ff0a2dd188041748e8fccaa39afd02a667fe39ce92262887e8740b3d1cf33a19

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_1740ff20ceac043f3d42572ec31442b0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 14.1MB
Sample260714-e3qvyses7n
SHA256 ff0a2dd188041748e8fccaa39afd02a667fe39ce92262887e8740b3d1cf33a19
MD5 1740ff20ceac043f3d42572ec31442b0
SHA1 6eca744ece9bee9f492b5c8c14f9331fac83a336
SHA512 a57994912ddd2b61ed269f2c1273059b472813c7108de7e51c9430d0f0ac78b7fa74cc5103417d7cc3c919e3dfd73490f27ab329091c17ffb48d2cb6875cac9a
SSDEEP 98304:p4Tq4Tq4Tq4Tq4Tq4Tq4Tq4T6OU/jIEeQfoR/IuOFVjUu53:pxxxxxxxhFIF0wu1
TLSH
T1B8E68C02B6DD0069F0B30771DE7AA27AA935FCFEAE12D56E6549740E2572F00C929337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002443f-12.dat	INDICATOR_EXE_Packed_Fody

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 9 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_ACBCABCBACBBABACBBACABBBCCCCCABACCCACCBAABACCCAACCCAAAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BAAABAAAABCABCABABCCAAAACACCCBBBCAACCAAAACCBBBAABAACBCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BAAAAACCAACBCBBBBABBCBAAAAABCACCBBCABABACABBABBCCACACAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_CBACAACCCACCACBAABBBCCCCBCBAAACACBABCABBBBABCCBACCBCCAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	2026-07-14_1740ff20ceac043f3d42572ec31442b0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe

Executes dropped EXE 64 IoCs

pid	Process
3024	svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe
4168	svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe
1992	svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe
4740	svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe
4308	svchost_ACBCABCBACBBABACBBACABBBCCCCCABACCCACCBAABACCCAACCCAAAA.exe
636	svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe
3080	svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe
3844	svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe
3044	svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe
4620	svchost_ABABABAACCAABCBBCABBABBBBCBCBCCABBABBBACBCABACABCABCACB.exe
2624	svchost_BBBAACAABBBCBBCABABCAABCCACBBBBCBAACBCACBCCCCCABABABCAB.exe
2096	svchost_BAABAACCCCABACCBBCBABBBCCCBCCBCBABBBCAACCCAACACCCAABCAB.exe
3300	svchost_BBCAAAAAAABCCBBACCCBAABCCAABCBCCABAACCAAABAABBBBBABCBCC.exe
3020	svchost_BBCCBBCBCAACABAABABCAACCAAABBBAAABBACCBACCCCACBCBAAAABB.exe
3568	svchost_BBAACBCAAABACBCAACCCCCBACBCBCBCBCBAACCCABABBCABCCBCACCA.exe
4908	svchost_BAAAAACCAACBCBBBBABBCBAAAAABCACCBBCABABACABBABBCCACACAA.exe
4560	svchost_BAAAAACCAACBCBBBBABBCBAAAAABCACCBBCABABACABBABBCCACACAA.exe
2680	svchost_BBACCCAAABBAAABBBBACBCAABCABAABABCBCAACBABBBAACBBCBBBAA.exe
936	svchost_BAAABAAAABCABCABABCCAAAACACCCBBBCAACCAAAACCBBBAABAACBCC.exe
4900	svchost_BAAABAAAABCABCABABCCAAAACACCCBBBCAACCAAAACCBBBAABAACBCC.exe
3488	svchost_CBACAACCCACCACBAABBBCCCCBCBAAACACBABCABBBBABCCBACCBCCAA.exe
4764	svchost_CBACAACCCACCACBAABBBCCCCBCBAAACACBABCABBBBABCCBACCBCCAA.exe
5292	svchost_CBCBAACBCBAACABACACCBCBBBBAABBBABCACACAAAACCCABCACAABAC.exe
5628	svchost_AAABBAABAACCBCAACCABCACCAABAACACBCBBACABCAAACACBCCBAACB.exe
5884	svchost_CABCACCBAAABBBCBBBCBAABAACABACACCCCCCBCCCAAAAACBAACABAC.exe
5160	svchost_AAACABACBAAACBBCBCAABBBBCCCBBBCBBABCBAAABAAAABABCBCACAB.exe
5452	svchost_CBBACCAABACCCCBBBACBAAABCBBBACBCBBCCBCACABBAABCABCBBCCC.exe
1280	svchost_CBACBCCBCCBCBCBCABCCCACCBBCCCAAACACAACBBCBBCCBCCCAABBCC.exe
1388	svchost_CBACBCCBCCBCBCBCABCCCACCBBCCCAAACACAACBBCBBCCBCCCAABBCC.exe
5340	svchost_BCCACCAABAACABAACBBBCBCACACBBCAAABCBCAABCCABABCABCAACBA.exe
5512	svchost_AABACACCCACBBABCACBABBBCBBCBCBBBCBBABACAACBACACCBBABBCB.exe
2832	svchost_BBCACACBBABAAAACBBAAABACAABCACBBBCCCABCCACBBBACBCAABCBB.exe
3128	svchost_CAABAABCACABBCCBAACCBBCACBABCACCCCAABCACBBCABACBBBBACBA.exe
5704	svchost_CBCCBCABBCBBAACCCABAACAACCACBBBCBAACBBACACBCABABAACCCCA.exe
5028	svchost_CBCBACCAAAAABABBCBCCBAAABCCCAACAABAABBAACBBACACCCCCACCA.exe
1364	svchost_CACBACCCBBCAABCCAACACAABABBABABBBABBCBCBBABBCAAABBCCACC.exe
2628	svchost_CBCBACCAAAAABABBCBCCBAAABCCCAACAABAABBAACBBACACCCCCACCA.exe
4844	svchost_CACBACCCBBCAABCCAACACAABABBABABBBABBCBCBBABBCAAABBCCACC.exe
5092	svchost_BBCAAAAAABCBAACBCBBBBCCBBCBBBACACCACACBBCCABBAABBBAABAB.exe
6008	svchost_AAAAACACCCCCCCBBBCCACCBAACCCABCCCABBAAACAACCBCABACBCABC.exe
3772	svchost_ABBBABCBBCCABACBCCBBAAACABBCACCCABACAAABBCCABAACCAACBBA.exe
3780	svchost_BCABCCCCACACAAABCABABCBBCCBBBCABBCCACCCBBACBCCCCABBACBC.exe
6352	svchost_BCABCCCCACACAAABCABABCBBCCBBBCABBCCACCCBBACBCCCCABBACBC.exe
6396	svchost_ABCBCCAABACAACCBACCAACAACBBCAABAABCABABBBBABBCCBABCBABA.exe
6424	svchost_BCBAAABCABBBCACBABBAAAACABBBABACAABAAABBAAAACBAABBBBAAA.exe
6440	svchost_BACCBBCCACBACBCCBBBCCAAAACAAACABAABCBCCCCABAABACBCBABCA.exe
6512	svchost_BACCBBCCACBACBCCBBBCCAAAACAAACABAABCBCCCCABAABACBCBABCA.exe
6568	svchost_BCBAAABCABBBCACBABBAAAACABBBABACAABAAABBAAAACBAABBBBAAA.exe
6908	svchost_BABBACCCBCBACABACBACCAABAABACBCBCCBCBBBBBCCAAABCBCACCBA.exe
7068	svchost_BABBACCCBCBACABACBACCAABAABACBCBCCBCBBBBBCCAAABCBCACCBA.exe
6668	svchost_BAABCCABBAAABABBBACCCBBCBACBABCBAAABBCABABCBAACABABABAA.exe
6812	svchost_BCCCCACABACABBCACBACCABCBAAACCAABBABCCABAAACCBABCCCBBBB.exe
6948	svchost_BCCCBBCBBBCACABACCACBBACBAABCBABBACCBBBBBAAAAACAAACABAC.exe
6972	svchost_ABCACBCACABAAABBCAACACBBCCACBBAACCCBCCAABABBAABBABABBCC.exe
2752	svchost_ABCCAABABCCCBBCCAACCBBACBBCCAAAACABCAAAACBABACABACABCAA.exe
2368	svchost_AACCCABBCBBBABCCBACCBAAAABBABBAABBBAAACAAABCCABBBBCBAAB.exe
5492	svchost_AACCCABBCBBBABCCBACCBAAAABBABBAABBBAAACAAABCCABBBBCBAAB.exe
5852	svchost_ABCACBCACABAAABBCAACACBBCCACBBAACCCBCCAABABBAABBABABBCC.exe
7104	svchost_BCCCBBCBBBCACABACCACBBACBAABCBABBACCBBBBBAAAAACAAACABAC.exe
6092	svchost_ABCCAABABCCCBBCCAACCBBACBBCCAAAACABCAAAACBABACABACABCAA.exe
5296	svchost_CBABCBAAABBBCABBBACCCACBBBABBCBCCBBBCCBCACCBACCAABACBCC.exe
5360	svchost_CBABCBAAABBBCABBBACCCACBBBABBCBCCBBBCCBCACCBACCAABACBCC.exe
7376	svchost_CBBBBBCCCCBBBAABACACCABBACCCCBBBBCBCCACCCCAABBAABBCBABB.exe
7504	svchost_CBBBBBCCCCBBBAABACACCABBACCCCBBBBCBCCACCCCAABBAABBCBABB.exe

Adds Run key to start application 2 TTPs 15 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BACBCBBCCCCAAAAAACCCCABBCCACCBCBCAABACCBAACCABAABCABABAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe"	2026-07-14_1740ff20ceac043f3d42572ec31442b0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCABBAAAACBBBACCABBBAACCCBCBABCACABACCBCCBCBCCACACCCCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe"	svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBABABACCBABACABABABACBABCBAACACBABBBCBBACBBCBCCCBACCBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe"	svchost_ACBCABCBACBBABACBBACABBBCCCCCABACCCACCBAABACCCAACCCAAAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ACCBBCACBCBCBABBABCACCBBCCBCAABBBCABAABABCBBCACBAACAAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAAAAACCAACBCBBBBABBCBAAAAABCACCBBCABABACABBABBCCACACAA.exe"	svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AABABBBCBACCABCBABBABACCABBBAAAACAACCBBCBAABBBABABBBBBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCCABBCBBBABCCBACCBAAAABBABBAABBBAAACAAABCCABBBBCBAAB.exe"	svchost_BCBAAABCABBBCACBABBAAAACABBBABACAABAAABBAAAACBAABBBBAAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe"	svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BAABAACCCCABACCBBCBABBBCCCBCCBCBABBBCAACCCAACACCCAABCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABAACCCCABACCBBCBABBBCCCBCCBCBABBBCAACCCAACACCCAABCAB.exe"	svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBBBACAAABCAAABAABCAACBAAABAAABCCBBBACAAAAAABCBBABBBBAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACAACCCACCACBAABBBCCCCBCBAAACACBABCABBBBABCCBACCBCCAA.exe"	svchost_BAAAAACCAACBCBBBBABBCBAAAAABCACCBBCABABACABBABBCCACACAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBCCAACACBABACCBBCAABBBCCCCACBCBCBCABAACBACBBABCCAABBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABBAABAACCBCAACCABCACCAABAACACBCBBACABCAAACACBCCBAACB.exe"	svchost_BAAABAAAABCABCABABCCAAAACACCCBBBCAACCAAAACCBBBAABAACBCC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AABCCCCCCABCABBCBABCBBBABCCCBABAACBBACCABBBBBCBBACACCCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCBBCBBBCACABACCACBBACBAABCBABBACCBBBBBAAAAACAAACABAC.exe"	svchost_BACCBBCCACBACBCCBBBCCAAAACAAACABAABCBCCCCABAABACBCBABCA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AAAABCCBBACAAAABCCBBBCACACCCAACBABCCACACAAABCBBAACBCBBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBBBCCCCBBBAABACACCABBACCCCBBBBCBCCACCCCAABBAABBCBABB.exe"	svchost_CBACBCCBCCBCBCBCABCCCACCBBCCCAAACACAACBBCBBCCBCCCAABBCC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCACABBCAACCBCCBBBBBBBCAACBAABACACBABBCCCCCABCAABBCACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBACCCBBCAABCCAACACAABABBABABBBABBCBCBBABBCAAABBCCACC.exe"	svchost_CBACAACCCACCACBAABBBCCCCBCBAAACACBABCABBBBABCCBACCBCCAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCABCCCCACACAAABCABABCBBCCBBBCABBCCACCCBBACBCCCCABBACBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABCCCCACACAAABCABABCBBCCBBBCABBCCACCCBBACBCCCCABBACBC.exe"	svchost_CBCBACCAAAAABABBCBCCBAAABCCCAACAABAABBAACBBACACCCCCACCA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BAABCBCBCAACCACBBACCBBCABBACBCCCABBABBAAACBCCBABBCABBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBCCAABACAACCBACCAACAACBBCAABAABCABABBBBABBCCBABCBABA.exe"	svchost_CACBACCCBBCAABCCAACACAABABBABABBBABBCBCBBABBCAAABBCCACC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBBBCABACCCBCCCBCCCACCAABABBACACACCBBCACAACCCCCBBBCCBBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACACCABABBBBBAACBCBBBCCAABBBCCABACBBCCCBBBACCCBBABCBBC.exe"	svchost_BABBACCCBCBACABACBACCAABAABACBCBCCBCBBBBBCCAAABCBCACCBA.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6264	sc.exe
6868	sc.exe
5476	sc.exe
5396	sc.exe
7360	sc.exe
8136	sc.exe
7568	sc.exe
8012	sc.exe
7936	sc.exe
4972	sc.exe
1744	sc.exe
5768	sc.exe
7420	sc.exe
7488	sc.exe
2104	sc.exe
4788	sc.exe
5800	sc.exe
1416	sc.exe
4412	sc.exe
3420	sc.exe
7056	sc.exe
6700	sc.exe
1892	sc.exe
5204	sc.exe
6472	sc.exe
7136	sc.exe
6748	sc.exe
7400	sc.exe
7716	sc.exe
5180	sc.exe
5860	sc.exe
5732	sc.exe
4260	sc.exe
5196	sc.exe
1388	sc.exe
2036	sc.exe
4460	sc.exe
4764	sc.exe
5624	sc.exe
6016	sc.exe
5536	sc.exe
656	sc.exe
4212	sc.exe
1748	sc.exe
5412	sc.exe
4280	sc.exe
5024	sc.exe
6552	sc.exe
1932	sc.exe
3240	sc.exe
6128	sc.exe
1792	sc.exe
5572	sc.exe
2076	sc.exe
3984	sc.exe
7756	sc.exe
5696	sc.exe
3996	sc.exe
5112	sc.exe
6448	sc.exe
5328	sc.exe
5712	sc.exe
4268	sc.exe
792	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACBCCBCCBCBCBCABCCCACCBBCCCAAACACAACBBCBBCCBCCCAABBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCACBCACABAAABBCAACACBBCCACBBAACCCBCCAABABBAABBABABBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBABCBBCCABACBCCBBAAACABBCACCCABACAAABBCCABAACCAACBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAACBCAAABACBCAACCCCCBACBCBCBCBCBAACCCABABBCABCCBCACCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCABCBACBBABACBBACABBBCCCCCABACCCACCBAABACCCAACCCAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABBAABAACCBCAACCABCACCAABAACACBCBBACABCAAACACBCCBAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5220	schtasks.exe
6056	schtasks.exe
5724	schtasks.exe
6012	schtasks.exe
836	schtasks.exe
6080	schtasks.exe
2388	schtasks.exe
4224	schtasks.exe
3416	schtasks.exe
2368	schtasks.exe
5284	schtasks.exe
7116	schtasks.exe
7188	schtasks.exe
7628	schtasks.exe
4276	schtasks.exe
4236	schtasks.exe
3048	schtasks.exe
1892	schtasks.exe
776	schtasks.exe
6740	schtasks.exe
2752	schtasks.exe
7668	schtasks.exe
3128	schtasks.exe
1800	schtasks.exe
6728	schtasks.exe
220	schtasks.exe
7984	schtasks.exe
8128	schtasks.exe
7620	schtasks.exe
7748	schtasks.exe
3576	schtasks.exe
5404	schtasks.exe
5728	schtasks.exe
2732	schtasks.exe
6152	schtasks.exe
7892	schtasks.exe
5416	schtasks.exe
7864	schtasks.exe
936	schtasks.exe
5332	schtasks.exe
5656	schtasks.exe
2368	schtasks.exe
5024	schtasks.exe
6968	schtasks.exe
6064	schtasks.exe
4512	schtasks.exe
444	schtasks.exe
3080	schtasks.exe
4992	schtasks.exe
3504	schtasks.exe
4132	schtasks.exe
1660	schtasks.exe
5128	schtasks.exe
6080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4776	2026-07-14_1740ff20ceac043f3d42572ec31442b0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4776	2026-07-14_1740ff20ceac043f3d42572ec31442b0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3024	svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe
3024	svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe
4168	svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe
4168	svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe
4776	2026-07-14_1740ff20ceac043f3d42572ec31442b0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4776	2026-07-14_1740ff20ceac043f3d42572ec31442b0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
1992	svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe
1992	svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe
4308	svchost_ACBCABCBACBBABACBBACABBBCCCCCABACCCACCBAABACCCAACCCAAAA.exe
4308	svchost_ACBCABCBACBBABACBBACABBBCCCCCABACCCACCBAABACCCAACCCAAAA.exe
4740	svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe
4740	svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe
3044	svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe
3044	svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe
636	svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe
636	svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe
4620	svchost_ABABABAACCAABCBBCABBABBBBCBCBCCABBABBBACBCABACABCABCACB.exe
4620	svchost_ABABABAACCAABCBBCABBABBBBCBCBCCABBABBBACBCABACABCABCACB.exe
3080	svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe
3080	svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe
3024	svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe
3024	svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe
2624	svchost_BBBAACAABBBCBBCABABCAABCCACBBBBCBAACBCACBCCCCCABABABCAB.exe
2624	svchost_BBBAACAABBBCBBCABABCAABCCACBBBBCBAACBCACBCCCCCABABABCAB.exe
3844	svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe
3844	svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe
2096	svchost_BAABAACCCCABACCBBCBABBBCCCBCCBCBABBBCAACCCAACACCCAABCAB.exe
2096	svchost_BAABAACCCCABACCBBCBABBBCCCBCCBCBABBBCAACCCAACACCCAABCAB.exe
1992	svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe
1992	svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe
4308	svchost_ACBCABCBACBBABACBBACABBBCCCCCABACCCACCBAABACCCAACCCAAAA.exe
4308	svchost_ACBCABCBACBBABACBBACABBBCCCCCABACCCACCBAABACCCAACCCAAAA.exe
3568	svchost_BBAACBCAAABACBCAACCCCCBACBCBCBCBCBAACCCABABBCABCCBCACCA.exe
3568	svchost_BBAACBCAAABACBCAACCCCCBACBCBCBCBCBAACCCABABBCABCCBCACCA.exe
4908	svchost_BAAAAACCAACBCBBBBABBCBAAAAABCACCBBCABABACABBABBCCACACAA.exe
4908	svchost_BAAAAACCAACBCBBBBABBCBAAAAABCACCBBCABABACABBABBCCACACAA.exe
3300	svchost_BBCAAAAAAABCCBBACCCBAABCCAABCBCCABAACCAAABAABBBBBABCBCC.exe
3300	svchost_BBCAAAAAAABCCBBACCCBAABCCAABCBCCABAACCAAABAABBBBBABCBCC.exe
936	svchost_BAAABAAAABCABCABABCCAAAACACCCBBBCAACCAAAACCBBBAABAACBCC.exe
936	svchost_BAAABAAAABCABCABABCCAAAACACCCBBBCAACCAAAACCBBBAABAACBCC.exe
3020	svchost_BBCCBBCBCAACABAABABCAACCAAABBBAAABBACCBACCCCACBCBAAAABB.exe
3020	svchost_BBCCBBCBCAACABAABABCAACCAAABBBAAABBACCBACCCCACBCBAAAABB.exe
636	svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe
636	svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe
4560	svchost_BAAAAACCAACBCBBBBABBCBAAAAABCACCBBCABABACABBABBCCACACAA.exe
4560	svchost_BAAAAACCAACBCBBBBABBCBAAAAABCACCBBCABABACABBABBCCACACAA.exe
4900	svchost_BAAABAAAABCABCABABCCAAAACACCCBBBCAACCAAAACCBBBAABAACBCC.exe
4900	svchost_BAAABAAAABCABCABABCCAAAACACCCBBBCAACCAAAACCBBBAABAACBCC.exe
2680	svchost_BBACCCAAABBAAABBBBACBCAABCABAABABCBCAACBABBBAACBBCBBBAA.exe
2680	svchost_BBACCCAAABBAAABBBBACBCAABCABAABABCBCAACBABBBAACBBCBBBAA.exe
5628	svchost_AAABBAABAACCBCAACCABCACCAABAACACBCBBACABCAAACACBCCBAACB.exe
5628	svchost_AAABBAABAACCBCAACCABCACCAABAACACBCBBACABCAAACACBCCBAACB.exe
5292	svchost_CBCBAACBCBAACABACACCBCBBBBAABBBABCACACAAAACCCABCACAABAC.exe
5292	svchost_CBCBAACBCBAACABACACCBCBBBBAABBBABCACACAAAACCCABCACAABAC.exe
5884	svchost_CABCACCBAAABBBCBBBCBAABAACABACACCCCCCBCCCAAAAACBAACABAC.exe
5884	svchost_CABCACCBAAABBBCBBBCBAABAACABACACCCCCCBCCCAAAAACBAACABAC.exe
3844	svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe
3844	svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe
5512	svchost_AABACACCCACBBABCACBABBBCBBCBCBBBCBBABACAACBACACCBBABBCB.exe
5512	svchost_AABACACCCACBBABCACBABBBCBBCBCBBBCBBABACAACBACACCBBABBCB.exe
5160	svchost_AAACABACBAAACBBCBCAABBBBCCCBBBCBBABCBAAABAAAABABCBCACAB.exe
5160	svchost_AAACABACBAAACBBCBCAABBBBCCCBBBCBBABCBAAABAAAABABCBCACAB.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeDebugPrivilege	4776	2026-07-14_1740ff20ceac043f3d42572ec31442b0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	3024	svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe
Token: SeDebugPrivilege	4168	svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe
Token: SeDebugPrivilege	1992	svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe
Token: SeDebugPrivilege	4308	svchost_ACBCABCBACBBABACBBACABBBCCCCCABACCCACCBAABACCCAACCCAAAA.exe
Token: SeDebugPrivilege	4740	svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe
Token: SeDebugPrivilege	3044	svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe
Token: SeDebugPrivilege	636	svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe
Token: SeDebugPrivilege	4620	svchost_ABABABAACCAABCBBCABBABBBBCBCBCCABBABBBACBCABACABCABCACB.exe
Token: SeDebugPrivilege	3080	svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe
Token: SeDebugPrivilege	2624	svchost_BBBAACAABBBCBBCABABCAABCCACBBBBCBAACBCACBCCCCCABABABCAB.exe
Token: SeDebugPrivilege	3844	svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe
Token: SeDebugPrivilege	2096	svchost_BAABAACCCCABACCBBCBABBBCCCBCCBCBABBBCAACCCAACACCCAABCAB.exe
Token: SeDebugPrivilege	3568	svchost_BBAACBCAAABACBCAACCCCCBACBCBCBCBCBAACCCABABBCABCCBCACCA.exe
Token: SeDebugPrivilege	4908	svchost_BAAAAACCAACBCBBBBABBCBAAAAABCACCBBCABABACABBABBCCACACAA.exe
Token: SeDebugPrivilege	3300	svchost_BBCAAAAAAABCCBBACCCBAABCCAABCBCCABAACCAAABAABBBBBABCBCC.exe
Token: SeDebugPrivilege	936	svchost_BAAABAAAABCABCABABCCAAAACACCCBBBCAACCAAAACCBBBAABAACBCC.exe
Token: SeDebugPrivilege	3020	svchost_BBCCBBCBCAACABAABABCAACCAAABBBAAABBACCBACCCCACBCBAAAABB.exe
Token: SeDebugPrivilege	4560	svchost_BAAAAACCAACBCBBBBABBCBAAAAABCACCBBCABABACABBABBCCACACAA.exe
Token: SeDebugPrivilege	4900	svchost_BAAABAAAABCABCABABCCAAAACACCCBBBCAACCAAAACCBBBAABAACBCC.exe
Token: SeDebugPrivilege	2680	svchost_BBACCCAAABBAAABBBBACBCAABCABAABABCBCAACBABBBAACBBCBBBAA.exe
Token: SeDebugPrivilege	5628	svchost_AAABBAABAACCBCAACCABCACCAABAACACBCBBACABCAAACACBCCBAACB.exe
Token: SeDebugPrivilege	5292	svchost_CBCBAACBCBAACABACACCBCBBBBAABBBABCACACAAAACCCABCACAABAC.exe
Token: SeDebugPrivilege	5884	svchost_CABCACCBAAABBBCBBBCBAABAACABACACCCCCCBCCCAAAAACBAACABAC.exe
Token: SeDebugPrivilege	5512	svchost_AABACACCCACBBABCACBABBBCBBCBCBBBCBBABACAACBACACCBBABBCB.exe
Token: SeDebugPrivilege	5160	svchost_AAACABACBAAACBBCBCAABBBBCCCBBBCBBABCBAAABAAAABABCBCACAB.exe
Token: SeDebugPrivilege	3488	svchost_CBACAACCCACCACBAABBBCCCCBCBAAACACBABCABBBBABCCBACCBCCAA.exe
Token: SeDebugPrivilege	4764	svchost_CBACAACCCACCACBAABBBCCCCBCBAAACACBABCABBBBABCCBACCBCCAA.exe
Token: SeDebugPrivilege	5452	svchost_CBBACCAABACCCCBBBACBAAABCBBBACBCBBCCBCACABBAABCABCBBCCC.exe
Token: SeDebugPrivilege	5340	svchost_BCCACCAABAACABAACBBBCBCACACBBCAAABCBCAABCCABABCABCAACBA.exe
Token: SeDebugPrivilege	2832	svchost_BBCACACBBABAAAACBBAAABACAABCACBBBCCCABCCACBBBACBCAABCBB.exe
Token: SeDebugPrivilege	5028	svchost_CBCBACCAAAAABABBCBCCBAAABCCCAACAABAABBAACBBACACCCCCACCA.exe
Token: SeDebugPrivilege	1364	svchost_CACBACCCBBCAABCCAACACAABABBABABBBABBCBCBBABBCAAABBCCACC.exe
Token: SeDebugPrivilege	2628	svchost_CBCBACCAAAAABABBCBCCBAAABCCCAACAABAABBAACBBACACCCCCACCA.exe
Token: SeDebugPrivilege	4844	svchost_CACBACCCBBCAABCCAACACAABABBABABBBABBCBCBBABBCAAABBCCACC.exe
Token: SeDebugPrivilege	5092	svchost_BBCAAAAAABCBAACBCBBBBCCBBCBBBACACCACACBBCCABBAABBBAABAB.exe
Token: SeDebugPrivilege	6352	svchost_BCABCCCCACACAAABCABABCBBCCBBBCABBCCACCCBBACBCCCCABBACBC.exe
Token: SeDebugPrivilege	6396	svchost_ABCBCCAABACAACCBACCAACAACBBCAABAABCABABBBBABBCCBABCBABA.exe
Token: SeDebugPrivilege	6424	svchost_BCBAAABCABBBCACBABBAAAACABBBABACAABAAABBAAAACBAABBBBAAA.exe
Token: SeDebugPrivilege	6440	svchost_BACCBBCCACBACBCCBBBCCAAAACAAACABAABCBCCCCABAABACBCBABCA.exe
Token: SeDebugPrivilege	6008	svchost_AAAAACACCCCCCCBBBCCACCBAACCCABCCCABBAAACAACCBCABACBCABC.exe
Token: SeDebugPrivilege	6512	svchost_BACCBBCCACBACBCCBBBCCAAAACAAACABAABCBCCCCABAABACBCBABCA.exe
Token: SeDebugPrivilege	6568	svchost_BCBAAABCABBBCACBABBAAAACABBBABACAABAAABBAAAACBAABBBBAAA.exe
Token: SeDebugPrivilege	1280	svchost_CBACBCCBCCBCBCBCABCCCACCBBCCCAAACACAACBBCBBCCBCCCAABBCC.exe
Token: SeDebugPrivilege	1388	svchost_CBACBCCBCCBCBCBCABCCCACCBBCCCAAACACAACBBCBBCCBCCCAABBCC.exe
Token: SeDebugPrivilege	3128	svchost_CAABAABCACABBCCBAACCBBCACBABCACCCCAABCACBBCABACBBBBACBA.exe
Token: SeDebugPrivilege	3772	svchost_ABBBABCBBCCABACBCCBBAAACABBCACCCABACAAABBCCABAACCAACBBA.exe
Token: SeDebugPrivilege	6908	svchost_BABBACCCBCBACABACBACCAABAABACBCBCCBCBBBBBCCAAABCBCACCBA.exe
Token: SeDebugPrivilege	7068	svchost_BABBACCCBCBACABACBACCAABAABACBCBCCBCBBBBBCCAAABCBCACCBA.exe
Token: SeDebugPrivilege	5704	svchost_CBCCBCABBCBBAACCCABAACAACCACBBBCBAACBBACACBCABABAACCCCA.exe
Token: SeDebugPrivilege	7836	svchost_CCACACACAACABCBBAAAACCBABACCAABAABBABCBCBAACAABCBBBBBAC.exe
Token: SeDebugPrivilege	6668	svchost_BAABCCABBAAABABBBACCCBBCBACBABCBAAABBCABABCBAACABABABAA.exe
Token: SeDebugPrivilege	6812	svchost_BCCCCACABACABBCACBACCABCBAAACCAABBABCCABAAACCBABCCCBBBB.exe
Token: SeDebugPrivilege	7020	svchost_ACAACCACAACBAACACCCAABCCCCACABCAACCABCCBABAABCCCCAAABBC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 3792	4776	2026-07-14_1740ff20ceac043f3d42572ec31442b0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	88
PID 3792 wrote to memory of 4236	3792	cmd.exe	90
PID 4776 wrote to memory of 2068	4776	2026-07-14_1740ff20ceac043f3d42572ec31442b0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	91
PID 2068 wrote to memory of 2104	2068	cmd.exe	94
PID 4776 wrote to memory of 3636	4776	2026-07-14_1740ff20ceac043f3d42572ec31442b0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	95
PID 3636 wrote to memory of 1388	3636	cmd.exe	98
PID 3024 wrote to memory of 2264	3024	svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe	107
PID 2264 wrote to memory of 3080	2264	cmd.exe	109
PID 3024 wrote to memory of 4476	3024	svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe	110
PID 4476 wrote to memory of 4268	4476	cmd.exe	113
PID 3024 wrote to memory of 4616	3024	svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe	114
PID 4616 wrote to memory of 4100	4616	cmd.exe	118
PID 4168 wrote to memory of 4428	4168	svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe	122
PID 4428 wrote to memory of 4992	4428	cmd.exe	124
PID 4168 wrote to memory of 1640	4168	svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe	125
PID 1640 wrote to memory of 1736	1640	cmd.exe	127
PID 1992 wrote to memory of 2052	1992	svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe	130
PID 2052 wrote to memory of 936	2052	cmd.exe	132
PID 1992 wrote to memory of 3016	1992	svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe	133
PID 3016 wrote to memory of 4336	3016	cmd.exe	136
PID 1992 wrote to memory of 3440	1992	svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe	137
PID 4308 wrote to memory of 1520	4308	svchost_ACBCABCBACBBABACBBACABBBCCCCCABACCCACCBAABACCCAACCCAAAA.exe	140
PID 3440 wrote to memory of 2776	3440	cmd.exe	142
PID 1520 wrote to memory of 3048	1520	cmd.exe	146
PID 4308 wrote to memory of 3252	4308	svchost_ACBCABCBACBBABACBBACABBBCCCCCABACCCACCBAABACCCAACCCAAAA.exe	147
PID 3252 wrote to memory of 2036	3252	cmd.exe	149
PID 4308 wrote to memory of 4676	4308	svchost_ACBCABCBACBBABACBBACABBBCCCCCABACCCACCBAABACCCAACCCAAAA.exe	151
PID 4676 wrote to memory of 792	4676	cmd.exe	153
PID 4740 wrote to memory of 2784	4740	svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe	155
PID 2784 wrote to memory of 3504	2784	cmd.exe	157
PID 4740 wrote to memory of 1160	4740	svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe	158
PID 1160 wrote to memory of 4212	1160	cmd.exe	160
PID 4740 wrote to memory of 1636	4740	svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe	162
PID 1636 wrote to memory of 4748	1636	cmd.exe	164
PID 3044 wrote to memory of 1764	3044	svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe	166
PID 1764 wrote to memory of 3128	1764	cmd.exe	168
PID 3044 wrote to memory of 2844	3044	svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe	169
PID 2844 wrote to memory of 1468	2844	cmd.exe	171
PID 3044 wrote to memory of 1864	3044	svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe	172
PID 1864 wrote to memory of 1000	1864	cmd.exe	174
PID 636 wrote to memory of 1956	636	svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe	176
PID 1956 wrote to memory of 4132	1956	cmd.exe	178
PID 636 wrote to memory of 4716	636	svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe	179
PID 4716 wrote to memory of 1748	4716	cmd.exe	181
PID 636 wrote to memory of 2972	636	svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe	182
PID 2972 wrote to memory of 4788	2972	cmd.exe	184
PID 4620 wrote to memory of 3828	4620	svchost_ABABABAACCAABCBBCABBABBBBCBCBCCABBABBBACBCABACABCABCACB.exe	186
PID 3828 wrote to memory of 3576	3828	cmd.exe	188
PID 4620 wrote to memory of 3200	4620	svchost_ABABABAACCAABCBBCABBABBBBCBCBCCABBABBBACBCABACABCABCACB.exe	189
PID 3200 wrote to memory of 2368	3200	cmd.exe	191
PID 4620 wrote to memory of 2452	4620	svchost_ABABABAACCAABCBBCABBABBBBCBCBCCABBABBBACBCABACABCABCACB.exe	192
PID 2452 wrote to memory of 3960	2452	cmd.exe	194
PID 3080 wrote to memory of 1780	3080	svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe	196
PID 1780 wrote to memory of 1892	1780	cmd.exe	198
PID 3080 wrote to memory of 4984	3080	svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe	199
PID 4984 wrote to memory of 4188	4984	cmd.exe	201
PID 3080 wrote to memory of 912	3080	svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe	202
PID 912 wrote to memory of 3988	912	cmd.exe	204
PID 2624 wrote to memory of 3836	2624	svchost_BBBAACAABBBCBBCABABCAABCCACBBBBCBAACBCACBCCCCCABABABCAB.exe	206
PID 3836 wrote to memory of 2388	3836	cmd.exe	208
PID 2624 wrote to memory of 564	2624	svchost_BBBAACAABBBCBBCABABCAABCCACBBBBCBAACBCACBCCCCCABABABCAB.exe	209
PID 564 wrote to memory of 4460	564	cmd.exe	211
PID 2624 wrote to memory of 420	2624	svchost_BBBAACAABBBCBBCABABCAABCCACBBBBCBAACBCACBCCCCCABABABCAB.exe	212
PID 420 wrote to memory of 3240	420	cmd.exe	214

C:\Users\Admin\AppData\Local\Temp\2026-07-14_1740ff20ceac043f3d42572ec31442b0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_1740ff20ceac043f3d42572ec31442b0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCBBCCCCAAAAAACCCCABBCCACCBCBCAABACCBAACCABAABCABABABABCCCCCAAAABCCACBABAACABCBABCAABBABABCCCABBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCBBCCCCAAAAAACCCCABBCCACCBCBCAABACCBAACCABAABCABABABABCCCCCAAAABCCACBABAACABCBABCAABBABABCCCABBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBBCABBBACCCCBCCBCBBACCACCBAABABACCACCBBBCCCCBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe" start= auto displayName= "UserDataSvc_CCBBBCABBBACCCCBCCBCBBACCACCBAABABACCACCBBBCCCCBCBB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBBCABBBACCCCBCCBCBBACCACCBAABABACCACCBBBCCCCBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe" start= auto displayName= "UserDataSvc_CCBBBCABBBACCCCBCCBCBBACCACCBAABABACCACCBBBCCCCBCBB"
    3⤵
    - Launches sc.exe
    PID:2104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBBCABBBACCCCBCCBCBBACCACCBAABABACCACCBBBCCCCBCBB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBBCABBBACCCCBCCBCBBACCACCBAABABACCACCBBBCCCCBCBB"
    3⤵
    - Launches sc.exe
    PID:1388

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABBAAAACBBBACCABBBAACCCBCBABCACABACCBCCBCBCCACACCCCCAAABBCAACABAAAACBBACABCAAACBBBBCBBCCCACBAAACBCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABBAAAACBBBACCABBBAACCCBCBABCACABACCBCCBCBCCACACCCCCAAABBCAACABAAAACBBACABCAAACBBBBCBBCCCACBAAACBCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABCABCBCBACBBCACBBBBCABCBBCCCBAAACBCAAAABABCABAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe" start= auto displayName= "UserDataSvc_ACABCABCBCBACBBCACBBBBCABCBBCCCBAAACBCAAAABABCABAAA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABCABCBCBACBBCACBBBBCABCBBCCCBAAACBCAAAABABCABAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe" start= auto displayName= "UserDataSvc_ACABCABCBCBACBBCACBBBBCABCBBCCCBAAACBCAAAABABCABAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABCABCBCBACBBCACBBBBCABCBBCCCBAAACBCAAAABABCABAAA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABCABCBCBACBBCACBBBBCABCBBCCCBAAACBCAAAABABCABAAA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACCCCACABACCCBAACABCBABCCBBCCCAAACABCBACABCBACBCACCBBBBABBCBACACACBBACACCBBAACCAAABBBBAAAABBCABCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABCBACBBABACBBACABBBCCCCCABACCCACCBAABACCCAACCCAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACCCCACABACCCBAACABCBABCCBBCCCAAACABCBACABCBACBCACCBBBBABBCBACACACBBACACCBBAACCAAABBBBAAAABBCABCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABCBACBBABACBBACABBBCCCCCABACCCACCBAABACCCAACCCAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABBAABCCAABCAABBAAAAACBBCCACAACCACBBCBABCBCBABCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABCBACBBABACBBACABBBCCCCCABACCCACCBAABACCCAACCCAAAA.exe" start= auto displayName= "UserDataSvc_BCABBAABCCAABCAABBAAAAACBBCCACAACCACBBCBABCBCBABCAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABBAABCCAABCAABBAAAAACBBCCACAACCACBBCBABCBCBABCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABCBACBBABACBBACABBBCCCCCABACCCACCBAABACCCAACCCAAAA.exe" start= auto displayName= "UserDataSvc_BCABBAABCCAABCAABBAAAAACBBCCACAACCACBBCBABCBCBABCAB"
    3⤵
    PID:1736

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACBCCAABBCCBBAABACACCCBCAABAAACCACCBBCCCAAABAAABCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACBCCAABBCCBBAABACACCCBCAABAAACCACCBBCCCAAABAAABCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBABCAABABACABABBBACABBBAABBCABABBBBABBBABCAAACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe" start= auto displayName= "UserDataSvc_BCBBABCAABABACABABBBACABBBAABBCABABBBBABBBABCAAACBA"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBABCAABABACABABBBACABBBAABBCABABBBBABBBABCAAACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe" start= auto displayName= "UserDataSvc_BCBBABCAABABACABABBBACABBBAABBCABABBBBABBBABCAAACBA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBABCAABABACABABBBACABBBAABBCABABBBBABBBABCAAACBA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBABCAABABACABABBBACABBBAABBCABABBBBABBBABCAAACBA"
    3⤵
    PID:2776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBABBACBAABBCCCAAAAABABCCCBCCCAAAABCCABCACCBACCCAABA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABABAACCAABCBBCABBABBBBCBCBCCABBABBBACBCABACABCABCACBABCBBAAABABABBAAAAACACAAABCBABCABCCCCCCCCABCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABAACCAABCBBCABBABBBBCBCBCCABBABBBACBCABACABCABCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABABAACCAABCBBCABBABBBBCBCBCCABBABBBACBCABACABCABCACBABCBBAAABABABBAAAAACACAAABCBABCABCCCCCCCCABCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABAACCAABCBBCABBABBBBCBCBCCABBABBBACBCABACABCABCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCABBCBAAAAACCAAACCBBBCCBCABCCBABCCAAACBCBABBACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABAACCAABCBBCABBABBBBCBCBCCABBABBBACBCABACABCABCACB.exe" start= auto displayName= "UserDataSvc_CCCABBCBAAAAACCAAACCBBBCCBCABCCBABCCAAACBCBABBACACC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCABBCBAAAAACCAAACCBBBCCBCABCCBABCCAAACBCBABBACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABAACCAABCBBCABBABBBBCBCBCCABBABBBACBCABACABCABCACB.exe" start= auto displayName= "UserDataSvc_CCCABBCBAAAAACCAAACCBBBCCBCABCCBABCCAAACBCBABBACACC"
    3⤵
    - Launches sc.exe
    PID:4212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCABBCBAAAAACCAAACCBBBCCBCABCCBABCCAAACBCBABBACACC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCABBCBAAAAACCAAACCBBBCCBCABCCBABCCAAACBCBABBACACC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4748

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABCBACBBABACBBACABBBCCCCCABACCCACCBAABACCCAACCCAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABCBACBBABACBBACABBBCCCCCABACCCACCBAABACCCAACCCAAAA.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBBCBBACBBCABCBABCAABCCBCCABABAABAABCBBCABBACAAABBBBAAAAAACCABAAAAABCCBCCBACCCAACBCCCCABABABCBCCCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBBCBBACBBCABCBABCAABCCBCCABABAABAABCBBCABBACAAABBBBAAAAAACCABAAAAABCCBCCBACCCAACBCCCCABABABCBCCCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCACACBBABBBCBABAABAAAACACCABAAAABABBCAABBCBCACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe" start= auto displayName= "UserDataSvc_BCBCACACBBABBBCBABAABAAAACACCABAAAABABBCAABBCBCACCB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCACACBBABBBCBABAABAAAACACCABAAAABABBCAABBCBCACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe" start= auto displayName= "UserDataSvc_BCBCACACBBABBBCBABAABAAAACACCABAAAABABBCAABBCBCACCB"
    3⤵
    - Launches sc.exe
    PID:2036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCACACBBABBBCBABAABAAAACACCABAAAABABBCAABBCBCACCB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCACACBBABBBCBABAABAAAACACCABAAAABABBCAABBCBCACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:792

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABACCACCBBCACCBABBCAACABAAAABCCBCBCBABCBCAAAABAABAABCCACACCACBACCACAAACABBAAACCBACBCBCCBABCABCBCACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAACCCCABACCBBCBABBBCCCBCCBCBABBBCAACCCAACACCCAABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABACCACCBBCACCBABBCAACABAAAABCCBCBCBABCBCAAAABAABAABCCACACCACBACCACAAACABBAAACCBACBCBCCBABCABCBCACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAACCCCABACCBBCBABBBCCCBCCBCBABBBCAACCCAACACCCAABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCACBBACABCCABACBBACBCCACACCCCABCBAABBCBAACBACCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAACCCCABACCBBCBABBBCCCBCCBCBABBBCAACCCAACACCCAABCAB.exe" start= auto displayName= "UserDataSvc_BBCACBBACABCCABACBBACBCCACACCCCABCBAABBCBAACBACCBCC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCACBBACABCCABACBBACBCCACACCCCABCBAABBCBAACBACCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAACCCCABACCBBCBABBBCCCBCCBCBABBBCAACCCAACACCCAABCAB.exe" start= auto displayName= "UserDataSvc_BBCACBBACABCCABACBBACBCCACACCCCABCBAABBCBAACBACCBCC"
    3⤵
    - Launches sc.exe
    PID:1748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCACBBACABCCABACBBACBCCACACCCCABCBAABBCBAACBACCBCC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCACBBACABCCABACBBACBCCACACCCCABCBAABBCBAACBACCBCC"
    3⤵
    - Launches sc.exe
    PID:4788

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBCCAABACCACBBBBAAAABBCBCACAABABBACBABBBABBBACACACB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBBCBABBBCCAACCACBBCCACCABCACCBACBABBBBABAACAAABACBBBABAABBCAACABBACBBACBBBACBCABACBCBCCBABAAACBCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCBCAACABAABABCAACCAAABBBAAABBACCBACCCCACBCBAAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBBCBABBBCCAACCACBBCCACCABCACCBACBABBBBABAACAAABACBBBABAABBCAACABBACBBACBBBACBCABACBCBCCBABAAACBCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCBCAACABAABABCAACCAAABBBAAABBACCBACCCCACBCBAAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBAAACBBBCACCABAAABACBCBACABBBCAAABABCCBAAABBCBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCBCAACABAABABCAACCAAABBBAAABBACCBACCCCACBCBAAAABB.exe" start= auto displayName= "UserDataSvc_CBBAAACBBBCACCABAAABACBCBACABBBCAAABABCCBAAABBCBABB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBAAACBBBCACCABAAABACBCBACABBBCAAABABCCBAAABBCBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCBCAACABAABABCAACCAAABBBAAABBACCBACCCCACBCBAAAABB.exe" start= auto displayName= "UserDataSvc_CBBAAACBBBCACCABAAABACBCBACABBBCAAABABCCBAAABBCBABB"
    3⤵
    PID:4188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBAAACBBBCACCABAAABACBCBACABBBCAAABABCCBAAABBCBABB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBAAACBBBCACCABAAABACBCBACABBBCAAABABCCBAAABBCBABB"
    3⤵
    PID:3988

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBBCACBCBCBABBABCACCBBCCBCAABBBCABAABABCBBCACBAACAAABABAAACCCBBAACCBBCCBBCBABCCCBBBCCAABBBCAABCBBBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAACCAACBCBBBBABBCBAAAAABCACCBBCABABACABBABBCCACACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBBCACBCBCBABBABCACCBBCCBCAABBBCABAABABCBBCACBAACAAABABAAACCCBBAACCBBCCBBCBABCCCBBBCCAABBBCAABCBBBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAACCAACBCBBBBABBCBAAAAABCACCBBCABABACABBABBCCACACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCABCBCCBAABCBAACBACBAACCCCCACCACBBCBCABBAABBCACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAACCAACBCBBBBABBCBAAAAABCACCBBCABABACABBABBCCACACAA.exe" start= auto displayName= "UserDataSvc_ACCABCBCCBAABCBAACBACBAACCCCCACCACBBCBCABBAABBCACAC"
  2⤵
  PID:1156
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCABCBCCBAABCBAACBACBAACCCCCACCACBBCBCABBAABBCACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAACCAACBCBBBBABBCBAAAAABCACCBBCABABACABBABBCCACACAA.exe" start= auto displayName= "UserDataSvc_ACCABCBCCBAABCBAACBACBAACCCCCACCACBBCBCABBAABBCACAC"
    3⤵
    - Launches sc.exe
    PID:1892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCABCBCCBAABCBAACBACBAACCCCCACCACBBCBCABBAABBCACAC"
  2⤵
  PID:2028
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCABCBCCBAABCBAACBACBAACCCCCACCACBBCBCABBAABBCACAC"
    3⤵
    PID:456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCBBBBBBBBBABCCACAACCCBCCCBBBCBCBCBBCBAACACCCCBCCBA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBAACAABBBCBBCABABCAABCCACBBBBCBAACBCACBCCCCCABABABCABACAACCCBBCCACBCBCCBBBCACABAAABCABACBBABCAACBCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACAABBBCBBCABABCAABCCACBBBBCBAACBCACBCCCCCABABABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBAACAABBBCBBCABABCAABCCACBBBBCBAACBCACBCCCCCABABABCABACAACCCBBCCACBCBCCBBBCACABAAABCABACBBABCAACBCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACAABBBCBBCABABCAABCCACBBBBCBAACBCACBCCCCCABABABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCCACCABBCCBBAAACAABACAACCACAABBCABAAACCCBACBBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACAABBBCBBCABABCAABCCACBBBBCBAACBCACBCCCCCABABABCAB.exe" start= auto displayName= "UserDataSvc_AACCCACCABBCCBBAAACAABACAACCACAABBCABAAACCCBACBBCBC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCCACCABBCCBBAAACAABACAACCACAABBCABAAACCCBACBBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACAABBBCBBCABABCAABCCACBBBBCBAACBCACBCCCCCABABABCAB.exe" start= auto displayName= "UserDataSvc_AACCCACCABBCCBBAAACAABACAACCACAABBCABAAACCCBACBBCBC"
    3⤵
    PID:1468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCCACCABBCCBBAAACAABACAACCACAABBCABAAACCCBACBBCBC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCCACCABBCCBBAAACAABACAACCACAABBCABAAACCCBACBBCBC"
    3⤵
    PID:1000

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABAACCAABCBBCABBABBBBCBCBCCABBABBBACBCABACABCABCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABAACCAABCBBCABBABBBBCBCBCCABBABBBACBCABACABCABCACB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBCAABCBBCABACBCCACCAACCABACABBAAAABABCCABCABBAAAABAACAACBCCAACCACBAAAAABCAACBABBBBBCCBABACBAABAABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAAAAABCCBBACCCBAABCCAABCBCCABAACCAAABAABBBBBABCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBCAABCBBCABACBCCACCAACCABACABBAAAABABCCABCABBAAAABAACAACBCCAACCACBAAAAABCAACBABBBBBCCBABACBAABAABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAAAAABCCBBACCCBAABCCAABCBCCABAACCAAABAABBBBBABCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACABBBBBACACBAACBCAAACABACCCAABAABCCBCBBCABCAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAAAAABCCBBACCCBAABCCAABCBCCABAACCAAABAABBBBBABCBCC.exe" start= auto displayName= "UserDataSvc_CBACABBBBBACACBAACBCAAACABACCCAABAABCCBCBBCABCAACBB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACABBBBBACACBAACBCAAACABACCCAABAABCCBCBBCABCAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAAAAABCCBBACCCBAABCCAABCBCCABAACCAAABAABBBBBABCBCC.exe" start= auto displayName= "UserDataSvc_CBACABBBBBACACBAACBCAAACABACCCAABAABCCBCBBCABCAACBB"
    3⤵
    PID:2368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACABBBBBACACBAACBCAAACABACCCAABAABCCBCBBCABCAACBB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACABBBBBACACBAACBCAAACABACCCAABAABCCBCBBCABCAACBB"
    3⤵
    PID:3960

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACAABBBCBBCABABCAABCCACBBBBCBAACBCACBCCCCCABABABCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACAABBBCBBCABABCAABCCACBBBBCBAACBCACBCCCCCABABABCAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAACBCAAABACBCAACCCCCBACBCBCBCBCBAACCCABABBCABCCBCACCACBABCBABBCBCABCABCCABBACBBBCBAAACBCCBABCCBCABBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCAAABACBCAACCCCCBACBCBCBCBCBAACCCABABBCABCCBCACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAACBCAAABACBCAACCCCCBACBCBCBCBCBAACCCABABBCABCCBCACCACBABCBABBCBCABCABCCABBACBBBCBAAACBCCBABCCBCABBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCAAABACBCAACCCCCBACBCBCBCBCBAACCCABABBCABCCBCACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCACABCBABBBBCAAAABCCBBBCBCCACAACBBCABACABACABBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCAAABACBCAACCCCCBACBCBCBCBCBAACCCABABBCABCCBCACCA.exe" start= auto displayName= "UserDataSvc_BBCACABCBABBBBCAAAABCCBBBCBCCACAACBBCABACABACABBBBC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCACABCBABBBBCAAAABCCBBBCBCCACAACBBCABACABACABBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCAAABACBCAACCCCCBACBCBCBCBCBAACCCABABBCABCCBCACCA.exe" start= auto displayName= "UserDataSvc_BBCACABCBABBBBCAAAABCCBBBCBCCACAACBBCABACABACABBBBC"
    3⤵
    - Launches sc.exe
    PID:4460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCACABCBABBBBCAAAABCCBBBCBCCACAACBBCABACABACABBBBC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:420
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCACABCBABBBBCAAAABCCBBBCBCCACAACBBCABACABACABBBBC"
    3⤵
    - Launches sc.exe
    PID:3240

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAACCCCABACCBBCBABBBCCCBCCBCBABBBCAACCCAACACCCAABCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAACCCCABACCBBCBABBBCCCBCCBCBABBBCAACCCAACACCCAABCAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAABBBCCCBBBAAACCBBCBBBBABCBBBCCAABCACCCAAAABBAABCABABCACCBBACBCACACBACAABAAACBCBACCBBCBCACCCABBBBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCAAABBAAABBBBACBCAABCABAABABCBCAACBABBBAACBBCBBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAABBBCCCBBBAAACCBBCBBBBABCBBBCCAABCACCCAAAABBAABCABABCACCBBACBCACACBACAABAAACBCBACCBBCBCACCCABBBBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCAAABBAAABBBBACBCAABCABAABABCBCAACBABBBAACBBCBBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABABABCBCCAAAAABCBCABACCBCAAACCACBACAACAAACCCACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCAAABBAAABBBBACBCAABCABAABABCBCAACBABBBAACBBCBBBAA.exe" start= auto displayName= "UserDataSvc_CCABABABCBCCAAAAABCBCABACCBCAAACCACBACAACAAACCCACCC"
  2⤵
  PID:3784
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABABABCBCCAAAAABCBCABACCBCAAACCACBACAACAAACCCACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCAAABBAAABBBBACBCAABCABAABABCBCAACBABBBAACBBCBBBAA.exe" start= auto displayName= "UserDataSvc_CCABABABCBCCAAAAABCBCABACCBCAAACCACBACAACAAACCCACCC"
    3⤵
    PID:1824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABABABCBCCAAAAABCBCABACCBCAAACCACBACAACAAACCCACCC"
  2⤵
  PID:2404
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABABABCBCCAAAAABCBCABACCBCAAACCACBACAACAAACCCACCC"
    3⤵
    PID:4180

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAAAAABCCBBACCCBAABCCAABCBCCABAACCAAABAABBBBBABCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAAAAABCCBBACCCBAABCCAABCBCCABAACCAAABAABBBBBABCBCC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABACBCABABBCAABBBAAABCCCCBABBBCBAABCCACACCBABABABBABBCCBACABAACBCAAACBCBBCCAAAAAABBCBBABCACABACABBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAACBCBAACABACACCBCBBBBAABBBABCACACAAAACCCABCACAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABACBCABABBCAABBBAAABCCCCBABBBCBAABCCACACCBABABABBABBCCBACABAACBCAAACBCBBCCAAAAAABBCBBABCACABACABBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAACBCBAACABACACCBCBBBBAABBBABCACACAAAACCCABCACAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABBACBABBABCABCBAABAACACCCABABBCCBABAABAACBCAACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAACBCBAACABACACCBCBBBBAABBBABCACACAAAACCCABCACAABAC.exe" start= auto displayName= "UserDataSvc_CCABBACBABBABCABCBAABAACACCCABABBCCBABAABAACBCAACCC"
  2⤵
  PID:5148
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABBACBABBABCABCBAABAACACCCABABBCCBABAABAACBCAACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAACBCBAACABACACCBCBBBBAABBBABCACACAAAACCCABCACAABAC.exe" start= auto displayName= "UserDataSvc_CCABBACBABBABCABCBAABAACACCCABABBCCBABAABAACBCAACCC"
    3⤵
    - Launches sc.exe
    PID:5204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABBACBABBABCABCBAABAACACCCABABBCCBABAABAACBCAACCC"
  2⤵
  PID:5224
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABBACBABBABCABCBAABAACACCCABABBCCBABAABAACBCAACCC"
    3⤵
    PID:5276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCBCAACABAABABCAACCAAABBBAAABBACCBACCCCACBCBAAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCBCAACABAABABCAACCAAABBBAAABBACCBACCCCACBCBAAAABB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBCBACABCBCCACAABCBCBCCAACABACBCAACBCABCACCBABACCBAACBCCCCBBBBBCACCCBBBAACAAABBBAAAACACAABCCACAACABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCBAAABBBCBBBCBAABAACABACACCCCCCBCCCAAAAACBAACABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5676
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBCBACABCBCCACAABCBCBCCAACABACBCAACBCABCACCBABACCBAACBCCCCBBBBBCACCCBBBAACAAABBBAAAACACAABCCACAACABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCBAAABBBCBBBCBAABAACABACACCCCCCBCCCAAAAACBAACABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCAAABBCCCABACCAABABACCAAAABACBAACBAABCABBBCAAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCBAAABBBCBBBCBAABAACABACACCCCCCBCCCAAAAACBAACABAC.exe" start= auto displayName= "UserDataSvc_ACCCAAABBCCCABACCAABABACCAAAABACBAACBAABCABBBCAAACB"
  2⤵
  PID:5748
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCAAABBCCCABACCAABABACCAAAABACBAACBAABCABBBCAAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCBAAABBBCBBBCBAABAACABACACCCCCCBCCCAAAAACBAACABAC.exe" start= auto displayName= "UserDataSvc_ACCCAAABBCCCABACCAABABACCAAAABACBAACBAABCABBBCAAACB"
    3⤵
    - Launches sc.exe
    PID:5800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCAAABBCCCABACCAABABACCAAAABACBAACBAABCABBBCAAACB"
  2⤵
  PID:5820
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCAAABBCCCABACCAABABACCAAAABACBAACBAABCABBBCAAACB"
    3⤵
    PID:5872

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCAAABACBCAACCCCCBACBCBCBCBCBAACCCABABBCABCCBCACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCAAABACBCAACCCCCBACBCBCBCBCBAACCCABABBCABCCBCACCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCCCCCACBCCBBCCBAACCCCACCBCCBCACBBBACCBAACAAACCBBACACBBCACABACBBCCBBCCBACAABCABCCAAABCCBAACABBACCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABAAAABCABCABABCCAAAACACCCBBBCAACCAAAACCBBBAABAACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCCCCCACBCCBBCCBAACCCCACCBCCBCACBBBACCBAACAAACCBBACACBBCACABACBBCCBBCCBACAABCABCCAAABCCBAACABBACCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABAAAABCABCABABCCAAAACACCCBBBCAACCAAAACCBBBAABAACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABABCCCACBAAABBBAABBABAACBABBCBAAABCCACBAAABABABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABAAAABCABCABABCCAAAACACCCBBBCAACCAAAACCBBBAABAACBCC.exe" start= auto displayName= "UserDataSvc_CCABABCCCACBAAABBBAABBABAACBABBCBAAABCCACBAAABABABA"
  2⤵
  PID:1052
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABABCCCACBAAABBBAABBABAACBABBCBAAABCCACBAAABABABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABAAAABCABCABABCCAAAACACCCBBBCAACCAAAACCBBBAABAACBCC.exe" start= auto displayName= "UserDataSvc_CCABABCCCACBAAABBBAABBABAACBABBCBAAABCCACBAAABABABA"
    3⤵
    PID:2568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABABCCCACBAAABBBAABBABAACBABBCBAAABCCACBAAABABABA"
  2⤵
  PID:3912
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABABCCCACBAAABBBAABBABAACBABBCBAAABCCACBAAABABABA"
    3⤵
    PID:4260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAACCAACBCBBBBABBCBAAAAABCACCBBCABABACABBABBCCACACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAACCAACBCBBBBABBCBAAAAABCACCBBCABABACABBABBCCACACAA.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBACAAABCAAABAABCAACBAAABAAABCCBBBACAAAAAABCBBABBBBAAAABCBCBCABBACCCCBAACABBACCCBACCACAABCCAAABACCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAACCCACCACBAABBBCCCCBCBAAACACBABCABBBBABCCBACCBCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBACAAABCAAABAABCAACBAAABAAABCCBBBACAAAAAABCBBABBBBAAAABCBCBCABBACCCCBAACABBACCCBACCACAABCCAAABACCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAACCCACCACBAABBBCCCCBCBAAACACBABCABBBBABCCBACCBCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAABBBBACCCACAACCAABCCBBABBACABACACAAAACCAABCCABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAACCCACCACBAABBBCCCCBCBAAACACBABCABBBBABCCBACCBCCAA.exe" start= auto displayName= "UserDataSvc_AAAABBBBACCCACAACCAABCCBBABBACABACACAAAACCAABCCABCC"
  2⤵
  PID:2760
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAABBBBACCCACAACCAABCCBBABBACABACACAAAACCAABCCABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAACCCACCACBAABBBCCCCBCBAAACACBABCABBBBABCCBACCBCCAA.exe" start= auto displayName= "UserDataSvc_AAAABBBBACCCACAACCAABCCBBABBACABACACAAAACCAABCCABCC"
    3⤵
    - Launches sc.exe
    PID:4764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAABBBBACCCACAACCAABCCBBABBACABACACAAAACCAABCCABCC"
  2⤵
  PID:3576
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAAABBBBACCCACAACCAABCCBBABBACABACACAAAACCAABCCABCC"
    3⤵
    PID:996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAACCAACBCBBBBABBCBAAAAABCACCBBCABABACABBABBCCACACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAACCAACBCBBBBABBCBAAAAABCACCBBCABABACABBABBCCACACAA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCBAACABAAAACABCABBABACABAABCACBBBBBABCABBACCCBBBAAABABCBACBAACBCCACCBBBBCCBBBACABBCABAAACBCAAABACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABACBAAACBBCBCAABBBBCCCBBBCBBABCBAAABAAAABABCBCACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCBAACABAAAACABCABBABACABAABCACBBBBBABCABBACCCBBBAAABABCBACBAACBCCACCBBBBCCBBBACABBCABAAACBCAAABACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABACBAAACBBCBCAABBBBCCCBBBCBBABCBAAABAAAABABCBCACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACBABCBBCBCABBABAABBBCACAACCABBACCAABAAACBCBCCBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABACBAAACBBCBCAABBBBCCCBBBCBBABCBAAABAAAABABCBCACAB.exe" start= auto displayName= "UserDataSvc_AACBABCBBCBCABBABAABBBCACAACCABBACCAABAAACBCBCCBABA"
  2⤵
  PID:6100
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACBABCBBCBCABBABAABBBCACAACCABBACCAABAAACBCBCCBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABACBAAACBBCBCAABBBBCCCBBBCBBABCBAAABAAAABABCBCACAB.exe" start= auto displayName= "UserDataSvc_AACBABCBBCBCABBABAABBBCACAACCABBACCAABAAACBCBCCBABA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACBABCBBCBCABBABAABBBCACAACCABBACCAABAAACBCBCCBABA"
  2⤵
  PID:5136
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACBABCBBCBCABBABAABBBCACAACCABBACCAABAAACBCBCCBABA"
    3⤵
    - Launches sc.exe
    PID:1416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCAAABBAAABBBBACBCAABCABAABABCBCAACBABBBAACBBCBBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCAAABBAAABBBBACBCAABCABAABABCBCAACBABBBAACBBCBBBAA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBCCBCCBCBCBCABCCCACCBBCCCAAACACAACBBCBBCCBCCCAABBCCCAACACBBAABAABACAABACACBBBACAACACBBACCCCBABCBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCCBCCBCBCBCABCCCACCBBCCCAAACACAACBBCBBCCBCCCAABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBCCBCCBCBCBCABCCCACCBBCCCAAACACAACBBCBBCCBCCCAABBCCCAACACBBAABAABACAABACACBBBACAACACBBACCCCBABCBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCCBCCBCBCBCABCCCACCBBCCCAAACACAACBBCBBCCBCCCAABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCCCCCCCBCBAACAAABAAACBBBCABCABABCBBCCABCCBCBBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCCBCCBCBCBCABCCCACCBBCCCAAACACAACBBCBBCCBCCCAABBCC.exe" start= auto displayName= "UserDataSvc_CBBCCCCCCCBCBAACAAABAAACBBBCABCABABCBBCCABCCBCBBCCA"
  2⤵
  PID:5716
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCCCCCCCBCBAACAAABAAACBBBCABCABABCBBCCABCCBCBBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCCBCCBCBCBCABCCCACCBBCCCAAACACAACBBCBBCCBCCCAABBCC.exe" start= auto displayName= "UserDataSvc_CBBCCCCCCCBCBAACAAABAAACBBBCABCABABCBBCCABCCBCBBCCA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCCCCCCCBCBAACAAABAAACBBBCABCABABCBBCCABCCBCBBCCA"
  2⤵
  PID:440
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCCCCCCCBCBAACAAABAAACBBBCABCABABCBBCCABCCBCBBCCA"
    3⤵
    - Launches sc.exe
    PID:5860

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABAAAABCABCABABCCAAAACACCCBBBCAACCAAAACCBBBAABAACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABAAAABCABCABABCCAAAACACCCBBBCAACCAAAACCBBBAABAACBCC.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCAACACBABACCBBCAABBBCCCCACBCBCBCABAACBACBBABCCAABBCCBBBAAAABBCAAABAAACABBBBABBABBBBCCCCACCBCCCAAAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAABAACCBCAACCABCACCAABAACACBCBBACABCAAACACBCCBAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5352
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCAACACBABACCBBCAABBBCCCCACBCBCBCABAACBACBBABCCAABBCCBBBAAAABBCAAABAAACABBBBABBABBBBCCCCACCBCCCAAAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAABAACCBCAACCABCACCAABAACACBCBBACABCAAACACBCCBAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAABAACBBAAAABACBAABBBBCBACBCAACBCAAACAABBCBCCBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAABAACCBCAACCABCACCAABAACACBCBBACABCAAACACBCCBAACB.exe" start= auto displayName= "UserDataSvc_CCAABAACBBAAAABACBAABBBBCBACBCAACBCAAACAABBCBCCBACC"
  2⤵
  PID:5428
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAABAACBBAAAABACBAABBBBCBACBCAACBCAAACAABBCBCCBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAABAACCBCAACCABCACCAABAACACBCBBACABCAAACACBCCBAACB.exe" start= auto displayName= "UserDataSvc_CCAABAACBBAAAABACBAABBBBCBACBCAACBCAAACAABBCBCCBACC"
    3⤵
    PID:5476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAABAACBBAAAABACBAABBBBCBACBCAACBCAAACAABBCBCCBACC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5500
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCAABAACBBAAAABACBAABBBBCBACBCAACBCAAACAABBCBCCBACC"
    3⤵
    PID:5592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABAAAABCABCABABCCAAAACACCCBBBCAACCAAAACCBBBAABAACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABAAAABCABCABABCCAAAACACCCBBBCAACCAAAACCBBBAABAACBCC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCAAAABCCCAAABBBAABBCABBCABCBACBAABABABBCCABBBACCCBCCABCCCABBABCCBBAAACACCAABACBCBAABABCCAABCBCACCBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCAABACCCCBBBACBAAABCBBBACBCBBCCBCACABBAABCABCBBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCAAAABCCCAAABBBAABBCABBCABCBACBAABABABBCCABBBACCCBCCABCCCABBABCCBBAAACACCAABACBCBAABABCCAABCBCACCBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCAABACCCCBBBACBAAABCBBBACBCBBCCBCACABBAABCABCBBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBBACACCACCBABCCBBCACCCCACCCBACBCABCBCABCCCABABCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCAABACCCCBBBACBAAABCBBBACBCBBCCBCACABBAABCABCBBCCC.exe" start= auto displayName= "UserDataSvc_ACBBACACCACCBABCCBBCACCCCACCCBACBCABCBCABCCCABABCAB"
  2⤵
  PID:5316
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBBACACCACCBABCCBBCACCCCACCCBACBCABCBCABCCCABABCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCAABACCCCBBBACBAAABCBBBACBCBBCCBCACABBAABCABCBBCCC.exe" start= auto displayName= "UserDataSvc_ACBBACACCACCBABCCBBCACCCCACCCBACBCABCBCABCCCABABCAB"
    3⤵
    - Launches sc.exe
    PID:5412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBBACACCACCBABCCBBCACCCCACCCBACBCABCBCABCCCABABCAB"
  2⤵
  PID:5388
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBBACACCACCBABCCBBCACCCCACCCBACBCABCBCABCCCABABCAB"
    3⤵
    PID:5472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAACCCACCACBAABBBCCCCBCBAAACACBABCABBBBABCCBACCBCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAACCCACCACBAABBBCCCCBCBAAACACBABCABBBBABCCBACCBCCAA.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACABBCAACCBCCBBBBBBBCAACBAABACACBABBCCCCCABCAABBCACCCACCCABCCCBABBBABBACABBCCAAABCABBBAABCCABBBACCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACCCBBCAABCCAACACAABABBABABBBABBCBCBBABBCAAABBCCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACABBCAACCBCCBBBBBBBCAACBAABACACBABBCCCCCABCAABBCACCCACCCABCCCBABBBABBACABBCCAAABCABBBAABCCABBBACCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACCCBBCAABCCAACACAABABBABABBBABBCBCBBABBCAAABBCCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCCACBACBAAABCACCACCACBBCCAAABBACBABBCBAABCACBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACCCBBCAABCCAACACAABABBABABBBABBCBCBBABBCAAABBCCACC.exe" start= auto displayName= "UserDataSvc_CABCCACBACBAAABCACCACCACBBCCAAABBACBABBCBAABCACBCCC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3908
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCCACBACBAAABCACCACCACBBCCAAABBACBABBCBAABCACBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACCCBBCAABCCAACACAABABBABABBBABBCBCBBABBCAAABBCCACC.exe" start= auto displayName= "UserDataSvc_CABCCACBACBAAABCACCACCACBBCCAAABBACBABBCBAABCACBCCC"
    3⤵
    PID:5152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCCACBACBAAABCACCACCACBBCCAAABBACBABBCBAABCACBCCC"
  2⤵
  PID:860
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCCACBACBAAABCACCACCACBBCCAAABBACBABBCBAABCACBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5624

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAACCCACCACBAABBBCCCCBCBAAACACBABCABBBBABCCBACCBCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAACCCACCACBAABBBCCCCBCBAAACACBABCABBBBABCCBACCBCCAA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBACBACBBCCBAABCBBCABBCCBCBCCBCBACABABACACACABCCBBCBBCCAABBBCCCBCACCAABCBCAACCBCBCBBCCCBBCCBACABCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBACCAAAAABABBCBCCBAAABCCCAACAABAABBAACBBACACCCCCACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBACBACBBCCBAABCBBCABBCCBCBCCBCBACABABACACACABCCBBCBBCCAABBBCCCBCACCAABCBCAACCBCBCBBCCCBBCCBACABCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBACCAAAAABABBCBCCBAAABCCCAACAABAABBAACBBACACCCCCACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCABCAAAACCCACBBCBCCABCBACAABAAABBCACCCAABABABCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBACCAAAAABABBCBCCBAAABCCCAACAABAABBAACBBACACCCCCACCA.exe" start= auto displayName= "UserDataSvc_CBBCABCAAAACCCACBBCBCCABCBACAABAAABBCACCCAABABABCBA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2728
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCABCAAAACCCACBBCBCCABCBACAABAAABBCACCCAABABABCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBACCAAAAABABBCBCCBAAABCCCAACAABAABBAACBBACACCCCCACCA.exe" start= auto displayName= "UserDataSvc_CBBCABCAAAACCCACBBCBCCABCBACAABAAABBCACCCAABABABCBA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCABCAAAACCCACBBCBCCABCBACAABAAABBCACCCAABABABCBA"
  2⤵
  PID:5332
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCABCAAAACCCACBBCBCCABCBACAABAAABBCACCCAABABABCBA"
    3⤵
    - Launches sc.exe
    PID:3420

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAACBCBAACABACACCBCBBBBAABBBABCACACAAAACCCABCACAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAACBCBAACABACACCBCBBBBAABBBABCACACAAAACCCABCACAABAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBBBCABABACBBCBCCAACAAACBAAAACBCACACCCAABABBCACACBCBABBCABCBCBBCCABAACCBABBAACBAACCBBCACCAACAACCBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACACCCACBBABCACBABBBCBBCBCBBBCBBABACAACBACACCBBABBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBBBCABABACBBCBCCAACAAACBAAAACBCACACCCAABABBCACACBCBABBCABCBCBBCCABAACCBABBAACBAACCBBCACCAACAACCBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACACCCACBBABCACBABBBCBBCBCBBBCBBABACAACBACACCBBABBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACBAABBCABCBCCCCACBBACCBBCCCCAAACCBCBBCAAAAABBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACACCCACBBABCACBABBBCBBCBCBBBCBBABACAACBACACCBBABBCB.exe" start= auto displayName= "UserDataSvc_CAACBAABBCABCBCCCCACBBACCBBCCCCAAACCBCBBCAAAAABBABC"
  2⤵
  PID:5376
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAACBAABBCABCBCCCCACBBACCBBCCCCAAACCBCBBCAAAAABBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACACCCACBBABCACBABBBCBBCBCBBBCBBABACAACBACACCBBABBCB.exe" start= auto displayName= "UserDataSvc_CAACBAABBCABCBCCCCACBBACCBBCCCCAAACCBCBBCAAAAABBABC"
    3⤵
    - Launches sc.exe
    PID:5396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAACBAABBCABCBCCCCACBBACCBBCCCCAAACCBCBBCAAAAABBABC"
  2⤵
  PID:2372
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAACBAABBCABCBCCCCACBBACCBBCCCCAAACCBCBBCAAAAABBABC"
    3⤵
    PID:5444

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAABAACCBCAACCABCACCAABAACACBCBBACABCAAACACBCCBAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAABAACCBCAACCABCACCAABAACACBCBBACABCAAACACBCCBAACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBAAAAAABCABBBCBCABBBACABBBAABACCBCABABBCCCABAACBCAABAAACCABABAABABCABCBACCBBBBBAABAAACCACABCACBBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCAABAACABAACBBBCBCACACBBCAAABCBCAABCCABABCABCAACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBAAAAAABCABBBCBCABBBACABBBAABACCBCABABBCCCABAACBCAABAAACCABABAABABCABCBACCBBBBBAABAAACCACABCACBBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCAABAACABAACBBBCBCACACBBCAAABCBCAABCCABABCABCAACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABCCCCCCCACACCBACBBACCBBACCCBCBBABBBBCCCBACCAABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCAABAACABAACBBBCBCACACBBCAAABCBCAABCCABABCABCAACBA.exe" start= auto displayName= "UserDataSvc_CAABCCCCCCCACACCBACBBACCBBACCCBCBBABBBBCCCBACCAABAB"
  2⤵
  PID:6072
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABCCCCCCCACACCBACBBACCBBACCCBCBBABBBBCCCBACCAABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCAABAACABAACBBBCBCACACBBCAAABCBCAABCCABABCABCAACBA.exe" start= auto displayName= "UserDataSvc_CAABCCCCCCCACACCBACBBACCBBACCCBCBBABBBBCCCBACCAABAB"
    3⤵
    - Launches sc.exe
    PID:6128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABCCCCCCCACACCBACBBACCBBACCCBCBBABBBBCCCBACCAABAB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2788
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABCCCCCCCACACCBACBBACCBBACCCBCBBABBBBCCCBACCAABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCBAAABBBCBBBCBAABAACABACACCCCCCBCCCAAAAACBAACABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCBAAABBBCBBBCBAABAACABACACCCCCCBCCCAAAAACBAACABAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCACACBBABAAAACBBAAABACAABCACBBBCCCABCCACBBBACBCAABCBBCBCACACBBABCBBAAAACCCACCBCCCBBBAAAACABCCACBBBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACACBBABAAAACBBAAABACAABCACBBBCCCABCCACBBBACBCAABCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCACACBBABAAAACBBAAABACAABCACBBBCCCABCCACBBBACBCAABCBBCBCACACBBABCBBAAAACCCACCBCCCBBBAAAACABCCACBBBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACACBBABAAAACBBAAABACAABCACBBBCCCABCCACBBBACBCAABCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACACBAAACACCBBAACACACCBABAAACBABCAABCABCCBCBCACAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACACBBABAAAACBBAAABACAABCACBBBCCCABCCACBBBACBCAABCBB.exe" start= auto displayName= "UserDataSvc_CACACBAAACACCBBAACACACCBABAAACBABCAABCABCCBCBCACAAC"
  2⤵
  PID:4752
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACACBAAACACCBBAACACACCBABAAACBABCAABCABCCBCBCACAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACACBBABAAAACBBAAABACAABCACBBBCCCABCCACBBBACBCAABCBB.exe" start= auto displayName= "UserDataSvc_CACACBAAACACCBBAACACACCBABAAACBABCAABCABCCBCBCACAAC"
    3⤵
    PID:5564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACACBAAACACCBBAACACACCBABAAACBABCAABCABCCBCBCACAAC"
  2⤵
  PID:5736
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACACBAAACACCBBAACACACCBABAAACBABCAABCABCCBCBCACAAC"
    3⤵
    - Launches sc.exe
    PID:5768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABACBAAACBBCBCAABBBBCCCBBBCBBABCBAAABAAAABABCBCACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABACBAAACBBCBCAABBBBCCCBBBCBBABCBAAABAAAABABCBCACAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCABABAABABACACBCBBBBABBCBBBBCBCCBBBABBAACCBBACBACBBBCBABBACCAACCBCBCCCCCAAAABBAABCBCABABAAAAACBABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCABBCBBAACCCABAACAACCACBBBCBAACBBACACBCABABAACCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCABABAABABACACBCBBBBABBCBBBBCBCCBBBABBAACCBBACBACBBBCBABBACCAACCBCBCCCCCAAAABBAABCBCABABAAAAACBABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCABBCBBAACCCABAACAACCACBBBCBAACBBACACBCABABAACCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCBCACACCBCBBCBABCCBABACABCAAABACBCCACBAAAABBBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCABBCBBAACCCABAACAACCACBBBCBAACBBACACBCABABAACCCCA.exe" start= auto displayName= "UserDataSvc_AABCBCACACCBCBBCBABCCBABACABCAAABACBCCACBAAAABBBACC"
  2⤵
  PID:3768
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCBCACACCBCBBCBABCCBABACABCAAABACBCCACBAAAABBBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCABBCBBAACCCABAACAACCACBBBCBAACBBACACBCABABAACCCCA.exe" start= auto displayName= "UserDataSvc_AABCBCACACCBCBBCBABCCBABACABCAAABACBCCACBAAAABBBACC"
    3⤵
    - Launches sc.exe
    PID:5572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCBCACACCBCBBCBABCCBABACABCAAABACBCCACBAAAABBBACC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5652
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCBCACACCBCBBCBABCCBABACABCAAABACBCCACBAAAABBBACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5732

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCAABACCCCBBBACBAAABCBBBACBCBBCCBCACABBAABCABCBBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCAABACCCCBBBACBAAABCBBBACBCBBCCBCACABBAABCABCBBCCC.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAABACBACCBBAACABCACCAACCACABBCBABBBABAAABABACABBAABCBCABCCCBCCAAACCBCABCCBBBACBCBABCACBBACBAABCCCCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAAAABCBAACBCBBBBCCBBCBBBACACCACACBBCCABBAABBBAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAABACBACCBBAACABCACCAACCACABBCBABBBABAAABABACABBAABCBCABCCCBCCAAACCBCABCCBBBACBCBABCACBBACBAABCCCCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAAAABCBAACBCBBBBCCBBCBBBACACCACACBBCCABBAABBBAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACAAAAABBBCBACCCBABCACAACBBCCAABCCBAABAACBCBACCBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAAAABCBAACBCBBBBCCBBCBBBACACCACACBBCCABBAABBBAABAB.exe" start= auto displayName= "UserDataSvc_ACAAAAABBBCBACCCBABCACAACBBCCAABCCBAABAACBCBACCBBAA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:456
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACAAAAABBBCBACCCBABCACAACBBCCAABCCBAABAACBCBACCBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAAAABCBAACBCBBBBCCBBCBBBACACCACACBBCCABBAABBBAABAB.exe" start= auto displayName= "UserDataSvc_ACAAAAABBBCBACCCBABCACAACBBCCAABCCBAABAACBCBACCBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACAAAAABBBCBACCCBABCACAACBBCCAABCCBAABAACBCBACCBBAA"
  2⤵
  PID:4304
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACAAAAABBBCBACCCBABCACAACBBCCAABCCBAABAACBCBACCBBAA"
    3⤵
    - Launches sc.exe
    PID:4280

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCCBCCBCBCBCABCCCACCBBCCCAAACACAACBBCBBCCBCCCAABBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCCBCCBCBCBCABCCCACCBBCCCAAACACAACBBCBBCCBCCCAABBCC.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBBBCCCCBBBAABACACCABBACCCCBBBBCBCCACCCCAABBAABBCBABBACCABCABCBCCCAAABCCBCBAAACBBCACCCACCBCCBCCBCCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBBCCCCBBBAABACACCABBACCCCBBBBCBCCACCCCAABBAABBCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBBBCCCCBBBAABACACCABBACCCCBBBBCBCCACCCCAABBAABBCBABBACCABCABCBCCCAAABCCBCBAAACBBCACCCACCBCCBCCBCCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBBCCCCBBBAABACACCABBACCCCBBBBCBCCACCCCAABBAABBCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCBBACBCCCACCBBBABCBBBACBBBCCACCACBBCAACBCBAAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBBCCCCBBBAABACACCABBACCCCBBBBCBCCACCCCAABBAABBCBABB.exe" start= auto displayName= "UserDataSvc_BCBCBBACBCCCACCBBBABCBBBACBBBCCACCACBBCAACBCBAAACBB"
  2⤵
  PID:7208
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCBBACBCCCACCBBBABCBBBACBBBCCACCACBBCAACBCBAAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBBCCCCBBBAABACACCABBACCCCBBBBCBCCACCCCAABBAABBCBABB.exe" start= auto displayName= "UserDataSvc_BCBCBBACBCCCACCBBBABCBBBACBBBCCACCACBBCAACBCBAAACBB"
    3⤵
    PID:7264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCBBACBCCCACCBBBABCBBBACBBBCCACCACBBCAACBCBAAACBB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7304
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCBBACBCCCACCBBBABCBBBACBBBCCACCACBBCAACBCBAAACBB"
    3⤵
    - Launches sc.exe
    PID:7360

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCCBCCBCBCBCABCCCACCBBCCCAAACACAACBBCBBCCBCCCAABBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCCBCCBCBCBCABCCCACCBBCCCAAACACAACBBCBBCCBCCCAABBCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCBCAACCCAACBCACBCACACBBCBABAABCAAABBAAABBACAABCCBACCBCCCCABACCCCCABBBBBBCAABBACCCBBCABAACACAAAACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBBCCCCBBBAABACACCABBACCCCBBBBCBCCACCCCAABBAABBCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCBCAACCCAACBCACBCACACBBCBABAABCAAABBAAABBACAABCCBACCBCCCCABACCCCCABBBBBBCAABBACCCBBCABAACACAAAACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBBCCCCBBBAABACACCABBACCCCBBBBCBCCACCCCAABBAABBCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBBAABBABCBBACCCCCCCBABCCCBBACBBBBCBAAABCBABAAAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBBCCCCBBBAABACACCABBACCCCBBBBCBCCACCCCAABBAABBCBABB.exe" start= auto displayName= "UserDataSvc_CBBBAABBABCBBACCCCCCCBABCCCBBACBBBBCBAAABCBABAAAABA"
  2⤵
  PID:7256
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBBAABBABCBBACCCCCCCBABCCCBBACBBBBCBAAABCBABAAAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBBCCCCBBBAABACACCABBACCCCBBBBCBCCACCCCAABBAABBCBABB.exe" start= auto displayName= "UserDataSvc_CBBBAABBABCBBACCCCCCCBABCCCBBACBBBBCBAAABCBABAAAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:7420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBBAABBABCBBACCCCCCCBABCCCBBACBBBBCBAAABCBABAAAABA"
  2⤵
  PID:7444
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBBAABBABCBBACCCCCCCBABCCCBBACBBBBCBAAABCBABAAAABA"
    3⤵
    - Launches sc.exe
    PID:7488

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCAABAACABAACBBBCBCACACBBCAAABCBCAABCCABABCABCAACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCAABAACABAACBBBCBCACACBBCAAABCBCAABCCABABCABCAACBA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCABCCACBBBACABBBABBAAACCABBAAABBAAACCBBBCBCABBBBACBABCCCBCCBBBACCAAAACBACCACAACACAACAACACCBABCCAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACACCCCCCCBBBCCACCBAACCCABCCCABBAAACAACCBCABACBCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCABCCACBBBACABBBABBAAACCABBAAABBAAACCBBBCBCABBBBACBABCCCBCCBBBACCAAAACBACCACAACACAACAACACCBABCCAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACACCCCCCCBBBCCACCBAACCCABCCCABBAAACAACCBCABACBCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABABABBBBABAACAABCBCAAABACCABAAAABCAACACBCCCBABACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACACCCCCCCBBBCCACCBAACCCABCCCABBAAACAACCBCABACBCABC.exe" start= auto displayName= "UserDataSvc_BABABABBBBABAACAABCBCAAABACCABAAAABCAACACBCCCBABACB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2612
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABABABBBBABAACAABCBCAAABACCABAAAABCAACACBCCCBABACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACACCCCCCCBBBCCACCBAACCCABCCCABBAAACAACCBCABACBCABC.exe" start= auto displayName= "UserDataSvc_BABABABBBBABAACAABCBCAAABACCABAAAABCAACACBCCCBABACB"
    3⤵
    - Launches sc.exe
    PID:2076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABABABBBBABAACAABCBCAAABACCABAAAABCAACACBCCCBABACB"
  2⤵
  PID:6064
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABABABBBBABAACAABCBCAAABACCABAAAABCAACACBCCCBABACB"
    3⤵
    - Launches sc.exe
    PID:3984

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACACCCACBBABCACBABBBCBBCBCBBBCBBABACAACBACACCBBABBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACACCCACBBABCACBABBBCBBCBCBBBCBBABACAACBACACCBBABBCB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABAABCACABBCCBAACCBBCACBABCACCCCAABCACBBCABACBBBBACBABAAABAACBACBAAABBBABACBABABABBBCCCBABCCAAAAABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAABCACABBCCBAACCBBCACBABCACCCCAABCACBBCABACBBBBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4156
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABAABCACABBCCBAACCBBCACBABCACCCCAABCACBBCABACBBBBACBABAAABAACBACBAAABBBABACBABABABBBCCCBABCCAAAAABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAABCACABBCCBAACCBBCACBABCACCCCAABCACBBCABACBBBBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCCCAABBCAABACBCBBCACCAAABACCBACBCACABAACBCBBBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAABCACABBCCBAACCBBCACBABCACCCCAABCACBBCABACBBBBACBA.exe" start= auto displayName= "UserDataSvc_AACCCCAABBCAABACBCBBCACCAAABACCBACBCACABAACBCBBBAAB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6120
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCCCAABBCAABACBCBBCACCAAABACCBACBCACABAACBCBBBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAABCACABBCCBAACCBBCACBABCACCCCAABCACBBCABACBBBBACBA.exe" start= auto displayName= "UserDataSvc_AACCCCAABBCAABACBCBBCACCAAABACCBACBCACABAACBCBBBAAB"
    3⤵
    - Launches sc.exe
    PID:1792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCCCAABBCAABACBCBBCACCAAABACCBACBCACABAACBCBBBAAB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5188
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCCCAABBCAABACBCBBCACCAAABACCBACBCACABAACBCBBBAAB"
    3⤵
    - Launches sc.exe
    PID:3996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACACBBABAAAACBBAAABACAABCACBBBCCCABCCACBBBACBCAABCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACACBBABAAAACBBAAABACAABCACBBBCCCABCCACBBBACBCAABCBB.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACACCBCBABAABAACBBACCBCCCACBCAAAACBCBACCAACABABBCCBCCABCCCBBBACCCCCACBACABAACACBCBCACBCCBBBCBACCBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABCBBCCABACBCCBBAAACABBCACCCABACAAABBCCABAACCAACBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACACCBCBABAABAACBBACCBCCCACBCAAAACBCBACCAACABABBCCBCCABCCCBBBACCCCCACBACABAACACBCBCACBCCBBBCBACCBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABCBBCCABACBCCBBAAACABBCACCCABACAAABBCCABAACCAACBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCABCCBBAAABBCBCACBCCBAACBBACCCACCBBCCACBBCCBBABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABCBBCCABACBCCBBAAACABBCACCCABACAAABBCCABAACCAACBBA.exe" start= auto displayName= "UserDataSvc_CCCABCCBBAAABBCBCACBCCBAACBBACCCACCBBCCACBBCCBBABCA"
  2⤵
  PID:5648
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCABCCBBAAABBCBCACBCCBAACBBACCCACCBBCCACBBCCBBABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABCBBCCABACBCCBBAAACABBCACCCABACAAABBCCABAACCAACBBA.exe" start= auto displayName= "UserDataSvc_CCCABCCBBAAABBCBCACBCCBAACBBACCCACCBBCCACBBCCBBABCA"
    3⤵
    PID:3012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCABCCBBAAABBCBCACBCCBAACBBACCCACCBBCCACBBCCBBABCA"
  2⤵
  PID:4696
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCABCCBBAAABBCBCACBCCBAACBBACCCACCBBCCACBBCCBBABCA"
    3⤵
    - Launches sc.exe
    PID:4260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAABCACABBCCBAACCBBCACBABCACCCCAABCACBBCABACBBBBACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAABCACABBCCBAACCBBCACBABCACCCCAABCACBBCABACBBBBACBA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACACACAACABCBBAAAACCBABACCAABAABBABCBCBAACAABCBBBBBACCCCCABABBBACBCACCACBBBBAAABBBCBABABBCBBABCCABCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACACACAACABCBBAAAACCBABACCAABAABBABCBCBAACAABCBBBBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACACACAACABCBBAAAACCBABACCAABAABBABCBCBAACAABCBBBBBACCCCCABABBBACBCACCACBBBBAAABBBCBABABBCBBABCCABCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACACACAACABCBBAAAACCBABACCAABAABBABCBCBAACAABCBBBBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACAAABBACACACCACBACCABBBCACCACAABABCBAACCBABBBACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACACACAACABCBBAAAACCBABACCAABAABBABCBCBAACAABCBBBBBAC.exe" start= auto displayName= "UserDataSvc_AACAAABBACACACCACBACCABBBCACCACAABABCBAACCBABBBACCC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7700
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACAAABBACACACCACBACCABBBCACCACAABABCBAACCBABBBACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACACACAACABCBBAAAACCBABACCAABAABBABCBCBAACAABCBBBBBAC.exe" start= auto displayName= "UserDataSvc_AACAAABBACACACCACBACCABBBCACCACAABABCBAACCBABBBACCC"
    3⤵
    - Launches sc.exe
    PID:7756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACAAABBACACACCACBACCABBBCACCACAABABCBAACCBABBBACCC"
  2⤵
  PID:7776
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACAAABBACACACCACBACCABBBCACCACAABABCBAACCBABBBACCC"
    3⤵
    PID:7824

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCABBCBBAACCCABAACAACCACBBBCBAACBBACACBCABABAACCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCABBCBBAACCCABAACAACCACBBBCBAACBBACACBCABABAACCCCA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBABABCABABBACCCABBCCBCBACACAAABABACBBAACBAABCCBBACCCBAACAABBABCACABACACACBABBCCACBABCCCBBAABCACBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACCABCBCACBCACBABCBCBCAABBCBABBACACABAACABCBBAACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBABABCABABBACCCABBCCBCBACACAAABABACBBAACBAABCCBBACCCBAACAABBABCACABACACACBABBCCACBABCCCBBAABCACBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACCABCBCACBCACBABCBCBCAABBCBABBACACABAACABCBBAACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBABCBABABACCACCABCCACAAABBCCBAABAACCCBBAABBAACCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACCABCBCACBCACBABCBCBCAABBCBABBACACABAACABCBBAACCBB.exe" start= auto displayName= "UserDataSvc_CBBABCBABABACCACCABCCACAAABBCCBAABAACCCBBAABBAACCCB"
  2⤵
  PID:7912
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBABCBABABACCACCABCCACAAABBCCBAABAACCCBBAABBAACCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACCABCBCACBCACBABCBCBCAABBCBABBACACABAACABCBBAACCBB.exe" start= auto displayName= "UserDataSvc_CBBABCBABABACCACCABCCACAAABBCCBAABAACCCBBAABBAACCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:8012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBABCBABABACCACCABCCACAAABBCCBAABAACCCBBAABBAACCCB"
  2⤵
  PID:8044
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBABCBABABACCACCABCCACAAABBCCBAABAACCCBBAABBAACCCB"
    3⤵
    - Launches sc.exe
    PID:7936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBACCAAAAABABBCBCCBAAABCCCAACAABAABBAACBBACACCCCCACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBACCAAAAABABBCBCCBAAABCCCAACAABAABBAACBBACACCCCCACCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:5028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCAABBABBBBABCBCBAAAAABBBBBCBCBBCCACCBBCBBACCCCAAAABCABBACBAAAACCABACBACACBBBBCCABBACAAABBCCAACBBCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCCCACACAAABCABABCBBCCBBBCABBCCACCCBBACBCCCCABBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCAABBABBBBABCBCBAAAAABBBBBCBCBBCCACCBBCBBACCCCAAAABCABBACBAAAACCABACBACACBBBBCCABBACAAABBCCAACBBCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCCCACACAAABCABABCBBCCBBBCABBCCACCCBBACBCCCCABBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABABCCCABAACBCBCAABACABAAACACBCAACBCBBCACBCBABBBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCCCACACAAABCABABCBBCCBBBCABBCCACCCBBACBCCCCABBACBC.exe" start= auto displayName= "UserDataSvc_ABABCCCABAACBCBCAABACABAAACACBCAACBCBBCACBCBABBBCAB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1016
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABABCCCABAACBCBCAABACABAAACACBCAACBCBBCACBCBABBBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCCCACACAAABCABABCBBCCBBBCABBCCACCCBBACBCCCCABBACBC.exe" start= auto displayName= "UserDataSvc_ABABCCCABAACBCBCAABACABAAACACBCAACBCBBCACBCBABBBCAB"
    3⤵
    - Launches sc.exe
    PID:5112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABABCCCABAACBCBCAABACABAAACACBCAACBCBBCACBCBABBBCAB"
  2⤵
  PID:1212
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABABCCCABAACBCBCAABACABAAACACBCAACBCBBCACBCBABBBCAB"
    3⤵
    - Launches sc.exe
    PID:6264

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACCCBBCAABCCAACACAABABBABABBBABBCBCBBABBCAAABBCCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACCCBBCAABCCAACACAABABBABABBBABBCBCBBABBCAAABBCCACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBCBCAACCACBBACCBBCABBACBCCCABBABBAAACBCCBABBCABBCCBBACCABBBAAABCBACACACBBBCCCBAAAABACBACABABBABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCAABACAACCBACCAACAACBBCAABAABCABABBBBABBCCBABCBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBCBCAACCACBBACCBBCABBACBCCCABBABBAAACBCCBABBCABBCCBBACCABBBAAABCBACACACBBBCCCBAAAABACBACABABBABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCAABACAACCBACCAACAACBBCAABAABCABABBBBABBCCBABCBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABBABAABBCABCBBABBBBBACBABCAAAABCABAABBCABACBBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCAABACAACCBACCAACAACBBCAABAABCABABBBBABBCCBABCBABA.exe" start= auto displayName= "UserDataSvc_CCABBABAABBCABCBBABBBBBACBABCAAAABCABAABBCABACBBCCB"
  2⤵
  PID:5580
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABBABAABBCABCBBABBBBBACBABCAAAABCABAABBCABACBBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCAABACAACCBACCAACAACBBCAABAABCABABBBBABBCCBABCBABA.exe" start= auto displayName= "UserDataSvc_CCABBABAABBCABCBBABBBBBACBABCAAAABCABAABBCABACBBCCB"
    3⤵
    - Launches sc.exe
    PID:5024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABBABAABBCABCBBABBBBBACBABCAAAABCABAABBCABACBBCCB"
  2⤵
  PID:5152
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABBABAABBCABCBBABBBBBACBABCAAAABCABAABBCABACBBCCB"
    3⤵
    PID:6372

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBACCAAAAABABBCBCCBAAABCCCAACAABAABBAACBBACACCCCCACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBACCAAAAABABBCBCCBAAABCCCAACAABAABBAACBBACACCCCCACCA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCACCCCCBACABBBCABABCACABCABABCCCCACAABCACCBCBABABCACCBAAAAABACBBBABABBCBCACBCCBCACCACAABACBCABBBCACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBCCACBACBCCBBBCCAAAACAAACABAABCBCCCCABAABACBCBABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCACCCCCBACABBBCABABCACABCABABCCCCACAABCACCBCBABABCACCBAAAAABACBBBABABBCBCACBCCBCACCACAABACBCABBBCACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBCCACBACBCCBBBCCAAAACAAACABAABCBCCCCABAABACBCBABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABABCCAAABBBABBCCCACBABACCCBCBBABABCAACBBAABAABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBCCACBACBCCBBBCCAAAACAAACABAABCBCCCCABAABACBCBABCA.exe" start= auto displayName= "UserDataSvc_BAABABCCAAABBBABBCCCACBABACCCBCBBABABCAACBBAABAABAA"
  2⤵
  PID:1784
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABABCCAAABBBABBCCCACBABACCCBCBBABABCAACBBAABAABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBCCACBACBCCBBBCCAAAACAAACABAABCBCCCCABAABACBCBABCA.exe" start= auto displayName= "UserDataSvc_BAABABCCAAABBBABBCCCACBABACCCBCBBABABCAACBBAABAABAA"
    3⤵
    PID:3416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABABCCAAABBBABBCCCACBABACCCBCBBABABCAACBBAABAABAA"
  2⤵
  PID:6308
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABABCCAAABBBABBCCCACBABACCCBCBBABABCAACBBAABAABAA"
    3⤵
    - Launches sc.exe
    PID:6472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACCCBBCAABCCAACACAABABBABABBBABBCBCBBABBCAAABBCCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACCCBBCAABCCAACACAABABBABABBBABBCBCBBABBCAAABBCCACC.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBABCBCCBBBABCACCACCCCBCABCCBCBBCBCAACAACCBAAABABCAAABBACABAABBABAABBBCABBCBBBACACAABCBCAABABAABCABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAABCABBBCACBABBAAAACABBBABACAABAAABBAAAACBAABBBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBABCBCCBBBABCACCACCCCBCABCCBCBBCBCAACAACCBAAABABCAAABBACABAABBABAABBBCABBCBBBACACAABCBCAABABAABCABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAABCABBBCACBABBAAAACABBBABACAABAAABBAAAACBAABBBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAABACCCCACCBBBBBBCCCBBBCBABABBACBACCAABABBBCCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAABCABBBCACBABBAAAACABBBABACAABAAABBAAAACBAABBBBAAA.exe" start= auto displayName= "UserDataSvc_BAAABACCCCACCBBBBBBCCCBBBCBABABBACBACCAABABBBCCABAC"
  2⤵
  PID:6240
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAAABACCCCACCBBBBBBCCCBBBCBABABBACBACCAABABBBCCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAABCABBBCACBABBAAAACABBBABACAABAAABBAAAACBAABBBBAAA.exe" start= auto displayName= "UserDataSvc_BAAABACCCCACCBBBBBBCCCBBBCBABABBACBACCAABABBBCCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAABACCCCACCBBBBBBCCCBBBCBABABBACBACCAABABBBCCABAC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6484
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAAABACCCCACCBBBBBBCCCBBBCBABABBACBACCAABABBBCCABAC"
    3⤵
    - Launches sc.exe
    PID:6552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAAAABCBAACBCBBBBCCBBCBBBACACCACACBBCCABBAABBBAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAAAABCBAACBCBBBBCCBBCBBBACACCACACBBCCABBAABBBAABAB.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCABCBCCBCBCCBCBBCCAAABAABAABAABBCCCACABBBCBBACACCCCCBCBABABAACBBAAACBABBCACBBACABAAABBBBCBBBBBACBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACCCBCBACABACBACCAABAABACBCBCCBCBBBBBCCAAABCBCACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCABCBCCBCBCCBCBBCCAAABAABAABAABBCCCACABBBCBBACACCCCCBCBABABAACBBAAACBABBCACBBACABAAABBBBCBBBBBACBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACCCBCBACABACBACCAABAABACBCBCCBCBBBBBCCAAABCBCACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCACABBCABAACCBCBBCAAACCACCBBCBBACBCBABBBABBBACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACCCBCBACABACBACCAABAABACBCBCCBCBBBBBCCAAABCBCACCBA.exe" start= auto displayName= "UserDataSvc_AACCACABBCABAACCBCBBCAAACCACCBBCBBACBCBABBBABBBACAC"
  2⤵
  PID:6932
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCACABBCABAACCBCBBCAAACCACCBBCBBACBCBABBBABBBACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACCCBCBACABACBACCAABAABACBCBCCBCBBBBBCCAAABCBCACCBA.exe" start= auto displayName= "UserDataSvc_AACCACABBCABAACCBCBBCAAACCACCBBCBBACBCBABBBABBBACAC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCACABBCABAACCBCBBCAAACCACCBBCBBACBCBABBBABBBACAC"
  2⤵
  PID:7008
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCACABBCABAACCBCBBCAAACCACCBBCBBACBCBABBBABBBACAC"
    3⤵
    - Launches sc.exe
    PID:7056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACACCCCCCCBBBCCACCBAACCCABCCCABBAAACAACCBCABACBCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACACCCCCCCBBBCCACCBAACCCABCCCABBAAACAACCBCABACBCABC.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCBBABCACCBBACBACCACACACCCCABBCBCACBABCABCBAABCABAAAACCBCCBBCCCBBBACBCBBBBABBACACBCABABACBBABBABCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCACABAAABBCAACACBBCCACBBAACCCBCCAABABBAABBABABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCBBABCACCBBACBACCACACACCCCABBCBCACBABCABCBAABCABAAAACCBCCBBCCCBBBACBCBBBBABBACACBCABABACBBABBABCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCACABAAABBCAACACBBCCACBBAACCCBCCAABABBAABBABABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAABCCACBCCCBBBBBABBBCCBBABAABCCBCCACBBCCBCCCCCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCACABAAABBCAACACBBCCACBBAACCCBCCAABABBAABBABABBCC.exe" start= auto displayName= "UserDataSvc_AAAABCCACBCCCBBBBBABBBCCBBABAABCCBCCACBBCCBCCCCCBBA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2808
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAABCCACBCCCBBBBBABBBCCBBABAABCCBCCACBBCCBCCCCCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCACABAAABBCAACACBBCCACBBAACCCBCCAABABBAABBABABBCC.exe" start= auto displayName= "UserDataSvc_AAAABCCACBCCCBBBBBABBBCCBBABAABCCBCCACBBCCBCCCCCBBA"
    3⤵
    PID:6756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAABCCACBCCCBBBBBABBBCCBBABAABCCBCCACBBCCBCCCCCBBA"
  2⤵
  PID:6928
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAAABCCACBCCCBBBBBABBBCCBBABAABCCBCCACBBCCBCCCCCBBA"
    3⤵
    PID:6712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABCBBCCABACBCCBBAAACABBCACCCABACAAABBCCABAACCAACBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABCBBCCABACBCCBBAAACABBCACCCABACAAABBCCABAACCAACBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAACCACAACBAACACCCAABCCCCACABCAACCABCCBABAABCCCCAAABBCCCABBCACABBCABCCCCACBAAABBBBCCCACCABBACBBCBBAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCACAACBAACACCCAABCCCCACABCAACCABCCBABAABCCCCAAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAACCACAACBAACACCCAABCCCCACABCAACCABCCBABAABCCCCAAABBCCCABBCACABBCABCCCCACBAAABBBBCCCACCABBACBBCBBAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCACAACBAACACCCAABCCCCACABCAACCABCCBABAABCCCCAAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACBAABCBBBCBBABAABABBCBCBAACBCCBCAAACBAAAABCBCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCACAACBAACACCCAABCCCCACABCAACCABCCBABAABCCCCAAABBC.exe" start= auto displayName= "UserDataSvc_ABACBAABCBBBCBBABAABABBCBCBAACBCCBCAAACBAAAABCBCBAA"
  2⤵
  PID:8076
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACBAABCBBBCBBABAABABBCBCBAACBCCBCAAACBAAAABCBCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCACAACBAACACCCAABCCCCACABCAACCABCCBABAABCCCCAAABBC.exe" start= auto displayName= "UserDataSvc_ABACBAABCBBBCBBABAABABBCBCBAACBCCBCAAACBAAAABCBCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:8136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACBAABCBBBCBBABAABABBCBCBAACBCCBCAAACBAAAABCBCBAA"
  2⤵
  PID:8160
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACBAABCBBBCBBABAABABBCBCBAACBCCBCAAACBAAAABCBCBAA"
    3⤵
    - Launches sc.exe
    PID:6748

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCCCACACAAABCABABCBBCCBBBCABBCCACCCBBACBCCCCABBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCCCACACAAABCABABCBBCCBBBCABBCCACCCBBACBCCCCABBACBC.exe
1⤵
- Executes dropped EXE
PID:3780

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCCCACACAAABCABABCBBCCBBBCABBCCACCCBBACBCCCCABBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCCCCACACAAABCABABCBBCCBBBCABBCCACCCBBACBCCCCABBACBC.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCCABBAAABABBBACCCBBCBACBABCBAAABBCABABCBAACABABABAABACBCABCCCBACCACCBCABBBCCAABABABCAACCAAACBACACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCABBAAABABBBACCCBBCBACBABCBAAABBCABABCBAACABABABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCCABBAAABABBBACCCBBCBACBABCBAAABBCABABCBAACABABABAABACBCABCCCBACCACCBCABBBCCAABABABCAACCAAACBACACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCABBAAABABBBACCCBBCBACBABCBAAABBCABABCBAACABABABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAACAAAAABBBABCBCCACCBABBACCABBABCACAAAABABBBCBABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCABBAAABABBBACCCBBCBACBABCBAAABBCABABCBAACABABABAA.exe" start= auto displayName= "UserDataSvc_AAACAAAAABBBABCBCCACCBABBACCABBABCACAAAABABBBCBABCA"
  2⤵
  PID:4328
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAACAAAAABBBABCBCCACCBABBACCABBABCACAAAABABBBCBABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCABBAAABABBBACCCBBCBACBABCBAAABBCABABCBAACABABABAA.exe" start= auto displayName= "UserDataSvc_AAACAAAAABBBABCBCCACCBABBACCABBABCACAAAABABBBCBABCA"
    3⤵
    PID:6288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAACAAAAABBBABCBCCACCBABBACCABBABCACAAAABABBBCBABCA"
  2⤵
  PID:6252
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAACAAAAABBBABCBCCACCBABBACCABBABCACAAAABABBBCBABCA"
    3⤵
    PID:6644

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCAABACAACCBACCAACAACBBCAABAABCABABBBBABBCCBABCBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCAABACAACCBACCAACAACBBCAABAABCABABBBBABBCCBABCBABA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBBACBCBACABCCBBBCBBBCBACAAACABBABAAAACCCAABACCCCACCBBBBCCBABBBCCCABCBAACAAACAABCACBACCCCABCBBCCCCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCACABACABBCACBACCABCBAAACCAABBABCCABAAACCBABCCCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBBACBCBACABCCBBBCBBBCBACAAACABBABAAAACCCAABACCCCACCBBBBCCBABBBCCCABCBAACAAACAABCACBACCCCABCBBCCCCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCACABACABBCACBACCABCBAAACCAABBABCCABAAACCBABCCCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBABBACBAABBACCBBCCACBAACBAAACBBABAABCBABCACBBBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCACABACABBCACBACCABCBAAACCAABBABCCABAAACCBABCCCBBBB.exe" start= auto displayName= "UserDataSvc_CCBABBACBAABBACCBBCCACBAACBAAACBBABAABCBABCACBBBAAB"
  2⤵
  PID:5268
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBABBACBAABBACCBBCCACBAACBAAACBBABAABCBABCACBBBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCACABACABBCACBACCABCBAAACCAABBABCCABAAACCBABCCCBBBB.exe" start= auto displayName= "UserDataSvc_CCBABBACBAABBACCBBCCACBAACBAAACBBABAABCBABCACBBBAAB"
    3⤵
    - Launches sc.exe
    PID:6700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBABBACBAABBACCBBCCACBAACBAAACBBABAABCBABCACBBBAAB"
  2⤵
  PID:5592
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBABBACBAABBACCBBCCACBAACBAAACBBABAABCBABCACBBBAAB"
    3⤵
    PID:6828

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAABCABBBCACBABBAAAACABBBABACAABAAABBAAAACBAABBBBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAABCABBBCACBABBAAAACABBBABACAABAAABBAAAACBAABBBBAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:6424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABBBCBACCABCBABBABACCABBBAAAACAACCBBCBAABBBABABBBBBABCBAABABBAACCACAAACABCCBBCCACACBBCBCBAAABBBCABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABBCBBBABCCBACCBAAAABBABBAABBBAAACAAABCCABBBBCBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABBBCBACCABCBABBABACCABBBAAAACAACCBBCBAABBBABABBBBBABCBAABABBAACCACAAACABCCBBCCACACBBCBCBAAABBBCABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABBCBBBABCCBACCBAAAABBABBAABBBAAACAAABCCABBBBCBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBBBABCBAAACBCCCCBBBABACACACCCBABBABAACCBBBBACABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABBCBBBABCCBACCBAAAABBABBAABBBAAACAAABCCABBBBCBAAB.exe" start= auto displayName= "UserDataSvc_CBBBBABCBAAACBCCCCBBBABACACACCCBABBABAACCBBBBACABCC"
  2⤵
  PID:7132
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBBBABCBAAACBCCCCBBBABACACACCCBABBABAACCBBBBACABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABBCBBBABCCBACCBAAAABBABBAABBBAAACAAABCCABBBBCBAAB.exe" start= auto displayName= "UserDataSvc_CBBBBABCBAAACBCCCCBBBABACACACCCBABBABAACCBBBBACABCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBBBABCBAAACBCCCCBBBABACACACCCBABBABAACCBBBBACABCC"
  2⤵
  PID:6984
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBBBABCBAAACBCCCCBBBABACACACCCBABBABAACCBBBBACABCC"
    3⤵
    - Launches sc.exe
    PID:5328

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBCCACBACBCCBBBCCAAAACAAACABAABCBCCCCABAABACBCBABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBCCACBACBCCBBBCCAAAACAAACABAABCBCCCCABAABACBCBABCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:6440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAABACBBACCCAAAAABCBCACACABCCCABACBBBAABCACCCCACAAAABCBBBBABACBACAAAAABACCBABBCBCCABCABACBCABABBBBBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCBBBCACABACCACBBACBAABCBABBACCBBBBBAAAAACAAACABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAABACBBACCCAAAAABCBCACACABCCCABACBBBAABCACCCCACAAAABCBBBBABACBACAAAAABACCBABBCBCCABCABACBCABABBBBBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCBBBCACABACCACBBACBAABCBABBACCBBBBBAAAAACAAACABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBBACABBACCACBBCCAACACBCABCAABCACAACAABBCBABCCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCBBBCACABACCACBBACBAABCBABBACCBBBBBAAAAACAAACABAC.exe" start= auto displayName= "UserDataSvc_CBCBBACABBACCACBBCCAACACBCABCAABCACAACAABBCBABCCACB"
  2⤵
  PID:1660
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBBACABBACCACBBCCAACACBCABCAABCACAACAABBCBABCCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCBBBCACABACCACBBACBAABCBABBACCBBBBBAAAAACAAACABAC.exe" start= auto displayName= "UserDataSvc_CBCBBACABBACCACBBCCAACACBCABCAABCACAACAABBCBABCCACB"
    3⤵
    - Launches sc.exe
    PID:6868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBBACABBACCACBBCCAACACBCABCAABCACAACAABBCBABCCACB"
  2⤵
  PID:368
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBBACABBACCACBBCCAACACBCABCAABCACAACAABBCBABCCACB"
    3⤵
    - Launches sc.exe
    PID:7136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBCCACBACBCCBBBCCAAAACAAACABAABCBCCCCABAABACBCBABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBCCACBACBCCBBBCCAAAACAAACABAABCBCCCCABAABACBCBABCA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBCABCABBABACABBABCBCACCCBACBCACBCCBCABBCCBACACBCCABBABAAAABACBBAACBABAAACBACCACBACCCBBBBCACBBBCAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCAABABCCCBBCCAACCBBACBBCCAAAACABCAAAACBABACABACABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBCABCABBABACABBABCBCACCCBACBCACBCCBCABBCCBACACBCCABBABAAAABACBBAACBABAAACBACCACBACCCBBBBCACBBBCAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCAABABCCCBBCCAACCBBACBBCCAAAACABCAAAACBABACABACABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCCBACCCBCABAABACAABBAAABCBBCBAAACCAAAACBCBAACBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCAABABCCCBBCCAACCBBACBBCCAAAACABCAAAACBABACABACABCAA.exe" start= auto displayName= "UserDataSvc_BCCCBACCCBCABAABACAABBAAABCBBCBAAACCAAAACBCBAACBBAA"
  2⤵
  PID:6656
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCCBACCCBCABAABACAABBAAABCBBCBAAACCAAAACBCBAACBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCAABABCCCBBCCAACCBBACBBCCAAAACABCAAAACBABACABACABCAA.exe" start= auto displayName= "UserDataSvc_BCCCBACCCBCABAABACAABBAAABCBBCBAAACCAAAACBCBAACBBAA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCCBACCCBCABAABACAABBAAABCBBCBAAACCAAAACBCBAACBBAA"
  2⤵
  PID:6588
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCCBACCCBCABAABACAABBAAABCBBCBAAACCAAAACBCBAACBBAA"
    3⤵
    PID:5232

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAABCABBBCACBABBAAAACABBBABACAABAAABBAAAACBAABBBBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAABCABBBCACBABBAAAACABBBABACAABAAABBAAAACBAABBBBAAA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBABBBBAAAAABCACBACBCCBAAAAAAAACAACBBACBAACAAAAACCBCABBBBCCBACABABBBBCABBBCAAABBBCCBCCACCCCAABCACCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBAAABBBCABBBACCCACBBBABBCBCCBBBCCBCACCBACCAABACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBABBBBAAAAABCACBACBCCBAAAAAAAACAACBBACBAACAAAAACCBCABBBBCCBACABABBBBCABBBCAAABBBCCBCCACCCCAABCACCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBAAABBBCABBBACCCACBBBABBCBCCBBBCCBCACCBACCAABACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBCCBCAABCBBACCCBBBACAAAABAACABBBBCAACCBACABBBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBAAABBBCABBBACCCACBBBABBCBCCBBBCCBCACCBACCAABACBCC.exe" start= auto displayName= "UserDataSvc_BCCBCCBCAABCBBACCCBBBACAAAABAACABBBBCAACCBACABBBAAA"
  2⤵
  PID:6292
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBCCBCAABCBBACCCBBBACAAAABAACABBBBCAACCBACABBBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBAAABBBCABBBACCCACBBBABBCBCCBBBCCBCACCBACCAABACBCC.exe" start= auto displayName= "UserDataSvc_BCCBCCBCAABCBBACCCBBBACAAAABAACABBBBCAACCBACABBBAAA"
    3⤵
    - Launches sc.exe
    PID:5712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBCCBCAABCBBACCCBBBACAAAABAACABBBBCAACCBACABBBAAA"
  2⤵
  PID:5632
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBCCBCAABCBBACCCBBBACAAAABAACABBBBCAACCBACABBBAAA"
    3⤵
    - Launches sc.exe
    PID:5476

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACCCBCBACABACBACCAABAABACBCBCCBCBBBBBCCAAABCBCACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACCCBCBACABACBACCAABAABACBCBCCBCBBBBBCCAAABCBCACCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:6908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBCABACCCBCCCBCCCACCAABABBACACACCBBCACAACCCCCBBBCCBBBABBABBACBACCAACBBBAACCBACABCBCABCBCBACBBBACABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCABABBBBBAACBCBBBCCAABBBCCABACBBCCCBBBACCCBBABCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBCABACCCBCCCBCCCACCAABABBACACACCBBCACAACCCCCBBBCCBBBABBABBACBACCAACBBBAACCBACABCBCABCBCBACBBBACABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCABABBBBBAACBCBBBCCAABBBCCABACBBCCCBBBACCCBBABCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCBCAAAABBCACBACABCCCACCBACCAABCAACCCACABCBCBCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCABABBBBBAACBCBBBCCAABBBCCABACBBCCCBBBACCCBBABCBBC.exe" start= auto displayName= "UserDataSvc_CBCCBCAAAABBCACBACABCCCACCBACCAABCAACCCACABCBCBCBBA"
  2⤵
  PID:7108
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCBCAAAABBCACBACABCCCACCBACCAABCAACCCACABCBCBCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCABABBBBBAACBCBBBCCAABBBCCABACBBCCCBBBACCCBBABCBBC.exe" start= auto displayName= "UserDataSvc_CBCCBCAAAABBCACBACABCCCACCBACCAABCAACCCACABCBCBCBBA"
    3⤵
    - Launches sc.exe
    PID:7400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCBCAAAABBCACBACABCCCACCBACCAABCAACCCACABCBCBCBBA"
  2⤵
  PID:7420
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCCBCAAAABBCACBACABCCCACCBACCAABCAACCCACABCBCBCBBA"
    3⤵
    - Launches sc.exe
    PID:7568

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACCCBCBACABACBACCAABAABACBCBCCBCBBBBBCCAAABCBCACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACCCBCBACABACBACCAABAABACBCBCCBCBBBBBCCAAABCBCACCBA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:7068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCBBACCABACBBCCCCABCCCCCABCCABBBCBAABBCAABCABAACCAABABCACCBBBABBACACCCCCBBCBBCBCCBCAAABBACBCCAABAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACCCBBBBBCCABAAABABBCCAAAACCCABABACACCCCCCACCBBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCBBACCABACBBCCCCABCCCCCABCCABBBCBAABBCAABCABAACCAABABCACCBBBABBACACCCCCBBCBBCBCCBCAAABBACBCCAABAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACCCBBBBBCCABAAABABBCCAAAACCCABABACACCCCCCACCBBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAACCABABBCCBCBAACBBCAAABCCCAACBABCCCBCBACCBAABCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACCCBBBBBCCABAAABABBCCAAAACCCABABACACCCCCCACCBBBAC.exe" start= auto displayName= "UserDataSvc_AAACCABABBCCBCBAACBBCAAABCCCAACBABCCCBCBACCBAABCCCC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7672
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAACCABABBCCBCBAACBBCAAABCCCAACBABCCCBCBACCBAABCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACCCBBBBBCCABAAABABBCCAAAACCCABABACACCCCCCACCBBBAC.exe" start= auto displayName= "UserDataSvc_AAACCABABBCCBCBAACBBCAAABCCCAACBABCCCBCBACCBAABCCCC"
    3⤵
    - Launches sc.exe
    PID:7716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAACCABABBCCBCBAACBBCAAABCCCAACBABCCCBCBACCBAABCCCC"
  2⤵
  PID:7760
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAACCABABBCCBCBAACBBCAAABCCCAACBABCCCBCBACCBAABCCCC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4604

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCABBAAABABBBACCCBBCBACBABCBAAABBCABABCBAACABABABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCABBAAABABBBACCCBBCBACBABCBAAABBCABABCBAACABABABAA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBAABBBCCABACCBCCBAABACABCABBCAACCBABCACCCABCAACABCCCBCCAAABABCCBCCBAACBBCCBACACBCBBBCBCCBACBAACCAAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCABABBBBCCACBBBACCABAACABCABCCBCCCCABBACACBABBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBAABBBCCABACCBCCBAABACABCABBCAACCBABCACCCABCAACABCCCBCCAAABABCCBCCBAACBBCCBACACBCBBBCBCCBACBAACCAAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCABABBBBCCACBBBACCABAACABCABCCBCCCCABBACACBABBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:7748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCABBCBBCCAAABAABACCAAACCBBABBBCACCBBCACCBCCABACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCABABBBBCCACBBBACCABAACABCABCCBCCCCABBACACBABBACB.exe" start= auto displayName= "UserDataSvc_ACCABBCBBCCAAABAABACCAAACCBBABBBCACCBBCACCBCCABACAC"
  2⤵
  PID:216
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCABBCBBCCAAABAABACCAAACCBBABBBCACCBBCACCBCCABACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCABABBBBCCACBBBACCABAACABCABCCBCCCCABBACACBABBACB.exe" start= auto displayName= "UserDataSvc_ACCABBCBBCCAAABAABACCAAACCBBABBBCACCBBCACCBCCABACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCABBCBBCCAAABAABACCAAACCBBABBBCACCBBCACCBCCABACAC"
  2⤵
  PID:408
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCABBCBBCCAAABAABACCAAACCBBABBBCACCBBCACCBCCABACAC"
    3⤵
    - Launches sc.exe
    PID:5180

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCACABACABBCACBACCABCBAAACCAABBABCCABAAACCBABCCCBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCACABACABBCACBACCABCBAAACCAABBABCCABAAACCBABCCCBBBB.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAACAAAABCBBCBCCAABBBACCBBCACAABBBCABAACAABABBBBCBACCABBCCCBACACACBABBAACBAABCBBBBBCCABCAACCCCACCCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCABBCBCCAABCBCBCACCBCABBACBCCCCCCCBCCAABBAABBBCCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAACAAAABCBBCBCCAABBBACCBBCACAABBBCABAACAABABBBBCBACCABBCCCBACACACBABBAACBAABCBBBBBCCABCAACCCCACCCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCABBCBCCAABCBCBCACCBCABBACBCCCCCCCBCCAABBAABBBCCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCACCCBACCAAABCCBCACCACACCCCBCBBCBBACAAAABCCBCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCABBCBCCAABCBCBCACCBCABBACBCCCCCCCBCCAABBAABBBCCABC.exe" start= auto displayName= "UserDataSvc_ACCCACCCBACCAAABCCBCACCACACCCCBCBBCBBACAAAABCCBCACB"
  2⤵
  PID:8016
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCACCCBACCAAABCCBCACCACACCCCBCBBCBBACAAAABCCBCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCABBCBCCAABCBCBCACCBCABBACBCCCCCCCBCCAABBAABBBCCABC.exe" start= auto displayName= "UserDataSvc_ACCCACCCBACCAAABCCBCACCACACCCCBCBBCBBACAAAABCCBCACB"
    3⤵
    - Launches sc.exe
    PID:656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCACCCBACCAAABCCBCACCACACCCCBCBBCBBACAAAABCCBCACB"
  2⤵
  PID:5348
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCACCCBACCAAABCCBCACCACACCCCBCBBCBBACAAAABCCBCACB"
    3⤵
    - Launches sc.exe
    PID:5696

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCBBBCACABACCACBBACBAABCBABBACCBBBBBAAAAACAAACABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCBBBCACABACCACBBACBAABCBABBACCBBBBBAAAAACAAACABAC.exe
1⤵
- Executes dropped EXE
PID:6948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCACABAAABBCAACACBBCCACBBAACCCBCCAABABBAABBABABBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCACABAAABBCAACACBBCCACBBAACCCBCCAABABBAABBABABBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6972

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCAABABCCCBBCCAACCBBACBBCCAAAACABCAAAACBABACABACABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCAABABCCCBBCCAACCBBACBBCCAAAACABCAAAACBABACABACABCAA.exe
1⤵
- Executes dropped EXE
PID:2752

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABBCBBBABCCBACCBAAAABBABBAABBBAAACAAABCCABBBBCBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABBCBBBABCCBACCBAAAABBABBAABBBAAACAAABCCABBBBCBAAB.exe
1⤵
- Executes dropped EXE
PID:2368

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABBCBBBABCCBACCBAAAABBABBAABBBAAACAAABCCABBBBCBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCABBCBBBABCCBACCBAAAABBABBAABBBAAACAAABCCABBBBCBAAB.exe
1⤵
- Executes dropped EXE
PID:5492

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCACABAAABBCAACACBBCCACBBAACCCBCCAABABBAABBABABBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCACABAAABBCAACACBBCCACBBAACCCBCCAABABBAABBABABBCC.exe
1⤵
- Executes dropped EXE
PID:5852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCBBBCACABACCACBBACBAABCBABBACCBBBBBAAAAACAAACABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCBBBCACABACCACBBACBAABCBABBACCBBBBBAAAAACAAACABAC.exe
1⤵
- Executes dropped EXE
PID:7104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCAABABCCCBBCCAACCBBACBBCCAAAACABCAAAACBABACABACABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCAABABCCCBBCCAACCBBACBBCCAAAACABCAAAACBABACABACABCAA.exe
1⤵
- Executes dropped EXE
PID:6092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBAAABBBCABBBACCCACBBBABBCBCCBBBCCBCACCBACCAABACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBAAABBBCABBBACCCACBBBABBCBCCBBBCCBCACCBACCAABACBCC.exe
1⤵
- Executes dropped EXE
PID:5296

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBAAABBBCABBBACCCACBBBABBCBCCBBBCCBCACCBACCAABACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBAAABBBCABBBACCCACBBBABBCBCCBBBCCBCACCBACCAABACBCC.exe
1⤵
- Executes dropped EXE
PID:5360

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBBCCCCBBBAABACACCABBACCCCBBBBCBCCACCCCAABBAABBCBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBBCCCCBBBAABACACCABBACCCCBBBBCBCCACCCCAABBAABBCBABB.exe
1⤵
- Executes dropped EXE
PID:7376

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBBCCCCBBBAABACACCABBACCCCBBBBCBCCACCCCAABBAABBCBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBBCCCCBBBAABACACCABBACCCCBBBBCBCCACCCCAABBAABBCBABB.exe
1⤵
- Executes dropped EXE
PID:7504

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACACACAACABCBBAAAACCBABACCAABAABBABCBCBAACAABCBBBBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACACACAACABCBBAAAACCBABACCAABAABBABCBCBAACAABCBBBBBAC.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACBBCCABCBBCCABBAACABCCCBCBABCABBCCCBACABBCAABCBCBABBBABABCABCACABCCBCCABCBCBACCBBACBCBCBCBCCBCBBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBCAABCCABCBCBBABACCCBABBABACCCCABCABAACCBBAACBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACBBCCABCBBCCABBAACABCCCBCBABCABBCCCBACABBCAABCBCBABBBABABCABCACABCCBCCABCBCBACCBBACBCBCBCBCCBCBBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBCAABCCABCBCBBABACCCBABBABACCCCABCABAACCBBAACBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABAABCACBBCBCCCBCABCBBACBCBAACCCCBCAABCACACCABCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBCAABCCABCBCBBABACCCBABBABACCCCABCABAACCBBAACBBCAB.exe" start= auto displayName= "UserDataSvc_CABAABCACBBCBCCCBCABCBBACBCBAACCCCBCAABCACACCABCCCB"
  2⤵
  PID:7652
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABAABCACBBCBCCCBCABCBBACBCBAACCCCBCAABCACACCABCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBCAABCCABCBCBBABACCCBABBABACCCCABCABAACCBBAACBBCAB.exe" start= auto displayName= "UserDataSvc_CABAABCACBBCBCCCBCABCBBACBCBAACCCCBCAABCACACCABCCCB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABAABCACBBCBCCCBCABCBBACBCBAACCCCBCAABCACACCABCCCB"
  2⤵
  PID:116
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABAABCACBBCBCCCBCABCBBACBCBAACCCCBCAABCACACCABCCCB"
    3⤵
    - Launches sc.exe
    PID:4972

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCACAACBAACACCCAABCCCCACABCAACCABCCBABAABCCCCAAABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCACAACBAACACCCAABCCCCACABCAACCABCCBABAABCCCCAAABBC.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCACCCBACCAAABCCBCACCACACCCCBCBBCBBACAAAABCCBCACBABCBAACBAAABBABABACBCCAAACCCABACCCCCABCACCCCAABBBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCACAABACCCAAABCCBABBBCACABAACAACCACCABCCACCBAABBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCACCCBACCAAABCCBCACCACACCCCBCBBCBBACAAAABCCBCACBABCBAACBAAABBABABACBCCAAACCCABACCCCCABCACCCCAABBBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCACAABACCCAAABCCBABBBCACABAACAACCACCABCCACCBAABBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCACABAABBABABCBCBCCCCAACCCCAABACCBAAAAAACBABACCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCACAABACCCAAABCCBABBBCACABAACAACCACCABCCACCBAABBCCC.exe" start= auto displayName= "UserDataSvc_ACCACABAABBABABCBCBCCCCAACCCCAABACCBAAAAAACBABACCCB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8056
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCACABAABBABABCBCBCCCCAACCCCAABACCBAAAAAACBABACCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCACAABACCCAAABCCBABBBCACABAACAACCACCABCCACCBAABBCCC.exe" start= auto displayName= "UserDataSvc_ACCACABAABBABABCBCBCCCCAACCCCAABACCBAAAAAACBABACCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCACABAABBABABCBCBCCCCAACCCCAABACCBAAAAAACBABACCCB"
  2⤵
  PID:2080
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCACABAABBABABCBCBCCCCAACCCCAABACCBAAAAAACBABACCCB"
    3⤵
    - Launches sc.exe
    PID:1932

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCABABBBBBAACBCBBBCCAABBBCCABACBBCCCBBBACCCBBABCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCABABBBBBAACBCBBBCCAABBBCCABACBBCCCBBBACCCBBABCBBC.exe
1⤵
PID:7584

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCABABBBBBAACBCBBBCCAABBBCCABACBBCCCBBBACCCBBABCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCABABBBBBAACBCBBBCCAABBBCCABACBBCCCBBBACCCBBABCBBC.exe
1⤵
PID:7600

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACCCBBBBBCCABAAABABBCCAAAACCCABABACACCCCCCACCBBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACCCBBBBBCCABAAABABBCCAAAACCCABABACACCCCCCACCBBBAC.exe
1⤵
PID:4912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACCABCBCACBCACBABCBCBCAABBCBABBACACABAACABCBBAACCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACCABCBCACBCACBABCBCBCAABBCBABBACACABAACABCBBAACCBB.exe
1⤵
PID:8136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBCAABCCABCBCBBABACCCBABBABACCCCABCABAACCBBAACBBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBCAABCCABCBCBBABACCCBABBABACCCCABCABAACCBBAACBBCAB.exe
1⤵
PID:2296

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCABABBBBCCACBBBACCABAACABCABCCBCCCCABBACACBABBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCABABBBBCCACBBBACCABAACABCABCCBCCCCABBACACBABBACB.exe
1⤵
PID:596

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCABBCBCCAABCBCBCACCBCABBACBCCCCCCCBCCAABBAABBBCCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCABBCBCCAABCBCBCACCBCABBACBCCCCCCCBCCAABBAABBBCCABC.exe
1⤵
PID:5496

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCACAABACCCAAABCCBABBBCACABAACAACCACCABCCACCBAABBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCACAABACCCAAABCCBABBBCACABAACAACCACCABCCACCBAABBCCC.exe
1⤵
PID:3868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

virus_log.txt

Path C:\Users\Admin\AppData\Local\Temp\virus_log.txt
Size 1KB
SHA256 7eeb466e882daf844a7f96acc6326b1b2734f21614dc5b23cbe733414e2271b0
MD5 285ceaf7496ccc1e8c7cc5d164f4ac67
SHA1 1d408c653e7ee9a1dfb58e047d27884a12b379ec
SHA512 63f3d29c0a030d4cfe6cd9821e7f62bf4570f07e596e4ae04e14d549521d56079da72923e9938e251ced8ce6005538acb5e7edbf08bb9b2af78e65a51efeb0ed
TLSH
T170416D32E4EBEC3BB222D486952AEF88C8E0F7977C882A50934445247BD5D33DD974C2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0024c81f1778355b8b807f4384b871549d7b2cb9db73b0996ea35dc1bf50e273
MD5 25c96dfc070a25492f5532b9a45e5cef
SHA1 e5e6ca2d7367567d294268f9b230f38f1ff56609
SHA512 f6a29b7378e7278cfda57213f8be84ce589ce98186beac80e30dc5bf8797506268ff60cbcfccce83bdf5a3b355147f5e14b421bed182719a905073f893b7c387
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0bdd749a0ad8897ce0470801d9b61e7869f8cc1dca9e9bb0cd36f788e16d9d0a
MD5 13e76dee62cd410aaef6a2c846056314
SHA1 8d3141afd41be3f8087df3773af4a62f426c8eee
SHA512 930298f39d8faea52c1c5bc1bbb52c51edd5d0fca971e6233620aa690493651b7f2ce60e90ec3d072377cbed97bc4a675ef49260735e41e16e03fd61c3936971
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fbb84a2afe984a572e828f63d2dca3954323e127e292b22cd55eeb31ac7f94cd
MD5 095dd5bb661d2a54273ab5c0a69f68a1
SHA1 48b1882f36031dc122e9b1856190420f62ebcee5
SHA512 edc18e393a057e6ced177e9d2bc8e9bfc1c8f6132b243c354ae9a6b475ec4afef3d3e946d2d0288342541da7cf73b88837aa786145390fc5b6c967f8bcdb45c4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a09488780782883bcd2a73c04ed3d80300d86317dd0f79ae050261312265a53d
MD5 d4fa14454f2b496a90748b5a722240ea
SHA1 abbc08681bbc6aa437f12ca5eece11333b9d2f8c
SHA512 e45f1fe96df3430aa3347aaa723ff82cf7720a21c16046b603856826eaefd966537b506be8f1d355dc478ac8c0fe3943dc46371249850f5b5ae0309ea40d555c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3fa794ff77c5effec63b0a41021f5dc1db418ba7c7c2ea89a65ece8b0a20d7d0
MD5 607815ec8e7ac1a181cfffb4bd6b0143
SHA1 d9f5f3d8df260b614a5e87004622bd6b0e867592
SHA512 c974b1b559c2270308e13e47f1e74b86d3d05b1bcbb4b06fc7beca3444428b39f8bf03b62584666bfc44e5f409de1467b38c281faf6ee3831752f1e90621178f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f1a14ecfd62e9b76bfac99a3162de1c01b941fe8e10b4da3ea0b82db0640a451
MD5 18743dcba2e4b04ad2abe9080cd1ef48
SHA1 9498436be15655289d51f59b576ef3107bf57d1b
SHA512 c66e4b0bddee8ca179c064609af78afbe63cbce2a1dbca8b659d8d706f1ca4c18768703c852b5c01304c92d7d642eea3980d511ac72ab337b53055641bd032b2
MD5 SHA1 SHA512

Submit Download

svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCAACAABAAAACBBABABAACABBCAACBACCCAAAAAACBBCBCAAAAAC.exe
Size 14.1MB
SHA256 ff0a2dd188041748e8fccaa39afd02a667fe39ce92262887e8740b3d1cf33a19
MD5 1740ff20ceac043f3d42572ec31442b0
SHA1 6eca744ece9bee9f492b5c8c14f9331fac83a336
SHA512 a57994912ddd2b61ed269f2c1273059b472813c7108de7e51c9430d0f0ac78b7fa74cc5103417d7cc3c919e3dfd73490f27ab329091c17ffb48d2cb6875cac9a
SSDEEP 98304:p4Tq4Tq4Tq4Tq4Tq4Tq4Tq4T6OU/jIEeQfoR/IuOFVjUu53:pxxxxxxxhFIF0wu1
TLSH
T1B8E68C02B6DD0069F0B30771DE7AA27AA935FCFEAE12D56E6549740E2572F00C929337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 b0ca5da042d07dc78f56e4e2ccdb5ddfc7b6f27f64315a3f3299522bb3552c33
MD5 5b447965c5561a5a241de06572c672be
SHA1 2d99a5e0f4a2828facbe73c94796c627fb5a5f3e
SHA512 4ccf9ea4bf0d9fb84025ea4e66248d682b29d54a8e40bf700d6726080a25095b6f58cabc1df129a53fc3fac82096707fdd0571d7f3f3e22dfa8ecafd14d14783
SSDEEP 96:oPqj1Qs4tf+wVu6qx1Xe4Fu8L+am41ua04aV6z+w0wet6A3P1IZbI4ZbRWj+wYtR:jjyUBxvJ9XW7KdeOcuU6
TLSH
T19F91A732E4E6EC77E232A8CB9629EBD24CD4B39F6CDC5644534D42286B98D32CC5D4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 d4712160e5ebf8b91958c73a16e813a6e37d85bcff3fec921676b29742eee982
MD5 2b64c8148ac5c85a76d2fad2bc9276d6
SHA1 088362daf1b60e7a1fd0d9eeeeb45ff493bf6dd2
SHA512 937d8527c70029445bfadc1a6d7adff01a838f4234f08324adf33413b1fa370d1753a8dbec991680c5d234e491175b66f5f5a8de070280ecacd21c248ab321f7
SSDEEP 96:oPqj1Qs4tf+wVu6qx1Xe4Fu8L+am41ua04aV6z+w0wet6A3P1IZbI4ZbRWj+wYty:jjyUBxvJ9XW7KdeOcuUhakzh7Yf6
TLSH
T1A9B1E832E4A6EC77F232A8C79619EBD24DD4B39F6CCC5A44534D4228AB98D32CC5D4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 0a3da4f3e8b4e6779657d14090ef3a8c022d599f9881084c14f4004cecb5ebe8
MD5 43b20c53b08322d08b3b355812e06c53
SHA1 ed9501ba208c5f786d77802cd51056582545f47b
SHA512 38dbce9d6e8cc41876e089bb532ec2aa8cdf154f93030891bfadabfbc8e551dfbc7a4fbf8d576902ccd42a657bdcccde5689c9bb3b2e5616e28e1de604e1f9d9
SSDEEP 96:oPqj1Qs4tf+wVu6qx1Xe4Fu8L+am41ua04aV6z+w0wet6A3P1IZbI4ZbRWj+wYtq:jjyUBxvJ9XW7KdeOcuUhakzh7YfhXCQw
TLSH
T167C1DB31E4A6EC77F232A8C79619EBD24CD8B39F6CCC5A44534D4228AB98D32CC5D4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 a2aa8931939f7fdd445fd7be9e41393b9d91fc93ec7e7b1b4d0e222a89bbf826
MD5 741e1c15cfe26515a21341853924d9f8
SHA1 7eaf9620550089918d3ec8cc263667664cbe32c3
SHA512 9a3e07b1061ff97c501c7dcc80e418916801a794a45a943fad6fbb2e9348e8c7fc0f10bc29882a10a1fd2313b92c714567477e29ddfbbbee2e63255261c4fd88
SSDEEP 192:jjyUBxvJ9XW7KdeOcuUhakzh7YfhXCQksWS+C:jeUBZJZW2deOcuUhakh7YfhXCQkbSP
TLSH
T1E1E1FC31E4E6EC77F232A8C79629DBD24DD8B39FACCC5A4453494228AB94D32CC5D4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 8KB
SHA256 ade4e6ffba72f7d29fbb81ab62c159c97d377e5a9cae0cd62cc9e75b061486ab
MD5 714bb34b2588af0d9f5a7a6cca416867
SHA1 5e66e52b66945c48e46602f5224d07c2ea562251
SHA512 178a547224fc6b2e1db9d3826ade50c0c14540eacfb37086eba42c998869999a8dbafc6ce8f24b4f014fd90c8a9cd1111b050c1ab3061045c6a9169b4808bee6
SSDEEP 192:jjyUBxvJ9XW7KdeOcuUhakzh7YfhXCQksWS+WE/ee:jeUBZJZW2deOcuUhakh7YfhXCQkbS3Ep
TLSH
T1AB02DB31E4A6EC77F232A8C79629DBD24DD4B39FACCC6A4453494228AF94E32CC5D4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 d60aa17622e1103a016cf1d68b70b4030ae835d4537d3a5bdfc549500681f66f
MD5 eaaf00df29f43a5782e4bd138962d3e9
SHA1 375c1424a56bf034d06d39b615a3fc7ec0b3733d
SHA512 0fe818f451458b2dfdcd268f9e34ba09373cf41de23f48053a5599e2ff22e8034b445dfc1cf77dc043d845eed847123aea79aa7f8ff6b56f17d1ba2243dfaa43
SSDEEP 192:jjyUBxvJ9XW7KdeOcuUhakzh7YfhXCQksWS+WE/eGN6vQ:jeUBZJZW2deOcuUhakh7YfhXCQkbS3E3
TLSH
T11812DB31E4A6EC77F232A8C79629DBD24DD8B39FACCC6A4453494228AF94D32CC5D4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 10KB
SHA256 052ca0683cab7b7ea907edad414e11a05a9101abe8470e13a7c6708b74788587
MD5 cfe71ca7b1c84832cf59359ca15098e6
SHA1 987b1d64c025c8a304e42d2872f4115c99da6f07
SHA512 109f5a9accdeb99d2560738c6af3b842b5798b40b09c75c0a944f64116ecbd2b91d8a47741887b1de3a517c41110f768ed6b330599df815ed478d826f4e3ee54
SSDEEP 192:jjyUBxvJ9XW7KdeOcuUhakzh7YfhXCQksWS+WE/eGN6vVBj:jeUBZJZW2deOcuUhakh7YfhXCQkbS3Eq
TLSH
T16422F932E4E6EC7BF23198C79629DBD14CE4B39F6CCC6A4453494228BB95E32CC5A4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 10KB
SHA256 915bb58e2acc362965c3a1f5fd39dc859090214dc665a4330a37d47ee60390a4
MD5 66173cad581da300d4ea2746edcba8f4
SHA1 163448400dc9a60628351e1f3e3e1fada944cb60
SHA512 a58f7a8c08c0b3611210f1b0194724c0c21c598e9f2ca3b48d5f9def6d5a92332dd52f720fcc3c103bb027b55bb06b955050a90b3f5e23d20a970ac016035d12
SSDEEP 192:jjyUBxvJ9XW7KdeOcuUhakzh7YfhXCQksWS+WE/eGN6vVBIZ:jeUBZJZW2deOcuUhakh7YfhXCQkbS3E3
TLSH
T10032F932E4E6EC7BF23198C79629DBD148E4B39F6CCC6A4453494228BB95E32CC5E4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 11KB
SHA256 cd6708f55f55407efd0b74267cf0d58add33ec7efdfa14295a60963ed5aec0f0
MD5 6ec155ea62f183f363913816b27589e6
SHA1 8a2d47c59b6f2a54c5a24b1aa3bbafd94c737f3f
SHA512 367cee5b13477f56923cedbfe66ef81331840c564d3ca5f92707dbcf5b80b1b0c8b5fcc7acc18308c91c1e59a0783c4ab7dbf14d120e96fbd345dbf0d9f6e6fc
SSDEEP 192:jjyUBxvJ9XW7KdeOcuUhakzh7YfhXCQksWS+WE/eGN6vVBImIN:jeUBZJZW2deOcuUhakh7YfhXCQkbS3Ej
TLSH
T110420A32E4E6EC7BF13198C796299BD148E4B39FACCC6A4453494228BB95E32CC5E4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 aafd2b9327bf5d27f4afd93f0f1221034ad5e4e7353fbdedf0161c0126e89278
MD5 0869db466fd73076f1f03587a5cc9c0f
SHA1 a7d67a05e7f79d30a76ae57828d66430f3f2783b
SHA512 7390adb03e00151602cf664ed94f686a8fbd335274627c52c1fa619b1a5609a5ae6edcb7904c502b4f1fc910eaa5b0d912cd89f43d077b6ed57faddeeccfc26a
SSDEEP 384:jeUBZJZW2deOcuUhakh7YfhXCQkbS3E/ZN6tBImQPFW:jeaZJZJdeOBMb4ExNSWx9W
TLSH
T19642F922E4E6EC7BF13298C79629DBD14CE4B39FACCC5A4453494228BB95E32CC5E4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 13KB
SHA256 460ab533a942960a8d51c8b2d407c6b5de83f67f85181df2bde44eb88ed98749
MD5 428ef234b3ca4aaf05161ec225d0daaf
SHA1 5e0d794ed2a74c847b4c52e9d860d285d295d7dc
SHA512 4a01e6a66685f7c4c67bd55a7e5bbd09fbb75fc043b654d5362fa07aa40422348c05683b32343a9aa288e8ade27a1f36aa7254d9edd6612ecac36d50c234c130
SSDEEP 384:jeUBZJZW2deOcuUhakh7YfhXCQkbS3E/ZN6tBImQPFkvc:jeaZJZJdeOBMb4ExNSWx9kU
TLSH
T1BE52FA32E4E6EC7BF23298C79629DBD148E4B39FACCC5A4453494228BB95D32CC5E4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 15KB
SHA256 0cc63ffbb66abad458d3da95fbc0316b8fa59414f8b8a163c7fc8e1d8a365488
MD5 5bd0f3901ce1d02194a1e6ab253c1a9e
SHA1 608a2d4d1c22d43272fd92a9cf62dddab34c2b1e
SHA512 582bd499c3216eb1533e8dc1f79ac91e0e53ad2d30d6a68ea4daf9f8489c3208a2e6bdbbc19ad0f5d70d0967764a5444fd47bbc3488598799e188bd7ea230306
SSDEEP 384:jeUBZJZW2deOcuUhakh7YfhXCQkbS3E/ZN6tBImQPFkvG5m5uTMD7:jeaZJZJdeOBMb4ExNSWx9k+5m5uTs
TLSH
T1DE621922E4E6EC7BF23198C79629DFD148E4B39F6CCC5A8453494228BB95E32CC5E4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 15KB
SHA256 97099553f37e3e8f980ece3854f82a3f719d6bc51608947684d28b5d82d3a3a1
MD5 11ed7c960d4f606699a5e6cf672c2ab4
SHA1 5de5f5dba0f93a28775b0f50c175e7899676ba11
SHA512 d208e901760cfc0ed75bfd1a6540bb44e2db685886b6d3cce37b66219692359449a33aa680b8293de8672511074556ad59091c8ab859dfe9f90cdb546cf9e0d8
SSDEEP 384:jeUBZJZW2deOcuUhakh7YfhXCQkbS3E/ZN6tBImQPFkvG5m5uTMD9:jeaZJZJdeOBMb4ExNSWx9k+5m5uT0
TLSH
T1C3621922E4E6EC7BF23198C79629DFD148E4B39F6CCC5A8453494228BB95E32CC5E4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 15KB
SHA256 d0cef1bfddace4e1d3b9c8a594070d0dc882d5ffa89d315ecf0f9c8d47d66bdf
MD5 03f8d9e09b03476032b8d410137b374f
SHA1 c208cc186bd5491ac02e78a621b1818b6fdc32f4
SHA512 6aa799647bd4ec02f8863183f1e899ffe6e2fd8eeb0d80097ef892eb38bccce4202bfd018af672d49fb733c832f1f0afd1faa81963bcb66ce576bbe0496b9677
SSDEEP 384:jeUBZJZW2deOcuUhakh7YfhXCQkbS3E/ZN6tBImQPFkvG5m5uTMDcH/:jeaZJZJdeOBMb4ExNSWx9k+5m5uT1f
TLSH
T1B2724B22E4E6EC7BF23198C79629DFD548E4B79B7CCC1A8053494228BB95E32CC5E4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 16KB
SHA256 7f3eb6bd3a8847d31b1db8580c29c263a723f06b4378471fcec3fb901e107e68
MD5 2d6b4d303e93cf301854d74345355c88
SHA1 393a24f451a6bf3487f4a191da541e09f5fecee7
SHA512 a968feae3c03d21f100ef2e024e776852bd2a2caa65f5e90d778881b0dbc3ca7b022d4252721e20533fc6cf2de3ea9095842f4c677ccdf3e73f48fe191259d5d
SSDEEP 384:jeUBZJZW2deOcuUhakh7YfhXCQkbS3E/ZN6tBImQPFkvG5m5uTMDcHc:jeaZJZJdeOBMb4ExNSWx9k+5m5uT18
TLSH
T1D1723C22E4E6EC7BF23198C79629DFD548D4B79B7CCC1A8053494224BBA5E32CC9E4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 17KB
SHA256 cdc37a45c4b8c699978fc1fa5bea66bdda349203c453feb53a7d679b74cbebcc
MD5 4746c5e3c6a7465d7b121ec46a56d8dd
SHA1 0a0b6af0fdd7f44ccf4c3f1c8f4500fcd8342ab9
SHA512 29cb29352e57754f257b10aeb7c2b962fb720829144c0d643f05c94f882236075a903ad5d651b9a7218790655e6d70a3373f530e02300b3ae8b8d8922cedff6d
SSDEEP 384:jeUBZJZW2deOcuUhakh7YfhXCQkbS3E/ZN6tBImQPFkvG5m5uTMDcHd41c9:jeaZJZJdeOBMb4ExNSWx9k+5m5uT194q
TLSH
T161823C22E4E6EC7BF23198C79629DFD548D4B79B7CCC1A8053494224BBA5E32CC9E4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 2cef4feb19f7fc2b8f0d074e87244a5fd1db396a376052d7a9b5690fb7e7b4cd
MD5 4f53fd0b2fa398f0a210c20748cea25a
SHA1 f3d31f86e39f6373ec3ef054bfcb8ed25c025ff3
SHA512 ac1824bfc33215d4e43e7e3b42e328cb1a96c7114173a0dc4c99b2b0096c49929ca8f91c0f8f3d884429bb3eeef0501f164cb5d76e069a3663e423cd4322b5bd
TLSH
T141213B32E4A6EC33F232A8CB951DEB915CE0B39FAC8C6644134D46296BA4D33CC4C8D5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 18KB
SHA256 2b8360dc00dd739272d6645e1b245ada8bf361dfde5b4828f36c922efcbd1339
MD5 f66d45486ffac1b21ab983f145128cd3
SHA1 88a1f66af0533067a328f0bcd4e0b88fb5eee730
SHA512 e324c5a6644ebaeb2724073a36f54f20f95f0cf66d68fe2139d849f65ff7d6c4ae31af826a9182f1835980ec160c77a2186fb6fd936df5d05c40d9e2de45433e
SSDEEP 384:jeUBZJZW2deOcuUhakh7YfhXCQkbS3E/ZN6tBImQPFkvG5m5uTMDcHd41ctCD7sR:jeaZJZJdeOBMb4ExNSWx9k+5m5uT194M
TLSH
T195823C22E4E6EC7BF23198C79629DBD14CE4B79F6CCC1A8453494224BBA5D32CC5E4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 97d99ac4f78ffeeff124ad00b9d1912871d5c069c8d98aa9712bc5996af4ac13
MD5 2d3cc2bb6ce569ae49e920d5e03beca7
SHA1 0f84c672351c29f1062175a24a1ccf6b3c682563
SHA512 2dfe8420f3bf50243e7dc19c4a714f3ee2eb64d0ec1ee22264135b0321c8f8882931829a8ca040bc48b26efd4d8b03c2dcaa5f307b9c1f0ddc9192f7d79def92
TLSH
T11941EB32E4A6EC37F23268CB911DAB925DD0B35FAC886A44138D43287B94D32CC598D5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 c6a08907c942a19f091b0186b80f402f81e1aa9c9cfbefb32ced54347de49f70
MD5 f670dc4eb57b5963b2c58c6dddbb7dbb
SHA1 2fc8a4fdbc613bfe1624d42d0a97051825754e16
SHA512 94ccb0bf75c7d0b8f7c8de2aacd5b7fb8115e3b0cdae330882ffd964d6840755a75fbbdc790cd90484b6dee7cd64584f92d1be41703d66a2df23d46cfee52c4e
TLSH
T1E141C632E4E6EC37F232A8CB951DAB914DE4B39FAC885A44138D43287B94D32CC5D8D5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 bb31288b1adc441468ae9e8c2a58adcbb5408bf9d8a64b60b0851b6850d635b7
MD5 11afcba790da37b83c2f408ebba9ea23
SHA1 e95e67ba2027293ef00aed7de724ae72e953b0ee
SHA512 35b544ec0348dbf46e9b9540855cf49560427dad88934d4713c6a797dd089b98bd4e8176f9d57a038f59ea01e802ddb1c3aadae46226abdbf26e59c7d1894ec9
TLSH
T14651D732E4E6EC77F232A8CB951DAB924DD4B39FACDC6A44134942287B94D32CC5D8D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 e73a8e80f83cd5d9227107b74f5e719279e6bdb3e5c1bceaa6a7c42641d9965b
MD5 53902db07bea169ffaf3e4e145849119
SHA1 023d8696e7589ac91f598bd8ce41fa3dfc58dc0f
SHA512 8b2149313949da215c0994d99316bb74fc3abb98aac03ee17a1a07fc47593cffa069cb0614ab5ca0b9473bd79d93b411d8a4bff23699dc1b167e80cc54f2c9ff
TLSH
T12F81A732E4E6EC77F232A4CB9629EBD24DD4B39F6C9C6644134942287B98D32CC5D4D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/636-124-0x0000000000B10000-0x0000000000B32000-memory.dmp

Download

memory/636-186-0x0000000000B10000-0x0000000000B32000-memory.dmp

Download

memory/936-521-0x0000000000F60000-0x0000000000F82000-memory.dmp

Download

memory/936-390-0x0000000000F60000-0x0000000000F82000-memory.dmp

Download

memory/1280-643-0x0000000000800000-0x0000000000822000-memory.dmp

Download

memory/1280-920-0x0000000000800000-0x0000000000822000-memory.dmp

Download

memory/1364-868-0x0000000000AA0000-0x0000000000AC2000-memory.dmp

Download

memory/1388-644-0x0000000000800000-0x0000000000822000-memory.dmp

Download

memory/1388-921-0x0000000000800000-0x0000000000822000-memory.dmp

Download

memory/1992-118-0x0000000000060000-0x0000000000082000-memory.dmp

Download

memory/1992-71-0x0000000000060000-0x0000000000082000-memory.dmp

Download

memory/2096-258-0x0000000000CC0000-0x0000000000CE2000-memory.dmp

Download

memory/2096-348-0x0000000000CC0000-0x0000000000CE2000-memory.dmp

Download

memory/2624-228-0x0000000000F20000-0x0000000000F42000-memory.dmp

Download

memory/2624-343-0x0000000000F20000-0x0000000000F42000-memory.dmp

Download

memory/2628-923-0x0000000000510000-0x0000000000532000-memory.dmp

Download

memory/2680-366-0x0000000000CD0000-0x0000000000CF2000-memory.dmp

Download

memory/2680-566-0x0000000000CD0000-0x0000000000CF2000-memory.dmp

Download

memory/2832-784-0x0000000000F00000-0x0000000000F22000-memory.dmp

Download

memory/3020-474-0x00000000002E0000-0x0000000000302000-memory.dmp

Download

memory/3020-305-0x00000000002E0000-0x0000000000302000-memory.dmp

Download

memory/3024-36-0x00000000001D0000-0x00000000001F2000-memory.dmp

Download

memory/3024-16-0x00000000001D0000-0x00000000001F2000-memory.dmp

Download

memory/3044-145-0x0000000000440000-0x0000000000462000-memory.dmp

Download

memory/3080-187-0x0000000000B10000-0x0000000000B32000-memory.dmp

Download

memory/3080-125-0x0000000000B10000-0x0000000000B32000-memory.dmp

Download

memory/3128-795-0x00000000001D0000-0x00000000001F2000-memory.dmp

Download

memory/3300-277-0x0000000000090000-0x00000000000B2000-memory.dmp

Download

memory/3300-463-0x0000000000090000-0x00000000000B2000-memory.dmp

Download

memory/3488-698-0x0000000000810000-0x0000000000832000-memory.dmp

Download

memory/3488-472-0x0000000000810000-0x0000000000832000-memory.dmp

Download

memory/3568-344-0x0000000000C00000-0x0000000000C22000-memory.dmp

Download

memory/3844-304-0x0000000000440000-0x0000000000462000-memory.dmp

Download

memory/3844-127-0x0000000000440000-0x0000000000462000-memory.dmp

Download

memory/4168-50-0x00000000001D0000-0x00000000001F2000-memory.dmp

Download

memory/4168-17-0x00000000001D0000-0x00000000001F2000-memory.dmp

Download

memory/4308-102-0x0000000000CE0000-0x0000000000D02000-memory.dmp

Download

memory/4560-465-0x0000000000700000-0x0000000000722000-memory.dmp

Download

memory/4560-354-0x0000000000700000-0x0000000000722000-memory.dmp

Download

memory/4620-257-0x0000000000020000-0x0000000000042000-memory.dmp

Download

memory/4620-162-0x0000000000020000-0x0000000000042000-memory.dmp

Download

memory/4740-96-0x0000000000060000-0x0000000000082000-memory.dmp

Download

memory/4740-123-0x0000000000060000-0x0000000000082000-memory.dmp

Download

memory/4764-473-0x0000000000810000-0x0000000000832000-memory.dmp

Download

memory/4764-679-0x0000000000810000-0x0000000000832000-memory.dmp

Download

memory/4776-0-0x00000000004B0000-0x00000000004D2000-memory.dmp

Download

memory/4776-15-0x00000000004B0000-0x00000000004D2000-memory.dmp

Download

memory/4844-948-0x0000000000AA0000-0x0000000000AC2000-memory.dmp

Download

memory/4900-524-0x0000000000F60000-0x0000000000F82000-memory.dmp

Download

memory/4900-434-0x0000000000F60000-0x0000000000F82000-memory.dmp

Download

memory/4908-449-0x0000000000700000-0x0000000000722000-memory.dmp

Download

memory/4908-351-0x0000000000700000-0x0000000000722000-memory.dmp

Download

memory/5028-867-0x0000000000510000-0x0000000000532000-memory.dmp

Download

memory/5092-949-0x0000000000860000-0x0000000000882000-memory.dmp

Download

memory/5160-561-0x0000000000220000-0x0000000000242000-memory.dmp

Download

memory/5160-663-0x0000000000220000-0x0000000000242000-memory.dmp

Download

memory/5292-522-0x00000000000C0000-0x00000000000E2000-memory.dmp

Download

memory/5340-699-0x00000000002D0000-0x00000000002F2000-memory.dmp

Download

memory/5452-678-0x0000000000A80000-0x0000000000AA2000-memory.dmp

Download

memory/5452-567-0x0000000000A80000-0x0000000000AA2000-memory.dmp

Download

memory/5512-754-0x00000000003D0000-0x00000000003F2000-memory.dmp

Download

memory/5628-525-0x0000000000A10000-0x0000000000A32000-memory.dmp

Download

memory/5704-798-0x00000000005D0000-0x00000000005F2000-memory.dmp

Download

memory/5884-540-0x0000000000D80000-0x0000000000DA2000-memory.dmp

Download