7m0EmcxF5wZxq5PQf0A7lH3s
TLSH
T13652F722E076EC63F13158CBAE1DEAC549E4739B9C8C5B8467098318B795C32EE5D8F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 13KB
SHA256 ddf941382cec2383250182c00f92486852da5bf84ffd8a389ed96668a9657c52
MD5 f3ac278802cbdf20aaa814fb1e351155
SHA1 59248ba715c55d187e4ed4b67e0a38078f7f5b0b
SHA512 0217ffcec1c0a86c6c90832a94eb500b141b0a8986433d79f1c3c7180dbd606ca92a345b7bbde77d8bef2afdad69fc245a9aa58b6443ba409afafedeb88efd83
SSDEEP 384:sktRxs/RazKn7m0EmcxF5wZShlKq5PnQf0TFWGC00SGguV7X9Q4HPPHi7Odnb:sktLsJ2K7m0EmcxF5wZxq5PQf0A7lH3z
TLSH
T1FD52F822E076EC63F13158CBAE1DEAC549E4739B9C8C5B8467098318B795C32EE5D8F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 050e28bbb94b25c742485e3002ee8662b70913000fd748afc220e51c5caa37e4
MD5 4d506ba17fc3dcc3878fb4aad948e892
SHA1 c3668424b52e0977c40faa9ec271022f7d000090
SHA512 e4321ad93cd78d0517728ec4e407c2ec926477c6a1b8dbe92034a799cac63092e35e075f0aa8c5692b3db3432c154222c719efd35a3710930e54da98771391c7
SSDEEP 384:sktRxs/RazKn7m0EmcxF5wZShlKq5PnQf0TFWGC00SGguV7X9Q4HPPHi7OdnGEZ:sktLsJ2K7m0EmcxF5wZxq5PQf0A7lH3h
TLSH
T16752F822E076EC63F13158CBAE1DEAC549E4739B9C8C5B8467098318B795C32EE5D8F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 00868ee124cb3bcbc67c80d90d5f2471edecb80ff108dc48bc9dc40e2bae6590
MD5 def0b06d534a222f588c9841586bfac3
SHA1 08cb709c8eb7f60f17efc28c718cc2a35d866eb7
SHA512 e4e73074507fbda9ed3c86630484aaeb1a8ae7eed6c778e35dbebee404ee81f880ad64754c9ba5ff213125e040e2e5c10737e0ec11698a7213a23ef409441b2d
SSDEEP 384:sktRxs/RazKn7m0EmcxF5wZShlKq5PnQf0TFWGC00SGguV7X9Q4HPPHi7OdnGEd:sktLsJ2K7m0EmcxF5wZxq5PQf0A7lH3F
TLSH
T16A52F822E076EC63F13158CBAE1DEAC549E4739B9C8C5B8467098318B795C32EE5D8F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 16KB
SHA256 dfb9bfe0957376df6d0c8b04b181a8ffad6ed9519b8e1ef6925b5e0d4f12d386
MD5 a0aa35d8eeb6495e98d72cba1de33f59
SHA1 43dd60113609da642ee5d7323fb25dfd57aecfbd
SHA512 62a8e50f7f2771f9f66f9e303d7682156c54cdd051fa12a898d72fa24b09153091cfbf7a8fb66e7ea84eb607772242b9c014fb2266e45ee7e77cf4d2243dfdb6
SSDEEP 384:sktRxs/RazKn7m0EmcxF5wZShlKq5PnQf0TFWGC00SGguV7X9Q4HPPHi7OdnGEVB:sktLsJ2K7m0EmcxF5wZxq5PQf0A7lH3b
TLSH
T1FF72D662E076EC63F13158CBAE1DEAC149E4739B9C8C5B8467098318B795C32EE5D8F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 52ee5f63b8d53174a306baea6032d14c44c5d593189fd9c5b1442ee953d44bda
MD5 80f247d95262708b7771c6f05f6b66e2
SHA1 fffd957f90a0c799832e525e77340c683d136947
SHA512 2f321294ddec3616bf7a860859ab71baebdcea2727f2665314260326e5061a234d408520c49869865f4efd7d517cf2e72ff2325a9f8f6bc416653e13b3ed3577
TLSH
T1DB210221B066A873F12118CBAA1ED98109E1739B9CCC5B889345531DB758D71EE1D8F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 17KB
SHA256 13b9c0d818f5bfbe1adaaa40c4e3d5e68097ed6c8a9df45d12305581c9fd2456
MD5 89f936f823d6719fb6b42883590688e1
SHA1 8b277e11f4066cef4b742d68b1f54df13d9f7c18
SHA512 3c4eedf40e36fa3e724abfaf4601b7f0cf1f84949b488e3fc9c7f84faab3b31a37c9468612be02d26d16219c80b27249c22e53afe367e19d896f258e0d7a98d8
SSDEEP 384:sktRxs/RazKn7m0EmcxF5wZShlKq5PnQf0TFWGC00SGguV7X9Q4HPPHi7OdnGEVS:sktLsJ2K7m0EmcxF5wZxq5PQf0A7lH3M
TLSH
T10B820922E076EC63F13158CBAE1DEAC549E4739B9C8C5B8467094318B795C32EE5D8F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 c2ef7ab1b0624fc4d01d9024ad1fe622c0260fe8f615a2f2d440a6dd584eb9b1
MD5 372e56c6b49dafa6ac2e209ed674b415
SHA1 d16a5332b3124532bf892e46cb8f6384998ba2f9
SHA512 aefb6fe9fce13c813b131338ce6811e7fab0181812f7d9cd72efdcd62d2aae1c6e3424369b5f3f8fccb0088ddd583a27027951fc05194087b245eddc6b7cd50b
TLSH
T1CB51C462E066EC63F13268CBAB1DE9C209D573AF588C5B44530A931DB748832EE1D8F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 fb77bb5aa77c37936cd00b44718f0d86b569f5ddc476e7d59bf7374c291787e6
MD5 3e093d0c67ee4459d9b8a61f1709a8a0
SHA1 0bb6a1596490752b21c7a0b3a15062b79987da1c
SHA512 aef2aeadd7001fc9d8760a9b3adf3d7f21064188d113eca903fabd5b18c9bb7ee919d22090eddee9ae4400de279b683a52985c0fd786499e9b24ad27117bb260
TLSH
T1AA71B662F066EC63F13258CBAB1DEAC20DD573AF588C5744530A8319B798832DE1D8F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 e5c30762da9f4dd70e1aea936dc4ec5ac5240d4d54787844b02fc8939722b9e6
MD5 1d70eacb36c5bd62e40c82e5c21a1d1e
SHA1 b40f21607b0f5dac422f629c4478ba02803c5661
SHA512 3b160b1c6f7fb5be6131cd3743ff710ffc3e962ec627fcaa12a7bb69c048bd05e981fbf2ae2a99ad1493f951a142dd7053a476c598dc7ee4f4b8f61a4d196508
SSDEEP 96:oSZpZkcZvZI14Zb9q3ZW49q3Zd3ZdEZ89Z7+rJHZsxl8ZoZ5cZAZz14ZsuZd4uZL:JZpZrZvZI+Zo3ZG3ZdZ+ZYZ7uZsxiZoK
TLSH
T1EB91B562F066EC63F13268CBAA1DEAC24DD5779F588C5B48130A8318B758832DE5D8F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/60-52-0x0000000000B10000-0x0000000000B32000-memory.dmp

Download

memory/60-32-0x0000000000B10000-0x0000000000B32000-memory.dmp

Download

memory/312-165-0x0000000000700000-0x0000000000722000-memory.dmp

Download

memory/632-226-0x0000000000550000-0x0000000000572000-memory.dmp

Download

memory/632-407-0x0000000000550000-0x0000000000572000-memory.dmp

Download

memory/988-413-0x00000000001A0000-0x00000000001C2000-memory.dmp

Download

memory/1232-337-0x00000000006B0000-0x00000000006D2000-memory.dmp

Download

memory/1232-232-0x00000000006B0000-0x00000000006D2000-memory.dmp

Download

memory/1500-728-0x0000000000910000-0x0000000000932000-memory.dmp

Download

memory/1632-223-0x0000000000670000-0x0000000000692000-memory.dmp

Download

memory/1632-338-0x0000000000670000-0x0000000000692000-memory.dmp

Download

memory/1660-341-0x00000000009B0000-0x00000000009D2000-memory.dmp

Download

memory/1660-224-0x00000000009B0000-0x00000000009D2000-memory.dmp

Download

memory/1964-473-0x0000000000D30000-0x0000000000D52000-memory.dmp

Download

memory/1964-688-0x0000000000D30000-0x0000000000D52000-memory.dmp

Download

memory/2068-33-0x0000000000B10000-0x0000000000B32000-memory.dmp

Download

memory/2128-601-0x0000000000B80000-0x0000000000BA2000-memory.dmp

Download

memory/2128-727-0x0000000000B80000-0x0000000000BA2000-memory.dmp

Download

memory/2448-387-0x0000000000D40000-0x0000000000D62000-memory.dmp

Download

memory/2448-526-0x0000000000D40000-0x0000000000D62000-memory.dmp

Download

memory/2572-547-0x0000000000E20000-0x0000000000E42000-memory.dmp

Download

memory/2952-474-0x0000000000D30000-0x0000000000D52000-memory.dmp

Download

memory/3056-335-0x00000000006B0000-0x00000000006D2000-memory.dmp

Download

memory/3056-230-0x00000000006B0000-0x00000000006D2000-memory.dmp

Download

memory/3104-671-0x00000000001B0000-0x00000000001D2000-memory.dmp

Download

memory/3104-471-0x00000000001B0000-0x00000000001D2000-memory.dmp

Download

memory/3172-585-0x0000000000EB0000-0x0000000000ED2000-memory.dmp

Download

memory/3244-472-0x00000000006E0000-0x0000000000702000-memory.dmp

Download

memory/3244-673-0x00000000006E0000-0x0000000000702000-memory.dmp

Download

memory/3400-54-0x0000000000B90000-0x0000000000BB2000-memory.dmp

Download

memory/3400-109-0x0000000000B90000-0x0000000000BB2000-memory.dmp

Download

memory/3800-0-0x00000000008F0000-0x0000000000912000-memory.dmp

Download

memory/3800-15-0x00000000008F0000-0x0000000000912000-memory.dmp

Download

memory/3824-467-0x00000000006F0000-0x0000000000712000-memory.dmp

Download

memory/3824-254-0x00000000006F0000-0x0000000000712000-memory.dmp

Download

memory/4192-388-0x00000000009B0000-0x00000000009D2000-memory.dmp

Download

memory/4192-527-0x00000000009B0000-0x00000000009D2000-memory.dmp

Download

memory/4220-739-0x0000000000FC0000-0x0000000000FE2000-memory.dmp

Download

memory/4220-810-0x0000000000FC0000-0x0000000000FE2000-memory.dmp

Download

memory/4364-164-0x0000000000070000-0x0000000000092000-memory.dmp

Download

memory/4364-51-0x0000000000070000-0x0000000000092000-memory.dmp

Download

memory/4452-412-0x00000000001A0000-0x00000000001C2000-memory.dmp

Download

memory/4588-220-0x0000000000BC0000-0x0000000000BE2000-memory.dmp

Download

memory/4588-146-0x0000000000BC0000-0x0000000000BE2000-memory.dmp

Download

memory/4768-644-0x0000000000950000-0x0000000000972000-memory.dmp

Download

memory/4768-548-0x0000000000950000-0x0000000000972000-memory.dmp

Download

memory/4868-111-0x0000000000B90000-0x0000000000BB2000-memory.dmp

Download

memory/4868-59-0x0000000000B90000-0x0000000000BB2000-memory.dmp

Download

memory/4988-478-0x00000000001F0000-0x0000000000212000-memory.dmp

Download

memory/4988-415-0x00000000001F0000-0x0000000000212000-memory.dmp

Download

memory/5080-122-0x0000000000BC0000-0x0000000000BE2000-memory.dmp

Download

memory/5080-219-0x0000000000BC0000-0x0000000000BE2000-memory.dmp

Download

memory/5116-159-0x0000000000070000-0x0000000000092000-memory.dmp

Download

memory/5116-50-0x0000000000070000-0x0000000000092000-memory.dmp

Download

memory/5172-841-0x0000000000A90000-0x0000000000AB2000-memory.dmp

Download

memory/5172-790-0x0000000000A90000-0x0000000000AB2000-memory.dmp

Download

memory/5344-672-0x0000000000F00000-0x0000000000F22000-memory.dmp

Download

memory/5344-756-0x0000000000F00000-0x0000000000F22000-memory.dmp

Download

memory/5660-807-0x0000000000C40000-0x0000000000C62000-memory.dmp

Download

memory/5728-706-0x0000000000C40000-0x0000000000C62000-memory.dmp

Download

memory/5780-742-0x00000000001D0000-0x00000000001F2000-memory.dmp

Download

memory/5780-811-0x00000000001D0000-0x00000000001F2000-memory.dmp

Download

memory/6056-709-0x0000000000FA0000-0x0000000000FC2000-memory.dmp

Download

memory/6072-710-0x0000000000FA0000-0x0000000000FC2000-memory.dmp

Download