893ccac4360b51d08b2c230fa9aa6dd44b32e69c9add35ff553e29a0ca4cd594

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe
Size 45.6MB
Sample260705-bwacvaby6q
SHA256 893ccac4360b51d08b2c230fa9aa6dd44b32e69c9add35ff553e29a0ca4cd594
MD5 78e4e6ec4b1ad84ec6791c5810bf5438
SHA1 7b46a0b5ef46868ae902548740e418f78ab99d0b
SHA512 ed1a45613c1927afe8534f4c94a17b4ae90fa1fa77e67290d43f8c72a1204fd3648a9e65ccef9b982bf7515788caeb9c15b252375d75c68ff3dcebbc73454710
SSDEEP 786432:oymbqv8l2r2H2cSDXQLcd2BWuFBKLAyomzeXqhb/UYE6uk5jzZ1spR2qsPHeuDDc:bQ72CWcxLcdaDy7zlhDUmOR/EHzwSMwA
TLSH
T134A7331DF2B600DED123607C885AD23AE339BDC55B95C6CB9A198D073F637E0DCA6246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe

Executes dropped EXE 30 IoCs

pid	Process
1748	svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe
1700	svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe
3212	svchost_CACAAAAABAACCCACCABBAACBBCCBCAABBAABBACCACAAABCCBBBBAAA.exe
5096	svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe
2908	svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe
1976	svchost_AACBBABBAABCBABCCCBBBABCBBCBCCBBCCBBABACCBBCCACCBBCBBAA.exe
2108	svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe
3320	svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe
976	svchost_ABAABABACCBBAAABACABABABCCCACABAACBAAACABBCCACABABCCABC.exe
4460	svchost_BCBCACAAABCACAAABCBBACACCCCAAAAACCCAABCBAABCCACABBBBCAA.exe
2780	svchost_AABAAABACACCBABBBABCCAAABBBCCAABBAABAABBAABAACCBABBBCAB.exe
2624	svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe
3352	svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe
4552	svchost_ACBCBCACBAAAABBCABCACBABACACABBCCBBBBCAABBBAACCAABCCACB.exe
1160	svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe
4320	svchost_CCBBABAABAACBCABCBCCACCABBBCACCCCCCCAAACCCCACBABBBACCAC.exe
1804	svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe
1904	svchost_AAABCABCAABCCBCBAACCBBCBCCBCCCBBBCABACCCBBBABACBABCCBCA.exe
2024	svchost_AAABCABCAABCCBCBAACCBBCBCCBCCCBBBCABACCCBBBABACBABCCBCA.exe
3040	svchost_AABACCAACCBBCACABBBCCAABCBAAACABBBBBBCACBABBCBACBBCBBBB.exe
1372	svchost_CAAABBBACCCCABBABBCCCCBBBBBCBBCACBBBACCCCBCCAAABCAABCBC.exe
1416	svchost_CACACCCCCAABCABACABCABCACBBACAAAABBCBABACABCAACCAABBACB.exe
1156	svchost_AABAABBAAACCBABCBCCCABCCABACCCBBABACCBABCABBCABCCCABAAA.exe
2984	svchost_ABCAABABBCBCCACBABBBCABAAACBBBAAAABABCBCBCABBAABBCAABCA.exe
1196	svchost_BCCBBBBBCCBAAABBBCAAABAACABCABBCAAACACCAABCBACABCBBBCCC.exe
3944	svchost_CCAABBBACAACACABBBAABAACCACCBCAAACCABACBBCCACBACCBCCCBA.exe
1204	svchost_BABAABBACBBABCBCBBCACCBBBBBACCCABAABBABACACAABAAABABBCA.exe
4372	svchost_ABACCCABBCBACCBACBAACACABCBBACCBCBBAABCABCCBAAAAABCCAAB.exe
4788	svchost_AAACCBCACACBCCCBBABBACBABBBAAABACBACCCCACBAABCCCABBBBBB.exe
3324	svchost_BCCBCCCBBABAAABCBAABBBBAABAAAACBABCAABCABACABABBCBCBACA.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCBCACCCAACBACBCCABABCCCCBACBBAACBBCBBBCBBBCBCAACBABABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe"	svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCCBCAACBCACACCBCCCBCACAACCCACCCCCBABACBCBABCCBCCBBBAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe"	svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ACCACACBCAABCACCCABCBCCBCACBACCCAAABAACACCAAAABBBCCACBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe"	svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BABAACCACCBBBAAACABAACABCABBCCBABABBBABBACCBBCAAAAABBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABCABCAABCCBCBAACCBBCBCCBCCCBBBCABACCCBBBABACBABCCBCA.exe"	svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AABAACAAAABBBABAABCABBBCACACCABCCCCBCBCAACCACCBCCCBCCBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBBBBBCCBAAABBBCAAABAACABCABBCAAACACCAABCBACABCBBBCCC.exe"	svchost_AAABCABCAABCCBCBAACCBBCBCCBCCCBBBCABACCCBBBABACBABCCBCA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BABAAACABAABBCACCCBCCABCCBCABCACABAACCBBAACCAACBACACCBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe"	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBCBBCBBBBABAACBABBBAABCAACBBAAABCBBBACCAAABBBBCAABCAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe"	svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe

Launches sc.exe 46 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3896	sc.exe
2436	sc.exe
5088	sc.exe
3164	sc.exe
3492	sc.exe
4804	sc.exe
4100	sc.exe
2444	sc.exe
3080	sc.exe
1056	sc.exe
812	sc.exe
1504	sc.exe
748	sc.exe
4492	sc.exe
1212	sc.exe
4660	sc.exe
2404	sc.exe
1140	sc.exe
4708	sc.exe
3388	sc.exe
2452	sc.exe
5116	sc.exe
2264	sc.exe
2316	sc.exe
3836	sc.exe
1068	sc.exe
4388	sc.exe
2672	sc.exe
3920	sc.exe
1504	sc.exe
3852	sc.exe
1116	sc.exe
2264	sc.exe
4532	sc.exe
4588	sc.exe
2204	sc.exe
3624	sc.exe
1132	sc.exe
4020	sc.exe
2248	sc.exe
4048	sc.exe
4224	sc.exe
3936	sc.exe
2324	sc.exe
748	sc.exe
552	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABCABCAABCCBCBAACCBBCBCCBCCCBBBCABACCCBBBABACBABCCBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABACCAACCBBCACABBBCCAABCBAAACABBBBBBCACBABBCBACBBCBBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBBBBBCCBAAABBBCAAABAACABCABBCAAACACCAABCBACABCBBBCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABCABCAABCCBCBAACCBBCBCCBCCCBBBCABACCCBBBABACBABCCBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBBABBAABCBABCCCBBBABCBBCBCCBBCCBBABACCBBCCACCBBCBBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABAAABACACCBABBBABCCAAABBBCCAABBAABAABBAABAACCBABBBCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACACCCCCAABCABACABCABCACBBACAAAABBCBABACABCAACCAABBACB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5040	schtasks.exe
2628	schtasks.exe
4196	schtasks.exe
1180	schtasks.exe
2684	schtasks.exe
748	schtasks.exe
4504	schtasks.exe
2360	schtasks.exe
2992	schtasks.exe
4388	schtasks.exe
2744	schtasks.exe
3964	schtasks.exe
4860	schtasks.exe
2204	schtasks.exe
4108	schtasks.exe
4500	schtasks.exe
3068	schtasks.exe
4272	schtasks.exe
744	schtasks.exe
4328	schtasks.exe
5060	schtasks.exe
3168	schtasks.exe
4588	schtasks.exe
4644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
3060	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe
3060	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe
1700	svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe
1700	svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe
1748	svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe
1748	svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe
3212	svchost_CACAAAAABAACCCACCABBAACBBCCBCAABBAABBACCACAAABCCBBBBAAA.exe
3212	svchost_CACAAAAABAACCCACCABBAACBBCCBCAABBAABBACCACAAABCCBBBBAAA.exe
5096	svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe
5096	svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe
3060	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe
3060	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe
1976	svchost_AACBBABBAABCBABCCCBBBABCBBCBCCBBCCBBABACCBBCCACCBBCBBAA.exe
1976	svchost_AACBBABBAABCBABCCCBBBABCBBCBCCBBCCBBABACCBBCCACCBBCBBAA.exe
3320	svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe
3320	svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe
2908	svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe
2908	svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe
2108	svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe
2108	svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe
1748	svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe
1748	svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe
976	svchost_ABAABABACCBBAAABACABABABCCCACABAACBAAACABBCCACABABCCABC.exe
976	svchost_ABAABABACCBBAAABACABABABCCCACABAACBAAACABBCCACABABCCABC.exe
2624	svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe
2624	svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe
5096	svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe
5096	svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe
2780	svchost_AABAAABACACCBABBBABCCAAABBBCCAABBAABAABBAABAACCBABBBCAB.exe
2780	svchost_AABAAABACACCBABBBABCCAAABBBCCAABBAABAABBAABAACCBABBBCAB.exe
1160	svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe
1160	svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe
3352	svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe
3352	svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe
4552	svchost_ACBCBCACBAAAABBCABCACBABACACABBCCBBBBCAABBBAACCAABCCACB.exe
4552	svchost_ACBCBCACBAAAABBCABCACBABACACABBCCBBBBCAABBBAACCAABCCACB.exe
4320	svchost_CCBBABAABAACBCABCBCCACCABBBCACCCCCCCAAACCCCACBABBBACCAC.exe
4320	svchost_CCBBABAABAACBCABCBCCACCABBBCACCCCCCCAAACCCCACBABBBACCAC.exe
2108	svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe
2108	svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe
1372	svchost_CAAABBBACCCCABBABBCCCCBBBBBCBBCACBBBACCCCBCCAAABCAABCBC.exe
1372	svchost_CAAABBBACCCCABBABBCCCCBBBBBCBBCACBBBACCCCBCCAAABCAABCBC.exe
1416	svchost_CACACCCCCAABCABACABCABCACBBACAAAABBCBABACABCAACCAABBACB.exe
1416	svchost_CACACCCCCAABCABACABCABCACBBACAAAABBCBABACABCAACCAABBACB.exe
1904	svchost_AAABCABCAABCCBCBAACCBBCBCCBCCCBBBCABACCCBBBABACBABCCBCA.exe
1904	svchost_AAABCABCAABCCBCBAACCBBCBCCBCCCBBBCABACCCBBBABACBABCCBCA.exe
2024	svchost_AAABCABCAABCCBCBAACCBBCBCCBCCCBBBCABACCCBBBABACBABCCBCA.exe
2024	svchost_AAABCABCAABCCBCBAACCBBCBCCBCCCBBBCABACCCBBBABACBABCCBCA.exe
2984	svchost_ABCAABABBCBCCACBABBBCABAAACBBBAAAABABCBCBCABBAABBCAABCA.exe
2984	svchost_ABCAABABBCBCCACBABBBCABAAACBBBAAAABABCBCBCABBAABBCAABCA.exe
1804	svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe
1804	svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe
2624	svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe
2624	svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe
3040	svchost_AABACCAACCBBCACABBBCCAABCBAAACABBBBBBCACBABBCBACBBCBBBB.exe
3040	svchost_AABACCAACCBBCACABBBCCAABCBAAACABBBBBBCACBABBCBACBBCBBBB.exe
1196	svchost_BCCBBBBBCCBAAABBBCAAABAACABCABBCAAACACCAABCBACABCBBBCCC.exe
1196	svchost_BCCBBBBBCCBAAABBBCAAABAACABCABBCAAACACCAABCBACABCBBBCCC.exe
1160	svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe
1160	svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	3060	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe
Token: SeDebugPrivilege	1700	svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe
Token: SeDebugPrivilege	1748	svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe
Token: SeDebugPrivilege	3212	svchost_CACAAAAABAACCCACCABBAACBBCCBCAABBAABBACCACAAABCCBBBBAAA.exe
Token: SeDebugPrivilege	5096	svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe
Token: SeDebugPrivilege	1976	svchost_AACBBABBAABCBABCCCBBBABCBBCBCCBBCCBBABACCBBCCACCBBCBBAA.exe
Token: SeDebugPrivilege	3320	svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe
Token: SeDebugPrivilege	2908	svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe
Token: SeDebugPrivilege	2108	svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe
Token: SeDebugPrivilege	976	svchost_ABAABABACCBBAAABACABABABCCCACABAACBAAACABBCCACABABCCABC.exe
Token: SeDebugPrivilege	2624	svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe
Token: SeDebugPrivilege	2780	svchost_AABAAABACACCBABBBABCCAAABBBCCAABBAABAABBAABAACCBABBBCAB.exe
Token: SeDebugPrivilege	1160	svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe
Token: SeDebugPrivilege	3352	svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe
Token: SeDebugPrivilege	4552	svchost_ACBCBCACBAAAABBCABCACBABACACABBCCBBBBCAABBBAACCAABCCACB.exe
Token: SeDebugPrivilege	4320	svchost_CCBBABAABAACBCABCBCCACCABBBCACCCCCCCAAACCCCACBABBBACCAC.exe
Token: SeDebugPrivilege	1372	svchost_CAAABBBACCCCABBABBCCCCBBBBBCBBCACBBBACCCCBCCAAABCAABCBC.exe
Token: SeDebugPrivilege	1416	svchost_CACACCCCCAABCABACABCABCACBBACAAAABBCBABACABCAACCAABBACB.exe
Token: SeDebugPrivilege	1904	svchost_AAABCABCAABCCBCBAACCBBCBCCBCCCBBBCABACCCBBBABACBABCCBCA.exe
Token: SeDebugPrivilege	2024	svchost_AAABCABCAABCCBCBAACCBBCBCCBCCCBBBCABACCCBBBABACBABCCBCA.exe
Token: SeDebugPrivilege	2984	svchost_ABCAABABBCBCCACBABBBCABAAACBBBAAAABABCBCBCABBAABBCAABCA.exe
Token: SeDebugPrivilege	1804	svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe
Token: SeDebugPrivilege	3040	svchost_AABACCAACCBBCACABBBCCAABCBAAACABBBBBBCACBABBCBACBBCBBBB.exe
Token: SeDebugPrivilege	1196	svchost_BCCBBBBBCCBAAABBBCAAABAACABCABBCAAACACCAABCBACABCBBBCCC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2340	3060	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe	85
PID 2340 wrote to memory of 4644	2340	cmd.exe	87
PID 3060 wrote to memory of 368	3060	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe	88
PID 368 wrote to memory of 4100	368	cmd.exe	91
PID 3060 wrote to memory of 404	3060	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe	93
PID 404 wrote to memory of 2248	404	cmd.exe	96
PID 1700 wrote to memory of 4400	1700	svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe	99
PID 4400 wrote to memory of 2360	4400	cmd.exe	101
PID 1700 wrote to memory of 5000	1700	svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe	102
PID 5000 wrote to memory of 2436	5000	cmd.exe	104
PID 1700 wrote to memory of 3616	1700	svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe	105
PID 3616 wrote to memory of 2452	3616	cmd.exe	107
PID 1748 wrote to memory of 3368	1748	svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe	109
PID 3368 wrote to memory of 5040	3368	cmd.exe	112
PID 1748 wrote to memory of 2728	1748	svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe	113
PID 2728 wrote to memory of 4048	2728	cmd.exe	116
PID 1748 wrote to memory of 3232	1748	svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe	117
PID 3232 wrote to memory of 2444	3232	cmd.exe	119
PID 3212 wrote to memory of 1448	3212	svchost_CACAAAAABAACCCACCABBAACBBCCBCAABBAABBACCACAAABCCBBBBAAA.exe	121
PID 1448 wrote to memory of 2628	1448	cmd.exe	123
PID 3212 wrote to memory of 4636	3212	svchost_CACAAAAABAACCCACCABBAACBBCCBCAABBAABBACCACAAABCCBBBBAAA.exe	124
PID 4636 wrote to memory of 2672	4636	cmd.exe	126
PID 3212 wrote to memory of 3992	3212	svchost_CACAAAAABAACCCACCABBAACBBCCBCAABBAABBACCACAAABCCBBBBAAA.exe	127
PID 3992 wrote to memory of 5116	3992	cmd.exe	130
PID 5096 wrote to memory of 3804	5096	svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe	132
PID 3804 wrote to memory of 4196	3804	cmd.exe	135
PID 5096 wrote to memory of 4380	5096	svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe	136
PID 4380 wrote to memory of 1140	4380	cmd.exe	138
PID 5096 wrote to memory of 2132	5096	svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe	140
PID 2132 wrote to memory of 3920	2132	cmd.exe	144
PID 1976 wrote to memory of 4764	1976	svchost_AACBBABBAABCBABCCCBBBABCBBCBCCBBCCBBABACCBBCCACCBBCBBAA.exe	147
PID 4764 wrote to memory of 4500	4764	cmd.exe	149
PID 1976 wrote to memory of 3488	1976	svchost_AACBBABBAABCBABCCCBBBABCBBCBCCBBCCBBABACCBBCCACCBBCBBAA.exe	150
PID 3488 wrote to memory of 5088	3488	cmd.exe	152
PID 1976 wrote to memory of 2472	1976	svchost_AACBBABBAABCBABCCCBBBABCBBCBCCBBCCBBABACCBBCCACCBBCBBAA.exe	153
PID 2472 wrote to memory of 3164	2472	cmd.exe	156
PID 3320 wrote to memory of 4820	3320	svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe	159
PID 4820 wrote to memory of 2992	4820	cmd.exe	162
PID 3320 wrote to memory of 1660	3320	svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe	163
PID 1660 wrote to memory of 4224	1660	cmd.exe	165
PID 3320 wrote to memory of 4284	3320	svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe	166
PID 4284 wrote to memory of 2264	4284	cmd.exe	168
PID 2908 wrote to memory of 3776	2908	svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe	171
PID 3776 wrote to memory of 1180	3776	cmd.exe	173
PID 2908 wrote to memory of 1764	2908	svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe	174
PID 1764 wrote to memory of 1212	1764	cmd.exe	176
PID 2108 wrote to memory of 652	2108	svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe	177
PID 2908 wrote to memory of 5040	2908	svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe	179
PID 5040 wrote to memory of 3492	5040	cmd.exe	181
PID 652 wrote to memory of 2684	652	cmd.exe	183
PID 2108 wrote to memory of 3656	2108	svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe	184
PID 3656 wrote to memory of 1504	3656	cmd.exe	188
PID 976 wrote to memory of 4452	976	svchost_ABAABABACCBBAAABACABABABCCCACABAACBAAACABBCCACABABCCABC.exe	189
PID 2108 wrote to memory of 60	2108	svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe	191
PID 4452 wrote to memory of 3964	4452	cmd.exe	193
PID 976 wrote to memory of 3140	976	svchost_ABAABABACCBBAAABACABABABCCCACABAACBAAACABBCCACABABCCABC.exe	194
PID 3140 wrote to memory of 4660	3140	cmd.exe	196
PID 976 wrote to memory of 4332	976	svchost_ABAABABACCBBAAABACABABABCCCACABAACBAAACABBCCACABABCCABC.exe	197
PID 60 wrote to memory of 2204	60	cmd.exe	199
PID 4332 wrote to memory of 4708	4332	cmd.exe	202
PID 2624 wrote to memory of 708	2624	svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe	204
PID 708 wrote to memory of 3068	708	cmd.exe	206
PID 2780 wrote to memory of 3760	2780	svchost_AABAAABACACCBABBBABCCAAABBBCCAABBAABAABBAABAACCBABBBCAB.exe	207
PID 2624 wrote to memory of 3420	2624	svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe	210

C:\Users\Admin\AppData\Local\Temp\2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABAAACABAABBCACCCBCCABCCBCABCACABAACCBBAACCAACBACACCBCBCABACBCBBACABCBAAACBACBBBBCCAACCCACCABCCCCACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABAAACABAABBCACCCBCCABCCBCABCACABAACCBBAACCAACBACACCBCBCABACBCBBACABCBAAACBACBBBBCCAACCCACCABCCCCACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCACCCBAAACBBABACCCBBABACCBACABBBBCBACBCCABCBBBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe" start= auto displayName= "UserDataSvc_CBCACCCBAAACBBABACCCBBABACCBACABBBBCBACBCCABCBBBACA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCACCCBAAACBBABACCCBBABACCBACABBBBCBACBCCABCBBBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe" start= auto displayName= "UserDataSvc_CBCACCCBAAACBBABACCCBBABACCBACABBBBCBACBCCABCBBBACA"
    3⤵
    - Launches sc.exe
    PID:4100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCACCCBAAACBBABACCCBBABACCBACABBBBCBACBCCABCBBBACA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCACCCBAAACBBABACCCBBABACCBACABBBBCBACBCCABCBBBACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2248

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBBCBBBBABAACBABBBAABCAACBBAAABCBBBACCAAABBBBCAABCAACBCCCBACBACCAACBCAACBCCCCACBBACCBCAABAAAAACABABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBBCBBBBABAACBABBBAABCAACBBAAABCBBBACCAAABBBBCAABCAACBCCCBACBACCAACBCAACBCCCCACBBACCBCAABAAAAACABABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCABBBABBBBCACCABABCCBBAAACBAABBACCCAAAABBCBABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe" start= auto displayName= "UserDataSvc_CABCABBBABBBBCACCABABCCBBAAACBAABBACCCAAAABBCBABBBC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCABBBABBBBCACCABABCCBBAAACBAABBACCCAAAABBCBABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe" start= auto displayName= "UserDataSvc_CABCABBBABBBBCACCABABCCBBAAACBAABBACCCAAAABBCBABBBC"
    3⤵
    - Launches sc.exe
    PID:4048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCABBBABBBBCACCABABCCBBAAACBAABBACCCAAAABBCBABBBC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCABBBABBBBCACCABABCCBBAAACBAABBACCCAAAABBCBABBBC"
    3⤵
    - Launches sc.exe
    PID:2444

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBABACABAACAACCBCBACCBCACACCBACBAABBBAABAACAABCACCBAACCABACBCACBCACCBBACABBABBBACABCCABCABACBBAABCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAAAABAACCCACCABBAACBBCCBCAABBAABBACCACAAABCCBBBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBABACABAACAACCBCBACCBCACACCBACBAABBBAABAACAABCACCBAACCABACBCACBCACCBBACABBABBBACABCCABCABACBBAABCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAAAABAACCCACCABBAACBBCCBCAABBAABBACCACAAABCCBBBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBACCABCCBABABBCCBABAABABABBAACCABACBABAACCCACBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAAAABAACCCACCABBAACBBCCBCAABBAABBACCACAAABCCBBBBAAA.exe" start= auto displayName= "UserDataSvc_ABBACCABCCBABABBCCBABAABABABBAACCABACBABAACCCACBBCC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBACCABCCBABABBCCBABAABABABBAACCABACBABAACCCACBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAAAABAACCCACCABBAACBBCCBCAABBAABBACCACAAABCCBBBBAAA.exe" start= auto displayName= "UserDataSvc_ABBACCABCCBABABBCCBABAABABABBAACCABACBABAACCCACBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBACCABCCBABABBCCBABAABABABBAACCABACBABAACCCACBBCC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBACCABCCBABABBCCBABAABABABBAACCABACBABAACCCACBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2452

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAAAABAACCCACCABBAACBBCCBCAABBAABBACCACAAABCCBBBBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAAAABAACCCACCABBAACBBCCBCAABBAABBACCACAAABCCBBBBAAA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCBBBBCBCBAACCACAABAACCABBBBAABCABBBBBBCAABAACBABCBAACBCCABCBCBAABBCCCCCAABBBCACCBBCBCABBACABACAACCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABBAABCBABCCCBBBABCBBCBCCBBCCBBABACCBBCCACCBBCBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCBBBBCBCBAACCACAABAACCABBBBAABCABBBBBBCAABAACBABCBAACBCCABCBCBAABBCCCCCAABBBCACCBBCBCABBACABACAACCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABBAABCBABCCCBBBABCBBCBCCBBCCBBABACCBBCCACCBBCBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCABCCBCBACBACBBAAAACABAABCAABBABAAAABCAABCBBCABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABBAABCBABCCCBBBABCBBCBCCBBCCBBABACCBBCCACCBBCBBAA.exe" start= auto displayName= "UserDataSvc_BCCABCCBCBACBACBBAAAACABAABCAABBABAAAABCAABCBBCABAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCABCCBCBACBACBBAAAACABAABCAABBABAAAABCAABCBBCABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABBAABCBABCCCBBBABCBBCBCCBBCCBBABACCBBCCACCBBCBBAA.exe" start= auto displayName= "UserDataSvc_BCCABCCBCBACBACBBAAAACABAABCAABBABAAAABCAABCBBCABAB"
    3⤵
    - Launches sc.exe
    PID:2672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCABCCBCBACBACBBAAAACABAABCAABBABAAAABCAABCBBCABAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCABCCBCBACBACBBAAAACABAABCAABBABAAAABCAABCBBCABAB"
    3⤵
    - Launches sc.exe
    PID:5116

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCACCCAACBACBCCABABCCCCBACBBAACBBCBBBCBBBCBCAACBABABBBACCCBBCBACBCABBCABABBBABCBABCBBCCBBBBBCACCAABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCACCCAACBACBCCABABCCCCBACBBAACBBCBBBCBBBCBCAACBABABBBACCCBBCBACBCABBCABABBBABCBABCBBCCBBBBBCACCAABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCABCBABCCAAABABABACCCABBCBBCCCCACCBBCCBAACCAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe" start= auto displayName= "UserDataSvc_ABCCABCBABCCAAABABABACCCABBCBBCCCCACCBBCCBAACCAABBA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCCABCBABCCAAABABABACCCABBCBBCCCCACCBBCCBAACCAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe" start= auto displayName= "UserDataSvc_ABCCABCBABCCAAABABABACCCABBCBBCCCCACCBBCCBAACCAABBA"
    3⤵
    - Launches sc.exe
    PID:1140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCCABCBABCCAAABABABACCCABBCBBCCCCACCBBCCBAACCAABBA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCCABCBABCCAAABABABACCCABBCBBCCCCACCBBCCBAACCAABBA"
    3⤵
    - Launches sc.exe
    PID:3920

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAABACABCAACCAABBBACABBCABCAAAACABABABABCABABCCBCCBB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBACBBBCBBABACBCCABCCCBCCBCAABBABBAABBBBAACABBACABCCCCCAACAACCAACAAAACCCACAABCBAABCACABACBBABAABBBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABACACCBABBBABCCAAABBBCCAABBAABAABBAABAACCBABBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBACBBBCBBABACBCCABCCCBCCBCAABBABBAABBBBAACABBACABCCCCCAACAACCAACAAAACCCACAABCBAABCACABACBBABAABBBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABACACCBABBBABCCAAABBBCCAABBAABAABBAABAACCBABBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCBCBBACBBCBBCACCBCCACABCCBABACBBBABBCBCBCCCACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABACACCBABBBABCCAAABBBCCAABBAABAABBAABAACCBABBBCAB.exe" start= auto displayName= "UserDataSvc_CCCCBCBBACBBCBBCACCBCCACABCCBABACBBBABBCBCBCCCACBAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCBCBBACBBCBBCACCBCCACABCCBABACBBBABBCBCBCCCACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABACACCBABBBABCCAAABBBCCAABBAABAABBAABAACCBABBBCAB.exe" start= auto displayName= "UserDataSvc_CCCCBCBBACBBCBBCACCBCCACABCCBABACBBBABBCBCBCCCACBAB"
    3⤵
    - Launches sc.exe
    PID:1212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCBCBBACBBCBBCACCBCCACABCCBABACBBBABBCBCBCCCACBAB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCBCBBACBBCBBCACCBCCACABCCBABACBBBABBCBCBCCCACBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3492

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABBAABCBABCCCBBBABCBBCBCCBBCCBBABACCBBCCACCBBCBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABBAABCBABCCCBBBABCBBCBCCBBCCBBABACCBBCCACCBBCBBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAAAACCBBACCCCBAABAABAACBAAAAAABBBABCCABABACBBCBBAACBCCBCAABACBACACBACABBBBBBCBCCAABCAAACBACBACBCBAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABACCBBAAABACABABABCCCACABAACBAAACABBCCACABABCCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAAAACCBBACCCCBAABAABAACBAAAAAABBBABCCABABACBBCBBAACBCCBCAABACBACACBACABBBBBBCBCCAABCAAACBACBACBCBAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABACCBBAAABACABABABCCCACABAACBAAACABBCCACABABCCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAACBAABCACAAAAABABBAAABBCCACCACABAAACCBBABCCBBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABACCBBAAABACABABABCCCACABAACBAAACABBCCACABABCCABC.exe" start= auto displayName= "UserDataSvc_CCAACBAABCACAAAAABABBAAABBCCACCACABAAACCBBABCCBBCAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAACBAABCACAAAAABABBAAABBCCACCACABAAACCBBABCCBBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABACCBBAAABACABABABCCCACABAACBAAACABBCCACABABCCABC.exe" start= auto displayName= "UserDataSvc_CCAACBAABCACAAAAABABBAAABBCCACCACABAAACCBBABCCBBCAB"
    3⤵
    - Launches sc.exe
    PID:5088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAACBAABCACAAAAABABBAAABBCCACCACABAAACCBBABCCBBCAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCAACBAABCACAAAAABABBAAABBCCACCACABAAACCBBABCCBBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3164

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCAACBCACACCBCCCBCACAACCCACCCCCBABACBCBABCCBCCBBBAABBCCAAACCBACABACBABCCCBCBACBCBCCCCBBBAABBCBAABCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCAACBCACACCBCCCBCACAACCCACCCCCBABACBCBABCCBCCBBBAABBCCAAACCBACABACBABCCCBCBACBCBCCCCBBBAABBCBAABCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBBCCAAABBBACBACAACBCABABAAABBACBBCCBCACBCCBABACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe" start= auto displayName= "UserDataSvc_CBBBCCAAABBBACBACAACBCABABAAABBACBBCCBCACBCCBABACAC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBBCCAAABBBACBACAACBCABABAAABBACBBCCBCACBCCBABACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe" start= auto displayName= "UserDataSvc_CBBBCCAAABBBACBACAACBCABABAAABBACBBCCBCACBCCBABACAC"
    3⤵
    - Launches sc.exe
    PID:1504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBBCCAAABBBACBACAACBCABABAAABBACBBCCBCACBCCBABACAC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBBCCAAABBBACBACAACBCABABAAABBACBBCCBCACBCCBABACAC"
    3⤵
    - Launches sc.exe
    PID:2204

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBABBBCAABCBAAAAACABCBBBCBBCCACCBBCCCCAACACCCCBCABBC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCBCBABCAABCACAAAAACAABBACBACACAABCACCBCBCCCBBBCACCBCBCCCBBBBCACAAABCCBCCCCABCAAABBACCCCCCABACBCBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACAAABCACAAABCBBACACCCCAAAAACCCAABCBAABCCACABBBBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCBCBABCAABCACAAAAACAABBACBACACAABCACCBCBCCCBBBCACCBCBCCCBBBBCACAAABCCBCCCCABCAAABBACCCCCCABACBCBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACAAABCACAAABCBBACACCCCAAAAACCCAABCBAABCCACABBBBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBBABCBACAAABBBCCABCBCBBBBCBBBBBCAAACACACCCCCCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACAAABCACAAABCBBACACCCCAAAAACCCAABCBAABCCACABBBBCAA.exe" start= auto displayName= "UserDataSvc_BCBBBABCBACAAABBBCCABCBCBBBBCBBBBBCAAACACACCCCCCABA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBBABCBACAAABBBCCABCBCBBBBCBBBBBCAAACACACCCCCCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACAAABCACAAABCBBACACCCCAAAAACCCAABCBAABCCACABBBBCAA.exe" start= auto displayName= "UserDataSvc_BCBBBABCBACAAABBBCCABCBCBBBBCBBBBBCAAACACACCCCCCABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBBABCBACAAABBBCCABCBCBBBBCBBBBBCAAACACACCCCCCABA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBBABCBACAAABBBCCABCBCBBBBCBBBBBCAAACACACCCCCCABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2264

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABACCBBAAABACABABABCCCACABAACBAAACABBCCACABABCCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABACCBBAAABACABABABCCCACABAACBAAACABBCCACABABCCABC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBCBCACACCBCBCBBACAACAACABBACAAABCCBBCCAAAACBCBCBCCBBACCAACBACAABCACABBCABCCBBCBBACBACBACBBCAABCBBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCACBAAAABBCABCACBABACACABBCCBBBBCAABBBAACCAABCCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBCBCACACCBCBCBBACAACAACABBACAAABCCBBCCAAAACBCBCBCCBBACCAACBACAABCACABBCABCCBBCBBACBACBACBBCAABCBBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCACBAAAABBCABCACBABACACABBCCBBBBCAABBBAACCAABCCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCABACAAACCABABBCAABCBBCBACCABCBBABAAABCCCACABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCACBAAAABBCABCACBABACACABBCCBBBBCAABBBAACCAABCCACB.exe" start= auto displayName= "UserDataSvc_BABCABACAAACCABABBCAABCBBCBACCABCBBABAAABCCCACABCCC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABCABACAAACCABABBCAABCBBCBACCABCBBABAAABCCCACABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCACBAAAABBCABCACBABACACABBCCBBBBCAABBBAACCAABCCACB.exe" start= auto displayName= "UserDataSvc_BABCABACAAACCABABBCAABCBBCBACCABCBBABAAABCCCACABCCC"
    3⤵
    - Launches sc.exe
    PID:4660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABCABACAAACCABABBCAABCBBCBACCABCBBABAAABCCCACABCCC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABCABACAAACCABABBCAABCBBCBACCABCBBABAAABCCCACABCCC"
    3⤵
    - Launches sc.exe
    PID:4708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACAAABCACAAABCBBACACCCCAAAAACCCAABCBAABCCACABBBBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACAAABCACAAABCBBACACCCCAAAAACCCAABCBAABCCACABBBBCAA.exe
1⤵
- Executes dropped EXE
PID:4460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABACACCBABBBABCCAAABBBCCAABBAABAABBAABAACCBABBBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABACACCBABBBABCCAAABBBCCAABBAABAABBAABAACCBABBBCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACCBCCBCAAABBCABBABACBAAABABBAACABCBCBCABAAABBCBBBACCCBBABACAAAABBBBCCBCAACCBBBBACCAABCBAAACABCAACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABAABAACBCABCBCCACCABBBCACCCCCCCAAACCCCACBABBBACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACCBCCBCAAABBCABBABACBAAABABBAACABCBCBCABAAABBCBBBACCCBBABACAAAABBBBCCBCAACCBBBBACCAABCBAAACABCAACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABAABAACBCABCBCCACCABBBCACCCCCCCAAACCCCACBABBBACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBCBCACACCBBCABCACCAAACCCBBACCABACCAABACCCCABCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABAABAACBCABCBCCACCABBBCACCCCCCCAAACCCCACBABBBACCAC.exe" start= auto displayName= "UserDataSvc_CBCBCBCACACCBBCABCACCAAACCCBBACCABACCAABACCCCABCBAC"
  2⤵
  PID:820
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBCBCACACCBBCABCACCAAACCCBBACCABACCAABACCCCABCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABAABAACBCABCBCCACCABBBCACCCCCCCAAACCCCACBABBBACCAC.exe" start= auto displayName= "UserDataSvc_CBCBCBCACACCBBCABCACCAAACCCBBACCABACCAABACCCCABCBAC"
    3⤵
    - Launches sc.exe
    PID:3852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBCBCACACCBBCABCACCAAACCCBBACCABACCAABACCCCABCBAC"
  2⤵
  PID:3476
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBCBCACACCBBCABCACCAAACCCBBACCABACCAABACCCCABCBAC"
    3⤵
    - Launches sc.exe
    PID:1116

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACACBCAABCACCCABCBCCBCACBACCCAAABAACACCAAAABBBCCACBABCAABACCBBAABAABCACAACBAABCBCBACBBABAACAAABBCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACACBCAABCACCCABCBCCBCACBACCCAAABAACACCAAAABBBCCACBABCAABACCBBAABAABCACAACBAABCBCBACBBABAACAAABBCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABCBACBCCCAABABBAABBCCABCAABCBBACBABAABCCBBCCCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe" start= auto displayName= "UserDataSvc_BAABCBACBCCCAABABBAABBCCABCAABCBBACBABAABCCBBCCCCAB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3420
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABCBACBCCCAABABBAABBCCABCAABCBBACBABAABCCBBCCCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe" start= auto displayName= "UserDataSvc_BAABCBACBCCCAABABBAABBCCABCAABCBBACBABAABCCBBCCCCAB"
    3⤵
    - Launches sc.exe
    PID:3080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABCBACBCCCAABABBAABBCCABCAABCBBACBABAABCCBBCCCCAB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4516
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABCBACBCCCAABABBAABBCCABCAABCBBACBABAABCCBBCCCCAB"
    3⤵
    - Launches sc.exe
    PID:1056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBCABBCACBBCAABBCAAABABCACCCBAACACACCABBCACABCBCCCC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBAACBBAAABBABABCCBBCCBACCBCBCABACCAABACCBBACACCACCCBACBCBACAACABCBABACCACCACACBAAABAAACABCBBCBCAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCAACCBBCACABBBCCAABCBAAACABBBBBBCACBABBCBACBBCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBAACBBAAABBABABCCBBCCBACCBCBCABACCAABACCBBACACCACCCBACBCBACAACABCBABACCACCACACBAAABAAACABCBBCBCAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCAACCBBCACABBBCCAABCBAAACABBBBBBCACBABBCBACBBCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAACBCBCCBCBCBABBABABBABBABABBAAAAABBAABAAACAABBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCAACCBBCACABBBCCAABCBAAACABBBBBBCACBABBCBACBBCBBBB.exe" start= auto displayName= "UserDataSvc_ABAACBCBCCBCBCBABBABABBABBABABBAAAAABBAABAAACAABBAA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4660
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAACBCBCCBCBCBABBABABBABBABABBAAAAABBAABAAACAABBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCAACCBBCACABBBCCAABCBAAACABBBBBBCACBABBCBACBBCBBBB.exe" start= auto displayName= "UserDataSvc_ABAACBCBCCBCBCBABBABABBABBABABBAAAAABBAABAAACAABBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAACBCBCCBCBCBABBABABBABBABABBAAAAABBAABAAACAABBAA"
  2⤵
  PID:3380
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAACBCBCCBCBCBABBABABBABBABABBAAAAABBAABAAACAABBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:812

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCACBAAAABBCABCACBABACACABBCCBBBBCAABBBAACCAABCCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCACBAAAABBCABCACBABACACABBCCBBBBCAABBBAACCAABCCACB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCABBCCCBBBAABBBAAABCBBBBBCBAACCAAACACACABCAACACACACCCCACCABABBCBBBCACAAAAABAAACCAABABACBCBBCCACCABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBBACCCCABBABBCCCCBBBBBCBBCACBBBACCCCBCCAAABCAABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCABBCCCBBBAABBBAAABCBBBBBCBAACCAAACACACABCAACACACACCCCACCABABBCBBBCACAAAAABAAACCAABABACBCBBCCACCABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBBACCCCABBABBCCCCBBBBBCBBCACBBBACCCCBCCAAABCAABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCBBABACCCACAACBBACACABCCCBCBACBABAACBCCABABABCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBBACCCCABBABBCCCCBBBBBCBBCACBBBACCCCBCCAAABCAABCBC.exe" start= auto displayName= "UserDataSvc_CCCBBABACCCACAACBBACACABCCCBCBACBABAACBCCABABABCCAA"
  2⤵
  PID:2992
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCBBABACCCACAACBBACACABCCCBCBACBABAACBCCABABABCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBBACCCCABBABBCCCCBBBBBCBBCACBBBACCCCBCCAAABCAABCBC.exe" start= auto displayName= "UserDataSvc_CCCBBABACCCACAACBBACACABCCCBCBACBABAACBCCABABABCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCBBABACCCACAACBBACACABCCCBCBACBABAACBCCABABABCCAA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4524
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCBBABACCCACAACBBACACABCCCBCBACBABAACBCCABABABCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1068

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCACCAACBACACACBCCACACCBBABCCBCCACACAACCCCCCAABACCBBAACBCCCBBBABCCBCCBBACABCCCCCACBCABABACBABCCBBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCABCAABCCBCBAACCBBCBCCBCCCBBBCABACCCBBBABACBABCCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCACCAACBACACACBCCACACCBBABCCBCCACACAACCCCCCAABACCBBAACBCCCBBBABCCBCCBBACABCCCCCACBCABABACBABCCBBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCABCAABCCBCBAACCBBCBCCBCCCBBBCABACCCBBBABACBABCCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCAABBAAABBBBBCBACBBABCABCBCABACABABBBCBBACBAABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCABCAABCCBCBAACCBBCBCCBCCCBBBCABACCCBBBABACBABCCBCA.exe" start= auto displayName= "UserDataSvc_CCCAABBAAABBBBBCBACBBABCABCBCABACABABBBCBBACBAABAAC"
  2⤵
  PID:3784
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCAABBAAABBBBBCBACBBABCABCBCABACABABBBCBBACBAABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCABCAABCCBCBAACCBBCBCCBCCCBBBCABACCCBBBABACBABCCBCA.exe" start= auto displayName= "UserDataSvc_CCCAABBAAABBBBBCBACBBABCABCBCABACABABBBCBBACBAABAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCAABBAAABBBBBCBACBBABCABCBCABACABABBBCBBACBAABAAC"
  2⤵
  PID:3156
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCAABBAAABBBBBCBACBBABCABCBCABACABABBBCBBACBAABAAC"
    3⤵
    - Launches sc.exe
    PID:552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABAABAACBCABCBCCACCABBBCACCCCCCCAAACCCCACBABBBACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABAABAACBCABCBCCACCABBBCACCCCCCCAAACCCCACBABBBACCAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACCBABBCBCCCCBABBCBCCABBCCACCACBACCBBBCBAACBABCACBABCACBBCCCBACCBCCBCACCAACABBBACACCAACBCCAABCAACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCCCCAABCABACABCABCACBBACAAAABBCBABACABCAACCAABBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACCBABBCBCCCCBABBCBCCABBCCACCACBACCBBBCBAACBABCACBABCACBBCCCBACCBCCBCACCAACABBBACACCAACBCCAABCAACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCCCCAABCABACABCABCACBBACAAAABBCBABACABCAACCAABBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACABCCAAABBBCCBAACACACCBBCCBCCACCCBCCBCBCACACCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCCCCAABCABACABCABCACBBACAAAABBCBABACABCAACCAABBACB.exe" start= auto displayName= "UserDataSvc_BBACABCCAAABBBCCBAACACACCBBCCBCCACCCBCCBCBCACACCCCB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3996
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACABCCAAABBBCCBAACACACCBBCCBCCACCCBCCBCBCACACCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCCCCAABCABACABCABCACBBACAAAABBCBABACABCAACCAABBACB.exe" start= auto displayName= "UserDataSvc_BBACABCCAAABBBCCBAACACACCBBCCBCCACCCBCCBCBCACACCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACABCCAAABBBCCBAACACACCBBCCBCCACCCBCCBCBCACACCCCB"
  2⤵
  PID:1940
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBACABCCAAABBBCCBAACACACCBBCCBCCACCCBCCBCBCACACCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABABCBCABACCBABACCABBACAAACBAAACBACABCABCCCBABACBCC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCACCBBCAABAABCAAACCCAABCBCACCBABCACABAACABABABACABCCBBAABABCBBCAAABBCAACCABCCCACBBCCBBAAABBCBCCAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCABBCBACCBACBAACACABCBBACCBCBBAABCABCCBAAAAABCCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCACCBBCAABAABCAAACCCAABCBCACCBABCACABAACABABABACABCCBBAABABCBBCAAABBCAACCABCCCACBBCCBBAAABBCBCCAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCABBCBACCBACBAACACABCBBACCBCBBAABCABCCBAAAAABCCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4588

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCABCAABCCBCBAACCBBCBCCBCCCBBBCABACCCBBBABACBABCCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCABCAABCCBCBAACCBBCBCCBCCCBBBCABACCCBBBABACBABCCBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAACAAAABBBABAABCABBBCACACCABCCCCBCBCAACCACCBCCCBCCBABBBABACAACACBCBAAACBCAABBABBCBAABCCABAAAAAACCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBCCBAAABBBCAAABAACABCABBCAAACACCAABCBACABCBBBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAACAAAABBBABAABCABBBCACACCABCCCCBCBCAACCACCBCCCBCCBABBBABACAACACBCBAAACBCAABBABBCBAABCCABAAAAAACCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBCCBAAABBBCAAABAACABCABBCAAACACCAABCBACABCBBBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAACCBCBAABCCACCCBACBAABCCABBBCACACABBABBBABACBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBCCBAAABBBCAAABAACABCABBCAAACACCAABCBACABCBBBCCC.exe" start= auto displayName= "UserDataSvc_ABAACCBCBAABCCACCCBACBAABCCABBBCACACABBABBBABACBAAA"
  2⤵
  PID:3452
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAACCBCBAABCCACCCBACBAABCCABBBCACACABBABBBABACBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBCCBAAABBBCAAABAACABCABBCAAACACCAABCBACABCBBBCCC.exe" start= auto displayName= "UserDataSvc_ABAACCBCBAABCCACCCBACBAABCCABBBCACACABBABBBABACBAAA"
    3⤵
    - Launches sc.exe
    PID:2324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAACCBCBAABCCACCCBACBAABCCABBBCACACABBABBBABACBAAA"
  2⤵
  PID:888
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAACCBCBAABCCACCCBACBAABCCABBBCACACABBABBBABACBAAA"
    3⤵
    - Launches sc.exe
    PID:3388

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCABCAABCCBCBAACCBBCBCCBCCCBBBCABACCCBBBABACBABCCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCABCAABCCBCBAACCBBCBCCBCCCBBBCABACCCBBBABACBABCCBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAACBABCBBCBBBABACABBACCCCCABBCBBCCBABACACCABABBCBABCCCAABCCACACBCBBBBBAACBAACCCBAABCAACBCABCBACBACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBBACAACACABBBAABAACCACCBCAAACCABACBBCCACBACCBCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1796
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAACBABCBBCBBBABACABBACCCCCABBCBBCCBABACACCABABBCBABCCCAABCCACACBCBBBBBAACBAACCCBAABCAACBCABCBACBACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBBACAACACABBBAABAACCACCBCAAACCABACBBCCACBACCBCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCACBACAACCBCCBBBBCBBBBBABBCCBBCABBABACBCBABCCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBBACAACACABBBAABAACCACCBCAAACCABACBBCCACBACCBCCCBA.exe" start= auto displayName= "UserDataSvc_BACCACBACAACCBCCBBBBCBBBBBABBCCBBCABBABACBCBABCCBAA"
  2⤵
  PID:3008
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCACBACAACCBCCBBBBCBBBBBABBCCBBCABBABACBCBABCCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBBACAACACABBBAABAACCACCBCAAACCABACBBCCACBACCBCCCBA.exe" start= auto displayName= "UserDataSvc_BACCACBACAACCBCCBBBBCBBBBBABBCCBBCABBABACBCBABCCBAA"
    3⤵
    - Launches sc.exe
    PID:4388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCACBACAACCBCCBBBBCBBBBBABBCCBBCABBABACBCBABCCBAA"
  2⤵
  PID:4592
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCACBACAACCBCCBBBBCBBBBBABBCCBBCABBABACBCBABCCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:748

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCAACCBBCACABBBCCAABCBAAACABBBBBBCACBABBCBACBBCBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCAACCBBCACABBBCCAABCBAAACABBBBBBCACBABBCBACBBCBBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCBCCBCCBAABCAACACCBCCBBABCAABBBCABCBAACCCAACBBBCCACABBCBAAAABCCCCBBAAAACBCCBACAABBAACACCBACCBACCCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBCACACBCCCBBABBACBABBBAAABACBACCCCACBAABCCCABBBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCBCCBCCBAABCAACACCBCCBBABCAABBBCABCBAACCCAACBBBCCACABBCBAAAABCCCCBBAAAACBCCBACAABBAACACCBACCBACCCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBCACACBCCCBBABBACBABBBAAABACBACCCCACBAABCCCABBBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCBCABBAABCBCBACCABABBBCACBBABBBACAABACCCBBAAABACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBCACACBCCCBBABBACBABBBAAABACBACCCCACBAABCCCABBBBBB.exe" start= auto displayName= "UserDataSvc_CCCBCABBAABCBCBACCABABBBCACBBABBBACAABACCCBBAAABACA"
  2⤵
  PID:4904
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCBCABBAABCBCBACCABABBBCACBBABBBACAABACCCBBAAABACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBCACACBCCCBBABBACBABBBAAABACBACCCCACBAABCCCABBBBBB.exe" start= auto displayName= "UserDataSvc_CCCBCABBAABCBCBACCABABBBCACBBABBBACAABACCCBBAAABACA"
    3⤵
    - Launches sc.exe
    PID:4588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCBCABBAABCBCBACCABABBBCACBBABBBACAABACCCBBAAABACA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1192
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCBCABBAABCBCBACCABABBBCACBBABBBACAABACCCBBAAABACA"
    3⤵
    - Launches sc.exe
    PID:1132

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBBACCCCABBABBCCCCBBBBBCBBCACBBBACCCCBCCAAABCAABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBBACCCCABBABBCCCCBBBBBCBBCACBBBACCCCBCCAAABCAABCBC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBABCCCCCCCACCCABBCCCBBBCCBACBACCCBBCCCCBABABAABACCAAACAABACACCBCCBCBBCACBCCBAABCCACCCCCBAABABCAABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBAAACCBABCBCCCABCCABACCCBBABACCBABCABBCABCCCABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBABCCCCCCCACCCABBCCCBBBCCBACBACCCBBCCCCBABABAABACCAAACAABACACCBCCBCBBCACBCCBAABCCACCCCCBAABABCAABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBAAACCBABCBCCCABCCABACCCBBABACCBABCABBCABCCCABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABABCCCAABAACCABBCACCACBBBCCCABABBCCBCCBAAABABCAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBAAACCBABCBCCCABCCABACCCBBABACCBABCABBCABCCCABAAA.exe" start= auto displayName= "UserDataSvc_ABABCCCAABAACCABBCACCACBBBCCCABABBCCBCCBAAABABCAACB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4868
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABABCCCAABAACCABBCACCACBBBCCCABABBCCBCCBAAABABCAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBAAACCBABCBCCCABCCABACCCBBABACCBABCABBCABCCCABAAA.exe" start= auto displayName= "UserDataSvc_ABABCCCAABAACCABBCACCACBBBCCCABABBCCBCCBAAABABCAACB"
    3⤵
    - Launches sc.exe
    PID:748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABABCCCAABAACCABBCACCACBBBCCCABABBCCBCCBAAABABCAACB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:724
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABABCCCAABAACCABBCACCACBBBCCCABABBCCBCCBAAABABCAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3624

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCCCCAABCABACABCABCACBBACAAAABBCBABACABCAACCAABBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCCCCAABCABACABCABCACBBACAAAABBCBABACABCAACCAABBACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAAABCCAABCACCACBCCBACCACBACACBBABBCCCAAAABCACCAABABBCABACCAAABBCCCCBAAACBCCACBBCBBBCBABBABBABCBAAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABABBCBCCACBABBBCABAAACBBBAAAABABCBCBCABBAABBCAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAAABCCAABCACCACBCCBACCACBACACBBABBCCCAAAABCACCAABABBCABACCAAABBCCCCBAAACBCCACBBCBBBCBABBABBABCBAAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABABBCBCCACBABBBCABAAACBBBAAAABABCBCBCABBAABBCAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAAAACBCBAAAABABAABBAABBACBABACCBABCACABBBBBCCBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABABBCBCCACBABBBCABAAACBBBAAAABABCBCBCABBAABBCAABCA.exe" start= auto displayName= "UserDataSvc_ABAAAACBCBAAAABABAABBAABBACBABACCBABCACABBBBBCCBABA"
  2⤵
  PID:1852
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAAAACBCBAAAABABAABBAABBACBABACCBABCACABBBBBCCBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABABBCBCCACBABBBCABAAACBBBAAAABABCBCBCABBAABBCAABCA.exe" start= auto displayName= "UserDataSvc_ABAAAACBCBAAAABABAABBAABBACBABACCBABCACABBBBBCCBABA"
    3⤵
    - Launches sc.exe
    PID:2264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAAAACBCBAAAABABAABBAABBACBABACCBABCACABBBBBCCBABA"
  2⤵
  PID:1876
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAAAACBCBAAAABABAABBAABBACBABACCBABCACABBBBBCCBABA"
    3⤵
    - Launches sc.exe
    PID:4804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBAAACCBABCBCCCABCCABACCCBBABACCBABCABBCABCCCABAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBAAACCBABCBCCCABCCABACCCBBABACCBABCABBCABCCCABAAA.exe
1⤵
- Executes dropped EXE
PID:1156

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABABBCBCCACBABBBCABAAACBBBAAAABABCBCBCABBAABBCAABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABABBCBCCACBABBBCABAAACBBBAAAABABCBCBCABBAABBCAABCA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCACBAACAACCBAACCCACCBAABABBBCCCBBABCCBACCBCACACAABBABCBCCBBCAAACBBAABCBBBBCCABCABCBCBABAAAABBBCACAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBACBBABCBCBBCACCBBBBBACCCABAABBABACACAABAAABABBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCACBAACAACCBAACCCACCBAABABBBCCCBBABCCBACCBCACACAABBABCBCCBBCAAACBBAABCBBBBCCABCABCBCBABAAAABBBCACAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBACBBABCBCBBCACCBBBBBACCCABAABBABACACAABAAABABBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACABCCCAACCAACBCCAAABBCBBAACCBCACCBAAACBAABAACBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBACBBABCBCBBCACCBBBBBACCCABAABBABACACAABAAABABBCA.exe" start= auto displayName= "UserDataSvc_BACABCCCAACCAACBCCAAABBCBBAACCBCACCBAAACBAABAACBBBC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1340
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACABCCCAACCAACBCCAAABBCBBAACCBCACCBAAACBAABAACBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBACBBABCBCBBCACCBBBBBACCCABAABBABACACAABAAABABBCA.exe" start= auto displayName= "UserDataSvc_BACABCCCAACCAACBCCAAABBCBBAACCBCACCBAAACBAABAACBBBC"
    3⤵
    - Launches sc.exe
    PID:4492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACABCCCAACCAACBCCAAABBCBBAACCBCACCBAAACBAABAACBBBC"
  2⤵
  PID:2444
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACABCCCAACCAACBCCAAABBCBBAACCBCACCBAAACBAABAACBBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4532

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBCCBAAABBBCAAABAACABCABBCAAACACCAABCBACABCBBBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBCCBAAABBBCAAABAACABCABBCAAACACCAABCBACABCBBBCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCAABABACBACBAAABABCACBBBBBBCCBBBCCBBBCBBBBACACACCACCACBBBAAABCCBCACAAACBCBBAACCBCACBCACBCAAABACBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCBBABAAABCBAABBBBAABAAAACBABCAABCABACABABBCBCBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4852
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCAABABACBACBAAABABCACBBBBBBCCBBBCCBBBCBBBBACACACCACCACBBBAAABCCBCACAAACBCBBAACCBCACBCACBCAAABACBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCBBABAAABCBAABBBBAABAAAACBABCAABCABACABABBCBCBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACBBACCBCCCAABACBCBBAACAABBABCBBBAACCCBAABCAAACABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCBBABAAABCBAABBBBAABAAAACBABCAABCABACABABBCBCBACA.exe" start= auto displayName= "UserDataSvc_AACBBACCBCCCAABACBCBBAACAABBABCBBBAACCCBAABCAAACABA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1036
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACBBACCBCCCAABACBCBBAACAABBABCBBBAACCCBAABCAAACABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCBBABAAABCBAABBBBAABAAAACBABCAABCABACABABBCBCBACA.exe" start= auto displayName= "UserDataSvc_AACBBACCBCCCAABACBCBBAACAABBABCBBBAACCCBAABCAAACABA"
    3⤵
    - Launches sc.exe
    PID:4020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACBBACCBCCCAABACBCBBAACAABBABCBBBAACCCBAABCAAACABA"
  2⤵
  PID:3768
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACBBACCBCCCAABACBCBBAACAABBABCBBBAACCCBAABCAAACABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2404

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBBACAACACABBBAABAACCACCBCAAACCABACBBCCACBACCBCCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBBACAACACABBBAABAACCACCBCAAACCABACBBCCACBACCBCCCBA.exe
1⤵
- Executes dropped EXE
PID:3944

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBACBBABCBCBBCACCBBBBBACCCABAABBABACACAABAAABABBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBACBBABCBCBBCACCBBBBBACCCABAABBABACACAABAAABABBCA.exe
1⤵
- Executes dropped EXE
PID:1204

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCABBCBACCBACBAACACABCBBACCBCBBAABCABCCBAAAAABCCAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCABBCBACCBACBAACACABCBBACCBCBBAABCABCCBAAAAABCCAAB.exe
1⤵
- Executes dropped EXE
PID:4372

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBCACACBCCCBBABBACBABBBAAABACBACCCCACBAABCCCABBBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBCACACBCCCBBABBACBABBBAAABACBACCCCACBAABCCCABBBBBB.exe
1⤵
- Executes dropped EXE
PID:4788

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCBBABAAABCBAABBBBAABAAAACBABCAABCABACABABBCBCBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCBBABAAABCBAABBBBAABAAAACBABCAABCABACABABBCBCBACA.exe
1⤵
- Executes dropped EXE
PID:3324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

virus_log.txt

Path C:\Users\Admin\AppData\Local\Temp\virus_log.txt
Size 1KB
SHA256 2120c21b68a87a01e5fb521d65fe9df2be817c9b0b3dabe1a31ea04665640575
MD5 c7202282af0152b1e79c462c49f4587f
SHA1 8665ab9b1916972296ad77b3493c6848efb0b9de
SHA512 9ce70423b1f84b1a62f8a9e1169dbb55491fec64f2d9f97098a7a7cf40b84c3b516226af2b426017fd426feb3eb5d519b27a72f71d1c4ecb94710cfff665cd59
TLSH
T157412906D0B9A8BBB021549BD63DEE89C8D4F75B6C846744930C8715B780D3AEE668D1
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6b0f4cd08fe6d5be10a49935a74e339b8dd9967325ddae2b4eb96d957e269967
MD5 7612f5fbc5f385be3ab035fb5417f926
SHA1 8c0142e9b27a23d382a3ed0153514542996c1a8d
SHA512 a820cef5a171ea42b9dbe8a22040d2414689deba688261dd7d22409031d08364c61853cb6f46410f4702f3d8f7178949169b1dd7455c06a194b548c94a7ddeb4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0a6d1b3f83eac6f59412773b0e3d6f5173f5b63a445f7ac78cb7de9e74ce8181
MD5 f134700e22ac13bc17c4f84635592138
SHA1 4d633e6e9310a19e3598250eafc280c549284cb5
SHA512 31d2be3d19a7effe475d2947cad90745bff47e6d344fde2306ee992eb4d52f04cd0023ef53053c73a9551c550127977f95b0820acbc6cbb854bbb67a76eca66e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c7e5a68e58c051f2a0152123d158b282fa67ef7cd63d71419c607125fc0b4c76
MD5 c14eedae936780522529675d773c4747
SHA1 7b89b01377576270166406e07af36b18e71973de
SHA512 82bb2e4b82eb725d6b333091668184178b1a8eaeace811d1a192e46659ef30c24036adbbe84fb359e3bc44c492a696e147f5ecbd62eea557ac0ae5232e7aa66c
MD5 SHA1 SHA512

Submit Download

svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCCABCACBBCCCBABBBBCCACABBCCACBAAACAACCCCCCBCBBBCCA.exe
Size 45.6MB
SHA256 893ccac4360b51d08b2c230fa9aa6dd44b32e69c9add35ff553e29a0ca4cd594
MD5 78e4e6ec4b1ad84ec6791c5810bf5438
SHA1 7b46a0b5ef46868ae902548740e418f78ab99d0b
SHA512 ed1a45613c1927afe8534f4c94a17b4ae90fa1fa77e67290d43f8c72a1204fd3648a9e65ccef9b982bf7515788caeb9c15b252375d75c68ff3dcebbc73454710
SSDEEP 786432:oymbqv8l2r2H2cSDXQLcd2BWuFBKLAyomzeXqhb/UYE6uk5jzZ1spR2qsPHeuDDc:bQ72CWcxLcdaDy7zlhDUmOR/EHzwSMwA
TLSH
T134A7331DF2B600DED123607C885AD23AE339BDC55B95C6CB9A198D073F637E0DCA6246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 81a09c6a82ab66c51a429cde5f2663f1718bf85460d418ac223981d962eb4221
MD5 f972373b950832f9901ed94dbbba01fd
SHA1 522ce9c02a213c841db02f7a5f591769ffe55859
SHA512 fdde6518bfa3fd0905b72b7ac17601e3b1590c3f812fdfcdb2556e4b97b357244ccf4e8c94dcb67d9e8ffc66c3177be1cbf2aa71ee14b0c08ef426f4b41dcf7c
SSDEEP 96:oSeTiWt14WkAb4kAu3uED9k+wzFKOFQi60s14fA6S4A6/03Myf+D3MkwUr+zkAPs:JeeWt+ZAvAWVhkXFKOFVzs+1rs8yf68k
TLSH
T18391C125E065DCB3F23258DBD63CD9C28DE8B39FAC8C9A04630D4318A7D5936DD198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 4ed5e7ff81e0848b25475c0e787d05fd2d00235e77970857a8c9b28de14f0c8e
MD5 232fcd218d86579b6f0601df860d3b97
SHA1 3e7fd48610fa666f8c6fcb96d7ede8c081506fc1
SHA512 102d50fc42165aadee63232110c90fb3ef73fcb7f1ee76748cb4049d324d52a73321e5b26924cd0ab77c4544ff2352b525dc873e2f65a8dbb66b0a34c6192275
SSDEEP 96:oSeTiWt14WkAb4kAu3uED9k+wzFKOFQi60s14fA6S4A6/03Myf+D3MkwUr+zkAPb:JeeWt+ZAvAWVhkXFKOFVzs+1rs8yf68z
TLSH
T1B7A1B324E065DCB3F23258DBD63DD9D28CE8B39FAC8C9B04630D4318A795936DD198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 d2ed69595e8926397a3747a596c8267fb10c6f21377f01ef1d60aa82ba459d43
MD5 6c7b02925e64504457f8f404ba8116f5
SHA1 ba97ec7971bff942aeb95e1386b77cb1b71611fe
SHA512 552b703c3c7ac6064a4c89eb684f8fffc40cffc96aceb09686578ef0f1c2d90d22d697a1e8ba30b41385e9e0de19f034382e6d680e9bf28d66e4b95924b36a15
SSDEEP 192:JeeWt+ZAvAWVhkXFKOFVzs+1rs8yf68kw4+AAPo+ZP9e4ief883UVq+oOTU0bua5:nae1KL8u6892tI89vb9abm
TLSH
T1BED1D425E065DCB3F23268DBD23DD9D28DE8B39FA88C9B04630D4318A795936DD1D8E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 ea2ead571d2072f105cb56290b5ee328a2aa3032b71864fea42f63d259cd02fc
MD5 d8961fc137c921b22ee6a3735098d894
SHA1 361718d14bb927cf455ce66a2ffb981b782af1c9
SHA512 b6069b504aece9a5e0bb6d5e774bf397a3abc8d08d6cf0ffa14b4ecf3fd10580cfc48a31c354a239beb180209cc5010e4b40778915cf6b9a43198c873b7cf98d
SSDEEP 192:JeeWt+ZAvAWVhkXFKOFVzs+1rs8yf68kw4+AAPo+ZP9e4ief883UVq+oOTU0buaP:nae1KL8u6892tI89vb9abB0GQxo0
TLSH
T1BDE1D425E065DCB3F23268DBD63DD9D28DE8B39F988C9B04630D4318A795836DE198D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 8KB
SHA256 55ccaef19f8204be81806b7c1e068d12ae7e8f33e72c775e0c71e3fdab18049f
MD5 960eb0d05e4eb1327d65157f0714657f
SHA1 c35e513d7420f6fc4fd5dcbee91b84cdbbc1b5f1
SHA512 ae66085e245aeb5d8a784834443886d6484699caa7d58cf9e3b16f8694dcd83bcaa5cd5faf78eb228531a15d996d58e2707fb7ed5f1f4e3df7df80f9bbe8aea2
SSDEEP 192:JeeWt+ZAvAWVhkXFKOFVzs+1rs8yf68kw4+AAPo+ZP9e4ief883UVq+oOTU0bua0:nae1KL8u6892tI89vb9abB0GQxogoH
TLSH
T11502C425E065D8B3F23268DBD63DD9D28DE4B39F9C8C9B04630D4318A795836DE1D8E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 8KB
SHA256 1e831cca901f0264cea9477067dbb6274e1552c05be61f967467f64dd2c57acb
MD5 a6cedeecbef8fd9cf4ab29fa050e8bc4
SHA1 19c136a1824504cd429773da8a314de6abe11858
SHA512 3d5e8934a35864d0017c914fd7b108f3e6278ed9193f3aa6a18979cffdfa839d13ddf5bbff9ed56d6d2020329bc48c1583e1fdfbb661728627994044cbf8682a
SSDEEP 192:JeeWt+ZAvAWVhkXFKOFVzs+1rs8yf68kw4+AAPo+ZP9e4ief883UVq+oOTU0buaa:nae1KL8u6892tI89vb9abB0GQxogobV
TLSH
T15A02B525E0A5D8B3F23268DBD63DDAD28DE4B39F9C8C9B04630D4318A795836DE198D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 8KB
SHA256 f5acbdb21ac7cd3f50ab690bc22690192881d0f55445db778701be81c9a12462
MD5 c4c4e52c60d5cb07a8d65c5d6d332648
SHA1 3dbba34480402cb118702258de6aef00d64cc37b
SHA512 0481f003df728f50e2dffcbc84bda6d97bbcf72d926d47726c2105769ea7bd7c60e70feb45632b6533a81c375e5ab741a120ef2492b9bcfd8a0bd1350a47265f
SSDEEP 192:JeeWt+ZAvAWVhkXFKOFVzs+1rs8yf68kw4+AAPo+ZP9e4ief883UVq+oOTU0bua4:nae1KL8u6892tI89vb9abB0GQxogoba6
TLSH
T18D12B425E0A5DCB3F23258DBD63DDAD28DE4B39F9C8C9B04630D4318A795836DE198D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 8e25d7b08876374767ca4a09dcc75fc80dead97374321596272175ca763e4287
MD5 0711980c5e05574c395b4867560ea516
SHA1 b127cd8e370344d3b3f8441813f6403bcfce79db
SHA512 97b081c470340fd44616e799f9b615ddc76e6c3c7b566ef2e2a56156c7ffd73ac3dd5230e345c70a3054e58355491d4d41a0acad18aaaa25341cc429c7014250
SSDEEP 192:JeeWt+ZAvAWVhkXFKOFVzs+1rs8yf68kw4+AAPo+ZP9e4ief883UVq+oOTU0buaY:nae1KL8u6892tI89vb9abB0GQxogobaG
TLSH
T1F512F625E0A5DCB3F23258DBD63DDAD28CE4B39F9C8C9B04630D4319A795836DE198D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 10KB
SHA256 25aa3ce0c21816fd9f0d5baf474b45dd29fbd0af8986b32d5fb7d3f25fbb3d01
MD5 a981055ad25bc54ae49194111f42670e
SHA1 3564ac857695fc815f34fd95313e0f5db815afa5
SHA512 869dcb421ed0ad562e2802def933aceeef136229cb948ccd0a10d6e4fd4e590ec52c81f434ad7919c7bdf9847e9f4f40e78acf886cef0bea1b272acbce21d237
SSDEEP 192:JeeWt+ZAvAWVhkXFKOFVzs+1rs8yf68kw4+AAPo+ZP9e4ief883UVq+oOTU0buaY:nae1KL8u6892tI89vb9abB0GQxogobaW
TLSH
T10D320725E0A5DCB3F13258DBD63DDAD28CE4B39F9C889B08530D4319B795836DE198D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 10KB
SHA256 8212ee5d8d657859c04ee61d13c01f4f29abffe51ca600ff356ee44733cfae96
MD5 09c399e112112348811708e2eea75d7f
SHA1 71b45fab127630428282e58427890f28fe6dd46a
SHA512 1b2e9866659fc36e6f085373abdcb19f7847409676cc58bbd687392a021de76f72eaa085a7a7a1c98e80497fee787a7c01b4a5c2b8e79124a4a998f90ca8c205
SSDEEP 192:JeeWt+ZAvAWVhkXFKOFVzs+1rs8yf68kw4+AAPo+ZP9e4ief883UVq+oOTU0buah:nae1KL8u6892tI89vb9abB0GQxogobaj
TLSH
T153320625E0A5DCB3F13258DBD63DDAD28CE4B39B9C8C9B08630D4319B795836DE198D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 10KB
SHA256 3d549478a2b601c7730c69c13f772f92cc493016b288c49949208988c7c934d1
MD5 40f999dbc0effdf983665540b55b4859
SHA1 c63379762d85a7a2bfd01b9b7f23ef878b1f27a6
SHA512 93457d9c2620ae48934c13d5a93695a943c6a0923a3a9dfbd17d1a457063982b614e46c7dad7df313c56d5122b039449dfc45c883aa064696383d1b135b3af69
SSDEEP 192:JeeWt+ZAvAWVhkXFKOFVzs+1rs8yf68kw4+AAPo+ZP9e4ief883UVq+oOTU0buaK:nae1KL8u6892tI89vb9abB0GQxogobag
TLSH
T110320625E0A5DCB3F12258DBD63DDAD28CE4B39F9C8C9B08530D4319BB95836DE198D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 11KB
SHA256 6af2eb1c1f034a962fa092b677945f290b3e27bbd953ff4f16c0234bd4f06710
MD5 455f10865591098e83b8cf1361ae7a7e
SHA1 e92a9777d75dc5756552ecdd15e7ad4d1445e6a9
SHA512 e790b6fb43c0ebdc1f64741925c7948920b483a179f88f756ffcd1e87dfddabfc9d270418809196b23e99cb880861de8f058fa48c110e71a8a10a3b333f23425
SSDEEP 192:JeeWt+ZAvAWVhkXFKOFVzs+1rs8yf68kw4+AAPo+ZP9e4ief883UVq+oOTU0buaL:nae1KL8u6892tI89vb9abB0GQxogoba1
TLSH
T18632F725E0A5DCB3F13268DBD63DDAD28CE4B39F9C889B08530D4319B795836DE198D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 dbeb9d25b80ffeafe6c04c21b470edb1495e2fe872e3ac068db45310cf792d8f
MD5 d413cbc8c717a332e45addb192c90d9e
SHA1 fa738dc8c0ef98a9128afd9600132316119b1d7d
SHA512 d6c6572c6ce4099c4c7fe1b476bcc310bdb04d0701e88dc96e3547b55ab0f72e881109f38d51ba1387b850d900a5ddce6a35e09f31d5d51bd13bd92989e026c2
SSDEEP 384:nae1KL8u6892tI89vb9abB0GQxogobatjLfu5vC:naecL8u68Atb9vbk9aoWtXkq
TLSH
T1E6421725E0A5DCB3F13268DBD63DDAD1CCE4B39BAC889B08530D4319B795836DE198D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 13KB
SHA256 350ea34d0caeea6bcee355f849675d7e60dcb980eb8f6c379d554dbb7d131e0b
MD5 7022a12b343d377d9268dec4d6ea3eff
SHA1 3edff868b0025fcc3324bed4479e755e2cb6220e
SHA512 5fd3326443e7767a71e33a08691dcd4c4e4da666bdf6c0f47f0cdc748ceda227a9ee74c47a61465001fea0e32e0acbd87b706378b19ba1809e9ffd71c1208ff7
SSDEEP 384:nae1KL8u6892tI89vb9abB0GQxogobatjLfu5vItp:naecL8u68Atb9vbk9aoWtXkgtp
TLSH
T15152F725E0A5DCB3F22268DBD63DDAD1CCE4B39FAC889B04530D4319B795836DE198D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 13KB
SHA256 3cffdbb3dbcc91e5b030c8c1a8c269a4f733e1272553431e295be9c2bb824e3b
MD5 ca3e642d4740838f4c42e03489d4f1ba
SHA1 b9280d6fa220e865c3c9997137a703504495f63b
SHA512 699bd62aabc3e3fbef4f2d08e5867e0fe46acdefb23f0a1307d6c05f77a7d7987d4c982ee770d8254351c4253e3f741640b56fb5f73cb48594d1cc8aed679a54
SSDEEP 384:nae1KL8u6892tI89vb9abB0GQxogobatjLfu5vIte:naecL8u68Atb9vbk9aoWtXkgte
TLSH
T1C7520725E0A5DCB3F22268DBD63DDAD18CE4B39FAC889B04530D4319B795836DE198D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 13KB
SHA256 f6a4c82ccd7a9164d54e46a17990a6f0251f8a763e21b3342186947d41a48d8c
MD5 8e70ce661c7e8a81a2545fdbbe67d100
SHA1 f6a2d2f24216f681eca843fe667fe0dbd74e1078
SHA512 f96f0fcd1e43aedc3d7f18709dd651cd63760d3af143b9f1cd29f43e525dfd5a31c0111bc81a1d7c680e82fe0a3a58cfce1b814523a25536d350cadfaf678013
SSDEEP 384:nae1KL8u6892tI89vb9abB0GQxogobatjLfu5vItVc:naecL8u68Atb9vbk9aoWtXkgtVc
TLSH
T103520725E0A5DCB3F22268DBD63DDAD1CCE4B39FAC889B04530D4319B795836DE198D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 13KB
SHA256 6c68d2bdc448a0b135dec3e696fdc37f236ce1b47628fa564867315ee4c122b9
MD5 452f24ce6fb65b8e64d9dba1eadcdd56
SHA1 9d17521b292994de077eced31673761a9c3556dd
SHA512 befcee16d4db4c1b2c34f6236c56daee5c06c1b28b4628645c6e1d90474516a6c28cae8c88a5074005ef0000b7994a6b983787e7458e02fc1b5069b69b19f1a0
SSDEEP 384:nae1KL8u6892tI89vb9abB0GQxogobatjLfu5vItVPpl:naecL8u68Atb9vbk9aoWtXkgtVPpl
TLSH
T1FC520625E0A5DCB3F23268DBD63DDAD18CE4B39FAC889B04530D4319B795836DE198D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 240b152a4e8655422ad0d8ccdab8880b9916f68256288837c7202856e18c59db
MD5 51057fb77eba704139fc826625d5ae8a
SHA1 46fd97f4ce340bbde09b95408d1ddaf1c108f908
SHA512 ba48c1c2fcdefe82eecb605682e68411b5f9ce3734722506c338e2f04be83d534bdcf2ae577b6f9ff9f635e8305444b5cbfa945faaa455a7f923ce49fa1e0fd2
SSDEEP 384:nae1KL8u6892tI89vb9abB0GQxogobatjLfu5vItVPp8ZH/:naecL8u68Atb9vbk9aoWtXkgtVPp8/
TLSH
T1C1521725E0A5DCB3F22268DBD63DDAD18CE4B39FAC8C9B04530D4319B795836DE198D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 8cd52cedb1a90c29febd9f91b4ca9c4b87422552bc252418bf6ab708dae8fd14
MD5 cd07997e89ced4a1d5134c8e59f6d0ec
SHA1 19dbf265fc57e62bdc2bb4b51ddf6067012c22bf
SHA512 1a7c90d00020484661e5bd97265311be535aa76a23e40ce623857c82322c46067c6087fa96e0fd4c0d4c3c59b5f7ff13890b40e75ed7cbf6269066fbd59f5ff9
SSDEEP 384:nae1KL8u6892tI89vb9abB0GQxogobatjLfu5vItVPp8ZH32:naecL8u68Atb9vbk9aoWtXkgtVPp832
TLSH
T1B0620725E0A5DCB3F22268DBD63DDAD18CE4B39FAC8C9B04530D4319B795836DE198D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 15KB
SHA256 3b4fcc560acd6eb49581f0237ad2861267158adc906847f5fe8d5c8e9aba6a14
MD5 a93f38bb3c6dcbed2d5583a03565f51d
SHA1 cfb36aad504e2457bf8f3b25f00c6d9e8e5285e5
SHA512 2c2658c7581d0c2d2e7213c826eb6c598b8d71c5e21aaf1e7bcdac4a72847a256a0325c86ab17516e4a537d2b2970ee54c8e1b5b5baca9f61ea85ebbda10d863
SSDEEP 384:nae1KL8u6892tI89vb9abB0GQxogobatjLfu5vItVPp8ZH32K:naecL8u68Atb9vbk9aoWtXkgtVPp832K
TLSH
T1C9620925E0A5DCB3F22268DBD63DDAD18CE4B39FAC8C9B04530D8319B795836DE198D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 16KB
SHA256 d0ce4f21c04459d7cf1952e4fe578feb1c7d3d6f65396baa73b522cfecdeb790
MD5 046c6ae3f01ab7eaf18673bbd29b5303
SHA1 2238182e63527c7cb673fa11e7771007fac73503
SHA512 bee414d087dcb1a5da046b4dba0f900e4c044edca6892be5273b9eb810598e8b759ccfff028aee2ecbc004c8be8095f34fdb6f706afd34194240cf6d2935610c
SSDEEP 384:nae1KL8u6892tI89vb9abB0GQxogobatjLfu5vItVPp8ZH325/L:naecL8u68Atb9vbk9aoWtXkgtVPp832h
TLSH
T1F5721825E0A5DCB3F23268DBD62DDAD18CE4B39FAC8C9B04530D8319B795836DE198D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 16KB
SHA256 92872e8ecb211e44a023cf5b00070795565e8ca1640fafc301b2bd5b3b177796
MD5 f6104dc5c24c97c00ecf17742d28dc84
SHA1 c475e1ce4d4eaf74e0b3828e0804636d525af0d9
SHA512 fb1b7f710d5f4076bf8ecf2743e67b3e374104154fae924bba59ea6876678b0458ac21d7a95a1cea2948830eed21bd1f6ff217586a31b9a97504ae6d0ccf155d
SSDEEP 384:nae1KL8u6892tI89vb9abB0GQxogobatjLfu5vItVPp8ZH325/SB:naecL8u68Atb9vbk9aoWtXkgtVPp832W
TLSH
T1D4721725E0A5DCB3F23268DBD62DDAD18CE4B39FAC8C9B04530D8319B795836DE198D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 16KB
SHA256 ce312c5ddaf9e4c91fabbe4f40696ae6c79e0c00c7887134aac31e0091e41b6b
MD5 6778e717dfb6187d2a572c92ab4312c3
SHA1 04bebab5de40c4af2ce29405d00089898fe28a71
SHA512 fcdb5ca4f128a6b599a837c569c397823dcd5b5d06e5e122cb1d7926efdc959cda1d51baaafa9f69982990e785d5126687234d924659017cb0f014f3e7ab04b0
SSDEEP 384:nae1KL8u6892tI89vb9abB0GQxogobatjLfu5vItVPp8ZH325/SA:naecL8u68Atb9vbk9aoWtXkgtVPp832Z
TLSH
T13B721825E0A5DCB3F23268DBD62DDAD18CE4B39FAC8C9B04530D8319B795836DE198D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 3c3a302621ca40551efb5b033126965abe76cff75613eed0a8c42d9d78c9ec78
MD5 67cb3f580151c8bd13f855121cc49877
SHA1 bd28599cd611854edd7cc530fe511c37458639ee
SHA512 ad7b514124fade7ca00ddedda4d1bfb906d6b4eb0ffa7ba4474d03629eb2a9fe6b0ad1c7240cce794a520bbb730164a3d1229b3667313ecbb1e83cdc1bd27971
TLSH
T121210625D0359CB3F22258AAD52DD9828DE4B37FAC8C9B05630D4719B794C3ADE1D8E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 0bb8178d151a30f2301b114e68c8134c46fd8090900fd44aa122be97df87f77c
MD5 d8fab0b57a15b800d33fc70a0731bbe5
SHA1 fc31b84329201f6e4d3c90314630c00d66177462
SHA512 59e92d47619b56fb7cfe77761c547786b5cd68e5d328171c51a08c27a7f4ab4b8572b00acf18fd72f8f51a87ad558da035313cbbcd81b02ce74a8777d55be35c
TLSH
T15251B525D065DCB3F232589AD62DD982CDE8B3AFAC8C9A04630D4719A7D4C36DD1D8E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 9d74db4a405c5a3d31628c2b6502c69aea3eeee8a4547390bb48f66587bf4135
MD5 1b8aba8bb13b05a6b5ed3c53e8a3f04a
SHA1 f2d2236b36b087e9ba528cb9e3bc6254885c8b92
SHA512 64ade43246f8c9c7038eb6c9124dd86e87d325700c3b3a95b35bb538f8ae4fe06f97081c277386baaa6d053bec729eae7c342713b5767d2c123ebac029f2b897
TLSH
T19861A425D035DCB3F232689BD62DD9C28DE4B39FA88C9B04630D4319A795D36DD1D8E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 f134587ab6171bd52bdf4e2d055828338895743811cd54075128f2bad4b052ee
MD5 ba2c0e7bd894a8f7782e029ef8001ad0
SHA1 7cde959c5108cb622698b5df17402f3fcc7ff5b1
SHA512 9b01d253cca173722de5cc3faeb85a4d9300c407a3e72467b104780a76c0fa5e87cd07da7a4edcc82292d4c3fa441025a0d509de379a5feeb6695979d5b4a0fd
TLSH
T170719225E025DCB3F232589BD62DD9C28DE8B39FA88C9A04630D4319A7D5D36DD1D8E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/976-159-0x00000000000B0000-0x00000000000D2000-memory.dmp

Download

memory/976-297-0x00000000000B0000-0x00000000000D2000-memory.dmp

Download

memory/1156-498-0x0000000000D70000-0x0000000000D92000-memory.dmp

Download

memory/1160-389-0x00000000006F0000-0x0000000000712000-memory.dmp

Download

memory/1160-317-0x00000000006F0000-0x0000000000712000-memory.dmp

Download

memory/1196-547-0x0000000000100000-0x0000000000122000-memory.dmp

Download

memory/1372-446-0x0000000000550000-0x0000000000572000-memory.dmp

Download

memory/1416-453-0x00000000000C0000-0x00000000000E2000-memory.dmp

Download

memory/1700-50-0x00000000004C0000-0x00000000004E2000-memory.dmp

Download

memory/1700-19-0x00000000004C0000-0x00000000004E2000-memory.dmp

Download

memory/1748-53-0x00000000004C0000-0x00000000004E2000-memory.dmp

Download

memory/1748-17-0x00000000004C0000-0x00000000004E2000-memory.dmp

Download

memory/1804-384-0x00000000006F0000-0x0000000000712000-memory.dmp

Download

memory/1804-511-0x00000000006F0000-0x0000000000712000-memory.dmp

Download

memory/1904-481-0x0000000000A10000-0x0000000000A32000-memory.dmp

Download

memory/1904-413-0x0000000000A10000-0x0000000000A32000-memory.dmp

Download

memory/1976-117-0x00000000002B0000-0x00000000002D2000-memory.dmp

Download

memory/2024-414-0x0000000000A10000-0x0000000000A32000-memory.dmp

Download

memory/2024-482-0x0000000000A10000-0x0000000000A32000-memory.dmp

Download

memory/2108-187-0x0000000000120000-0x0000000000142000-memory.dmp

Download

memory/2108-137-0x0000000000120000-0x0000000000142000-memory.dmp

Download

memory/2624-278-0x0000000000E70000-0x0000000000E92000-memory.dmp

Download

memory/2780-239-0x0000000000870000-0x0000000000892000-memory.dmp

Download

memory/2780-310-0x0000000000870000-0x0000000000892000-memory.dmp

Download

memory/2908-109-0x00000000009F0000-0x0000000000A12000-memory.dmp

Download

memory/2908-186-0x00000000009F0000-0x0000000000A12000-memory.dmp

Download

memory/2984-532-0x0000000000D00000-0x0000000000D22000-memory.dmp

Download

memory/3040-579-0x00000000001A0000-0x00000000001C2000-memory.dmp

Download

memory/3040-417-0x00000000001A0000-0x00000000001C2000-memory.dmp

Download

memory/3060-15-0x0000000000410000-0x0000000000432000-memory.dmp

Download

memory/3060-0-0x0000000000410000-0x0000000000432000-memory.dmp

Download

memory/3212-102-0x00000000009D0000-0x00000000009F2000-memory.dmp

Download

memory/3212-51-0x00000000009D0000-0x00000000009F2000-memory.dmp

Download

memory/3320-152-0x0000000000120000-0x0000000000142000-memory.dmp

Download

memory/3352-364-0x0000000000E70000-0x0000000000E92000-memory.dmp

Download

memory/3352-311-0x0000000000E70000-0x0000000000E92000-memory.dmp

Download

memory/3944-548-0x0000000000C70000-0x0000000000C92000-memory.dmp

Download

memory/4320-390-0x00000000001A0000-0x00000000001C2000-memory.dmp

Download

memory/4320-318-0x00000000001A0000-0x00000000001C2000-memory.dmp

Download

memory/4460-208-0x0000000000530000-0x0000000000552000-memory.dmp

Download

memory/4552-367-0x00000000007C0000-0x00000000007E2000-memory.dmp

Download

memory/4552-312-0x00000000007C0000-0x00000000007E2000-memory.dmp

Download

memory/5096-116-0x00000000009F0000-0x0000000000A12000-memory.dmp

Download

memory/5096-73-0x00000000009F0000-0x0000000000A12000-memory.dmp

Download