591ddbb54a545842a189be259e690cac15aa3e99ea86fffce4aa9c65c35dd428

Analysis

max time kernel
119s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_0acaa9a8ba9bf8b69f8dbb9ec5c4f7df_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 41.2MB
Sample260720-d495jsgy2z
SHA256 591ddbb54a545842a189be259e690cac15aa3e99ea86fffce4aa9c65c35dd428
MD5 0acaa9a8ba9bf8b69f8dbb9ec5c4f7df
SHA1 e6d2258e470eb02a6c35c90ba1984b1e2b7412a8
SHA512 0ab52c614af2b4d1c32261c4e67b463e7313bdc1984387a1f5ce0863d68c2f9387c4df0ebe027046167cafeeef267b5fa50ba8a12c60fa6f7b5bba81b22f921b
SSDEEP 98304:z4TD4TD4TD4T5OU/jIEeQfoR/IuOFVjUu5A:z000SFIF0wuG
TLSH
T1C0978E01FADA00B5F0730670DDBAE27A5935FDE99912C96EF64DA50F2633F10C929326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4ae-10.dat	INDICATOR_EXE_Packed_Fody

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	2026-07-20_0acaa9a8ba9bf8b69f8dbb9ec5c4f7df_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BACCBCACCBCACCCACCBCCCCABCABCCACCBCACAAACCACACAAAAAABBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe

Executes dropped EXE 33 IoCs

pid	Process
476	svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe
3228	svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe
4644	svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe
4796	svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe
4504	svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe
3500	svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe
4488	svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe
3220	svchost_BACCBCACCBCACCCACCBCCCCABCABCCACCBCACAAACCACACAAAAAABBC.exe
1408	svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe
4236	svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe
5932	svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe
3108	svchost_BCCCBBABBCACCBBAACCAAACCBBCCABCBABCCCBCABABBCBBCBCBAAAA.exe
5676	svchost_BCCCBBABBCACCBBAACCAAACCBBCCABCBABCCCBCABABBCBBCBCBAAAA.exe
1852	svchost_BCBAABCBCCABCABACCCCBBAAABCCCBBCCBBCBABBACAAABCBBBACAAA.exe
1988	svchost_BCBAABCBCCABCABACCCCBBAAABCCCBBCCBBCBABBACAAABCBBBACAAA.exe
4104	svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe
1300	svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe
2996	svchost_CAAAABACBBBBACACCBCABAABBACBBBACCBCBACBAAAACBBCCAACAABA.exe
4232	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
4260	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
4468	svchost_CAAAABACBBBBACACCBCABAABBACBBBACCBCBACBAAAACBBCCAACAABA.exe
7084	svchost_BAABBCCABBCBBABBBCCCBACACBCACBAACBAABCCBCACCCCBCCBBCAAA.exe
7160	svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe
5000	svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe
6092	svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe
2736	svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe
5700	svchost_ABACBAAABAACCBCBCBBACACCABBABCCBCBCCCCCABBABACBABACCCCC.exe
6872	svchost_CBBACCCCABABAAAABCACACCAABABACCABCBBBACBBBBBCCBACAAAAAB.exe
6904	svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe
7124	svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe
7116	svchost_BAABBCCABBCBBABBBCCCBACACBCACBAACBAABCCBCACCCCBCCBBCAAA.exe
252	svchost_CBBACCCCABABAAAABCACACCAABABACCABCBBBACBBBBBCCBACAAAAAB.exe
7096	svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAACAAACBCABBCBBABACBABCCACCCBCBBCBBCBBABBCBBCACBBBCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCBBABBCACCBBAACCAAACCBBCCABCBABCCCBCABABBCBBCBCBAAAA.exe"	svchost_BACCBCACCBCACCCACCBCCCCABCABCCACCBCACAAACCACACAAAAAABBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABABCBCCBAACAAAABBABBBACBCBBABBBBBAAAACACABBBCACBCACCBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe"	svchost_CAAAABACBBBBACACCBCABAABBACBBBACCBCBACBAAAACBBCCAACAABA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABACAAACBBCCABBACAAABCBBBBAACBACCCAABBABACBBCAACCCBCCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe"	svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACACACAAAACAACBBBABABCBCACCCACAACACAACACBACABCBABBBBBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe"	svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCCBCCBAAABBCACCBACBCBACCBBAAABABCCBCBAABBCBBBAAABAAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe"	svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACACBBBACBCACABCCBACBBCBACABBABAABBAAACBCBCABCBAAACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAAABACBBBBACACCBCABAABBACBBBACCBCBACBAAAACBBCCAACAABA.exe"	svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABABCBCCBAACAAAABBABBBACBCBBABBBBBAAAACACABBBCACBCACCBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe"	svchost_BCCCBBABBCACCBBAACCAAACCBBCCABCBABCCCBCABABBCBBCBCBAAAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCBCCACBBBCCABAABBCCBABBABCAABCABCBCCAACACCCACBAAACCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe"	svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAABBCCBCCCBAACCBBCBCCABBABCBCABAAABBCBBCCAACCBCBBBCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe"	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAACCABCBACCCBCAACBBCACCAABCCACCCACACBCACBCCABCAAAACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABBCCABBCBBABBBCCCBACACBCACBAACBAABCCBCACCCCBCCBBCAAA.exe"	svchost_BCBAABCBCCABCABACCCCBBAAABCCCBBCCBBCBABBACAAABCBBBACAAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBBABACCBACBCBACCACABCACAABABAABACCCBAAACCABAAACCAAABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe"	2026-07-20_0acaa9a8ba9bf8b69f8dbb9ec5c4f7df_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAABCBACCCCBCBCBBBCAABBCBCCCABBCCCAAACACCBABBCBABABACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe"	svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Øö£\SystemHelper.lnk	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Windows\SysWOW64\öŸ\SystemHelper.lnk	svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Uninstall.exe	svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe
File created	C:\Program Files\Common Files\DESIGNER\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bn-IN\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\km-KH\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\am-ET\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\vi-VN\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\qap`g`v~dtlq	svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hi-IN\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\be-BY\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uz-Latn-UZ\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\7-Zip\7zG.exe	svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\as-IN\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\eu-ES\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lb-LU\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mk-MK\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File opened for modification	C:\Program Files\7-Zip\Lang\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mr-IN\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-RS\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tt-RU\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cy-GB\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-MX\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\gl-ES\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\gu-IN\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ml-IN\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nn-NO\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ne-NP\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\7-Zip\7zFM.exe	svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\qap`g`v~dtlq	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
9640	sc.exe
4896	sc.exe
9996	sc.exe
8804	sc.exe
1692	sc.exe
4708	sc.exe
5012	sc.exe
3532	sc.exe
4564	sc.exe
5812	sc.exe
2636	sc.exe
7068	sc.exe
2448	sc.exe
6984	sc.exe
5628	sc.exe
4176	sc.exe
716	sc.exe
2396	sc.exe
5900	sc.exe
5108	sc.exe
6080	sc.exe
2760	sc.exe
6164	sc.exe
4584	sc.exe
7692	sc.exe
7600	sc.exe
6796	sc.exe
5692	sc.exe
4744	sc.exe
6724	sc.exe
7924	sc.exe
5276	sc.exe
2204	sc.exe
6952	sc.exe
7940	sc.exe
8024	sc.exe
5296	sc.exe
4628	sc.exe
4580	sc.exe
4964	sc.exe
6976	sc.exe
7092	sc.exe
5836	sc.exe
2408	sc.exe
7848	sc.exe
700	sc.exe
7000	sc.exe
6556	sc.exe
5048	sc.exe
7228	sc.exe
7624	sc.exe
6796	sc.exe
7100	sc.exe
7012	sc.exe
9632	sc.exe
5664	sc.exe
7148	sc.exe
3916	sc.exe
8064	sc.exe
1360	sc.exe
4208	sc.exe
6000	sc.exe
7020	sc.exe
7080	sc.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2604	cmd.exe
6540	cmd.exe
7576	cmd.exe
9680	cmd.exe
4852	cmd.exe
2856	cmd.exe
2948	cmd.exe
9564	cmd.exe
9928	cmd.exe
5724	cmd.exe
464	cmd.exe
7628	cmd.exe
8200	cmd.exe
8424	cmd.exe
9388	cmd.exe
5484	cmd.exe
7448	cmd.exe
7552	cmd.exe
8252	cmd.exe
396	cmd.exe
5980	cmd.exe
4200	cmd.exe
1964	cmd.exe
1336	cmd.exe
4856	cmd.exe
6420	cmd.exe
6972	cmd.exe
5640	cmd.exe
7916	cmd.exe
2012	cmd.exe
1120	cmd.exe
1756	cmd.exe
3012	cmd.exe
6196	cmd.exe
1948	cmd.exe
9008	cmd.exe
8532	cmd.exe
8368	cmd.exe
2388	cmd.exe
6000	cmd.exe
7212	cmd.exe
8376	cmd.exe
5740	cmd.exe
4584	cmd.exe
2020	cmd.exe
2024	cmd.exe
9476	cmd.exe
8316	cmd.exe
4180	cmd.exe
5140	cmd.exe
3768	cmd.exe
8300	cmd.exe
8824	cmd.exe
8028	cmd.exe
6176	cmd.exe
4464	cmd.exe
6992	cmd.exe
7896	cmd.exe
8012	cmd.exe
8356	cmd.exe
8928	cmd.exe
4860	cmd.exe
2084	cmd.exe
8924	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAAABACBBBBACACCBCABAABBACBBBACCBCBACBAAAACBBCCAACAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCBCACCBCACCCACCBCCCCABCABCCACCBCACAAACCACACAAAAAABBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCBBABBCACCBBAACCAAACCBBCCABCBABCCCBCABABBCBBCBCBAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 53 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2288	schtasks.exe
8552	schtasks.exe
8528	schtasks.exe
9932	schtasks.exe
10188	schtasks.exe
10208	schtasks.exe
8080	schtasks.exe
8640	schtasks.exe
7992	schtasks.exe
2140	schtasks.exe
4248	schtasks.exe
4872	schtasks.exe
3768	schtasks.exe
8796	schtasks.exe
10104	schtasks.exe
2252	schtasks.exe
4208	schtasks.exe
2004	schtasks.exe
6284	schtasks.exe
6832	schtasks.exe
4328	schtasks.exe
7736	schtasks.exe
8100	schtasks.exe
2880	schtasks.exe
3560	schtasks.exe
4420	schtasks.exe
5048	schtasks.exe
8072	schtasks.exe
9360	schtasks.exe
2420	schtasks.exe
9036	schtasks.exe
792	schtasks.exe
4132	schtasks.exe
5272	schtasks.exe
1752	schtasks.exe
7012	schtasks.exe
6876	schtasks.exe
700	schtasks.exe
1612	schtasks.exe
6124	schtasks.exe
4736	schtasks.exe
7928	schtasks.exe
9688	schtasks.exe
10148	schtasks.exe
2344	schtasks.exe
3808	schtasks.exe
956	schtasks.exe
6796	schtasks.exe
6500	schtasks.exe
2148	schtasks.exe
2800	schtasks.exe
8740	schtasks.exe
5864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4940	2026-07-20_0acaa9a8ba9bf8b69f8dbb9ec5c4f7df_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4940	2026-07-20_0acaa9a8ba9bf8b69f8dbb9ec5c4f7df_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3228	svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe
3228	svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe
4940	2026-07-20_0acaa9a8ba9bf8b69f8dbb9ec5c4f7df_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4940	2026-07-20_0acaa9a8ba9bf8b69f8dbb9ec5c4f7df_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
476	svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe
476	svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe
4644	svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe
4644	svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe
4796	svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe
4796	svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe
4488	svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe
4488	svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe
3220	svchost_BACCBCACCBCACCCACCBCCCCABCABCCACCBCACAAACCACACAAAAAABBC.exe
3220	svchost_BACCBCACCBCACCCACCBCCCCABCABCCACCBCACAAACCACACAAAAAABBC.exe
1408	svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe
1408	svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe
3500	svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe
3500	svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe
4504	svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe
4504	svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe
476	svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe
476	svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe
4236	svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe
4236	svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe
5932	svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe
5932	svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe
1988	svchost_BCBAABCBCCABCABACCCCBBAAABCCCBBCCBBCBABBACAAABCBBBACAAA.exe
1988	svchost_BCBAABCBCCABCABACCCCBBAAABCCCBBCCBBCBABBACAAABCBBBACAAA.exe
1852	svchost_BCBAABCBCCABCABACCCCBBAAABCCCBBCCBBCBABBACAAABCBBBACAAA.exe
1852	svchost_BCBAABCBCCABCABACCCCBBAAABCCCBBCCBBCBABBACAAABCBBBACAAA.exe
4232	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
4232	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
2996	svchost_CAAAABACBBBBACACCBCABAABBACBBBACCBCBACBAAAACBBCCAACAABA.exe
2996	svchost_CAAAABACBBBBACACCBCABAABBACBBBACCBCBACBAAAACBBCCAACAABA.exe
3108	svchost_BCCCBBABBCACCBBAACCAAACCBBCCABCBABCCCBCABABBCBBCBCBAAAA.exe
3108	svchost_BCCCBBABBCACCBBAACCAAACCBBCCABCBABCCCBCABABBCBBCBCBAAAA.exe
5676	svchost_BCCCBBABBCACCBBAACCAAACCBBCCABCBABCCCBCABABBCBBCBCBAAAA.exe
5676	svchost_BCCCBBABBCACCBBAACCAAACCBBCCABCBABCCCBCABABBCBBCBCBAAAA.exe
1300	svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe
1300	svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe
4468	svchost_CAAAABACBBBBACACCBCABAABBACBBBACCBCBACBAAAACBBCCAACAABA.exe
4104	svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe
4260	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
4260	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
4104	svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe
4468	svchost_CAAAABACBBBBACACCBCABAABBACBBBACCBCBACBAAAACBBCCAACAABA.exe
4488	svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe
4488	svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe
4796	svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe
4796	svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe
3220	svchost_BACCBCACCBCACCCACCBCCCCABCABCCACCBCACAAACCACACAAAAAABBC.exe
3220	svchost_BACCBCACCBCACCCACCBCCCCABCABCCACCBCACAAACCACACAAAAAABBC.exe
4260	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
4260	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
4104	svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe
4104	svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe
3500	svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe
3500	svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe
5932	svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe
5932	svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe
6092	svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe
6092	svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	2026-07-20_0acaa9a8ba9bf8b69f8dbb9ec5c4f7df_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	3228	svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe
Token: SeDebugPrivilege	476	svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe
Token: SeDebugPrivilege	4644	svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe
Token: SeDebugPrivilege	4796	svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe
Token: SeDebugPrivilege	4488	svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe
Token: SeDebugPrivilege	3220	svchost_BACCBCACCBCACCCACCBCCCCABCABCCACCBCACAAACCACACAAAAAABBC.exe
Token: SeDebugPrivilege	1408	svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe
Token: SeDebugPrivilege	3500	svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe
Token: SeDebugPrivilege	4236	svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe
Token: SeDebugPrivilege	5932	svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe
Token: SeDebugPrivilege	1988	svchost_BCBAABCBCCABCABACCCCBBAAABCCCBBCCBBCBABBACAAABCBBBACAAA.exe
Token: SeDebugPrivilege	4232	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
Token: SeDebugPrivilege	2996	svchost_CAAAABACBBBBACACCBCABAABBACBBBACCBCBACBAAAACBBCCAACAABA.exe
Token: SeDebugPrivilege	5676	svchost_BCCCBBABBCACCBBAACCAAACCBBCCABCBABCCCBCABABBCBBCBCBAAAA.exe
Token: SeDebugPrivilege	3108	svchost_BCCCBBABBCACCBBAACCAAACCBBCCABCBABCCCBCABABBCBBCBCBAAAA.exe
Token: SeDebugPrivilege	4260	svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
Token: SeDebugPrivilege	1852	svchost_BCBAABCBCCABCABACCCCBBAAABCCCBBCCBBCBABBACAAABCBBBACAAA.exe
Token: SeDebugPrivilege	4104	svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe
Token: SeDebugPrivilege	1300	svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe
Token: SeDebugPrivilege	4468	svchost_CAAAABACBBBBACACCBCABAABBACBBBACCBCBACBAAAACBBCCAACAABA.exe
Token: SeDebugPrivilege	6092	svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe
Token: SeDebugPrivilege	2736	svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4860	4940	2026-07-20_0acaa9a8ba9bf8b69f8dbb9ec5c4f7df_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	89
PID 4860 wrote to memory of 2252	4860	cmd.exe	91
PID 4940 wrote to memory of 5724	4940	2026-07-20_0acaa9a8ba9bf8b69f8dbb9ec5c4f7df_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	92
PID 5724 wrote to memory of 5108	5724	cmd.exe	95
PID 4940 wrote to memory of 3540	4940	2026-07-20_0acaa9a8ba9bf8b69f8dbb9ec5c4f7df_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	96
PID 3540 wrote to memory of 5692	3540	cmd.exe	98
PID 3228 wrote to memory of 4464	3228	svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe	101
PID 4464 wrote to memory of 792	4464	cmd.exe	103
PID 3228 wrote to memory of 396	3228	svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe	104
PID 396 wrote to memory of 4208	396	cmd.exe	106
PID 3228 wrote to memory of 1120	3228	svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe	107
PID 1120 wrote to memory of 5812	1120	cmd.exe	109
PID 476 wrote to memory of 2388	476	svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe	115
PID 2388 wrote to memory of 2344	2388	cmd.exe	117
PID 476 wrote to memory of 1912	476	svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe	118
PID 1912 wrote to memory of 4896	1912	cmd.exe	121
PID 476 wrote to memory of 356	476	svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe	122
PID 356 wrote to memory of 4628	356	cmd.exe	124
PID 4644 wrote to memory of 1336	4644	svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe	127
PID 1336 wrote to memory of 2880	1336	cmd.exe	129
PID 4796 wrote to memory of 3716	4796	svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe	130
PID 4644 wrote to memory of 4164	4644	svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe	132
PID 3716 wrote to memory of 3560	3716	cmd.exe	136
PID 4164 wrote to memory of 5628	4164	cmd.exe	137
PID 4796 wrote to memory of 2872	4796	svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe	138
PID 2872 wrote to memory of 4176	2872	cmd.exe	140
PID 4796 wrote to memory of 2020	4796	svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe	143
PID 2020 wrote to memory of 1692	2020	cmd.exe	145
PID 4488 wrote to memory of 4852	4488	svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe	147
PID 4852 wrote to memory of 2140	4852	cmd.exe	149
PID 4488 wrote to memory of 2604	4488	svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe	151
PID 3220 wrote to memory of 1804	3220	svchost_BACCBCACCBCACCCACCBCCCCABCABCCACCBCACAAACCACACAAAAAABBC.exe	153
PID 2604 wrote to memory of 4556	2604	cmd.exe	155
PID 1804 wrote to memory of 4248	1804	cmd.exe	192
PID 4488 wrote to memory of 5168	4488	svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe	157
PID 3220 wrote to memory of 2856	3220	svchost_BACCBCACCBCACCCACCBCCCCABCABCCACCBCACAAACCACACAAAAAABBC.exe	159
PID 5168 wrote to memory of 4580	5168	cmd.exe	161
PID 2856 wrote to memory of 2636	2856	cmd.exe	163
PID 3220 wrote to memory of 5980	3220	svchost_BACCBCACCBCACCCACCBCCCCABCABCCACCBCACAAACCACACAAAAAABBC.exe	166
PID 5980 wrote to memory of 6080	5980	cmd.exe	168
PID 1408 wrote to memory of 464	1408	svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe	169
PID 464 wrote to memory of 4132	464	cmd.exe	202
PID 1408 wrote to memory of 5856	1408	svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe	174
PID 5856 wrote to memory of 4964	5856	cmd.exe	176
PID 1408 wrote to memory of 4180	1408	svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe	177
PID 4180 wrote to memory of 2760	4180	cmd.exe	179
PID 3500 wrote to memory of 5812	3500	svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe	182
PID 5812 wrote to memory of 4420	5812	cmd.exe	184
PID 3500 wrote to memory of 4816	3500	svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe	188
PID 4816 wrote to memory of 2204	4816	cmd.exe	190
PID 5932 wrote to memory of 1756	5932	svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe	191
PID 3500 wrote to memory of 4248	3500	svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe	192
PID 4236 wrote to memory of 2776	4236	svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe	194
PID 1756 wrote to memory of 1612	1756	cmd.exe	197
PID 2776 wrote to memory of 3808	2776	cmd.exe	198
PID 4248 wrote to memory of 6000	4248	cmd.exe	199
PID 5932 wrote to memory of 2884	5932	svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe	201
PID 4236 wrote to memory of 4600	4236	svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe	204
PID 2884 wrote to memory of 700	2884	cmd.exe	208
PID 4600 wrote to memory of 5664	4600	cmd.exe	238
PID 5932 wrote to memory of 4200	5932	svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe	210
PID 4236 wrote to memory of 2948	4236	svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe	211
PID 2948 wrote to memory of 5012	2948	cmd.exe	216
PID 4200 wrote to memory of 4708	4200	cmd.exe	218

C:\Users\Admin\AppData\Local\Temp\2026-07-20_0acaa9a8ba9bf8b69f8dbb9ec5c4f7df_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_0acaa9a8ba9bf8b69f8dbb9ec5c4f7df_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBABACCBACBCBACCACABCACAABABAABACCCBAAACCABAAACCAAABCCAABCBCACCABBACAABACBBCBBBACBBBBACBACBCABCBCCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBABACCBACBCBACCACABCACAABABAABACCCBAAACCABAAACCAAABCCAABCBCACCABBACAABACBBCBBBACBBBBACBACBCABCBCCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCBACBACBACBACCBBCCCCCBCCCBCBBCABCBBCCCAACABBCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe" start= auto displayName= "UserDataSvc_CCCCBACBACBACBACCBBCCCCCBCCCBCBBCABCBBCCCAACABBCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5724
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCBACBACBACBACCBBCCCCCBCCCBCBBCABCBBCCCAACABBCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe" start= auto displayName= "UserDataSvc_CCCCBACBACBACBACCBBCCCCCBCCCBCBBCABCBBCCCAACABBCCCA"
    3⤵
    - Launches sc.exe
    PID:5108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCBACBACBACBACCBBCCCCCBCCCBCBBCABCBBCCCAACABBCCCA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCBACBACBACBACCBBCCCCCBCCCBCBBCABCBBCCCAACABBCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABBACABCCABBCBBCCBABCCBACBBCAACAABBABCBCAABABCCBACBBBBBBCCBBAAAAABABCACCBBABCBBCABBCBABBCBABBBCAAABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABBACABCCABBCBBCCBABCCBACBBCAACAABBABCBCAABABCCBACBBBBBBCCBBAAAAABABCACCBBABCBBCABBCBABBCBABBBCAAABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCACBBBAAAABBBABAAAAACACCCBCBABAAABBABCBAACBBACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe" start= auto displayName= "UserDataSvc_ACCCACBBBAAAABBBABAAAAACACCCBCBABAAABBABCBAACBBACBA"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:396
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCACBBBAAAABBBABAAAAACACCCBCBABAAABBABCBAACBBACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe" start= auto displayName= "UserDataSvc_ACCCACBBBAAAABBBABAAAAACACCCBCBABAAABBABCBAACBBACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCACBBBAAAABBBABAAAAACACCCBCBABAAABBABCBAACBBACBA"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCACBBBAAAABBBABAAAAACACCCBCBABAAABBABCBAACBBACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5812

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABCBACCCCBCBCBBBCAABBCBCCCABBCCCAAACACCBABBCBABABACBBBBBACBACBAABABCABAACCBAACACBCABBBBBACAABBBACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABCBACCCCBCBCBBBCAABBCBCCCABBCCCAAACACCBABBCBABABACBBBBBACBACBAABABCABAACCBAACACBCABBBBBACAABBBACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACAACABBBAABBAABBBABBAABAACBACCBABCBBCCCCABBACCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe" start= auto displayName= "UserDataSvc_BAACAACABBBAABBAABBBABBAABAACBACCBABCBBCCCCABBACCBC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAACAACABBBAABBAABBBABBAABAACBACCBABCBBCCCCABBACCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe" start= auto displayName= "UserDataSvc_BAACAACABBBAABBAABBBABBAABAACBACCBABCBBCCCCABBACCBC"
    3⤵
    - Launches sc.exe
    PID:4896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACAACABBBAABBAABBBABBAABAACBACCBABCBBCCCCABBACCBC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:356
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAACAACABBBAABBAABBBABBAABAACBACCBABCBBCCCCABBACCBC"
    3⤵
    - Launches sc.exe
    PID:4628

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBBABCBACBACBACBACABAACACACBABBBBBBCABBBBACBCABACBAACBCBBCCBCAACACCACBABABBBACBACACABBABCACACBCCCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCACCBCACCCACCBCCCCABCABCCACCBCACAAACCACACAAAAAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBBABCBACBACBACBACABAACACACBABBBBBBCABBBBACBCABACBAACBCBBCCBCAACACCACBABABBBACBACACABBABCACACBCCCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCACCBCACCCACCBCCCCABCABCCACCBCACAAACCACACAAAAAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCAACCCACAACACBACCCACAACCACBCCAAACBBCCAABACCBABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCACCBCACCCACCBCCCCABCABCCACCBCACAAACCACACAAAAAABBC.exe" start= auto displayName= "UserDataSvc_BABCAACCCACAACACBACCCACAACCACBCCAAACBBCCAABACCBABBB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABCAACCCACAACACBACCCACAACCACBCCAAACBBCCAABACCBABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCACCBCACCCACCBCCCCABCABCCACCBCACAAACCACACAAAAAABBC.exe" start= auto displayName= "UserDataSvc_BABCAACCCACAACACBACCCACAACCACBCCAAACBBCCAABACCBABBB"
    3⤵
    - Launches sc.exe
    PID:5628

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCABCABBBCAAABAACBBCABABBBCBCBACBBBCACAAAAAABCCBA.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABACAAACBBCCABBACAAABCBBBBAACBACCCAABBABACBBCAACCCBCCBAAABBCCBCCCCACBCCCBACCBCCBABBACABACABAACABCABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABACAAACBBCCABBACAAABCBBBBAACBACCCAABBABACBBCAACCCBCCBAAABBCCBCCCCACBCCCBACCBCCBABBACABACABAACABCABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAAAABACCCABBCCBBCAAACCABAABBBCBAACBACCBABCABAACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe" start= auto displayName= "UserDataSvc_BAAAAABACCCABBCCBBCAAACCABAABBBCBAACBACCBABCABAACCC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAAAAABACCCABBCCBBCAAACCABAABBBCBAACBACCBABCABAACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe" start= auto displayName= "UserDataSvc_BAAAAABACCCABBCCBBCAAACCABAABBBCBAACBACCBABCABAACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAAAABACCCABBCCBBCAAACCABAABBBCBAACBACCBABCABAACCC"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAAAAABACCCABBCCBBCAAACCABAABBBCBAACBACCBABCABAACCC"
    3⤵
    - Launches sc.exe
    PID:1692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4504

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAACBAAABACCCABBBCBCACAACCCACABABBCCCBABBCCCBCCCCBCB.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBCCBAAABBCACCBACBCBACCBBAAABABCCBCBAABBCBBBAAABAAACCCBBBCCAACABABACAACABCACCABCCCCBCBCBCBABCCCAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBCCBAAABBCACCBACBCBACCBBAAABABCCBCBAABBCBBBAAABAAACCCBBBCCAACABABACAACABCACCABCCCCBCBCBCBABCCCAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCBCCACAACAACBAABABABAACCACCACABABAABAABBBCABAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe" start= auto displayName= "UserDataSvc_CACCBCCACAACAACBAABABABAACCACCACABABAABAABBBCABAAAC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCBCCACAACAACBAABABABAACCACCACABABAABAABBBCABAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe" start= auto displayName= "UserDataSvc_CACCBCCACAACAACBAABABABAACCACCACABABAABAABBBCABAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCBCCACAACAACBAABABABAACCACCACABABAABAABBBCABAAAC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACCBCCACAACAACBAABABABAACCACCACABABAABAABBBCABAAAC"
    3⤵
    - Launches sc.exe
    PID:6000

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACACAAAACAACBBBABABCBCACCCACAACACAACACBACABCBABBBBBCAACABBBBCBCCBACCAACACABCBBACACCCACACCCBCACCCAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACACAAAACAACBBBABABCBCACCCACAACACAACACBACABCBABBBBBCAACABBBBCBCCBACCAACACABCBBACACCCACACCCBCACCCAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCABCBACBABBBCCBBCACCBAAABACABCBACBABBBBCACCAAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe" start= auto displayName= "UserDataSvc_AABCABCBACBABBBCCBBCACCBAAABACABCBACBABBBBCACCAAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCABCBACBABBBCCBBCACCBAAABACABCBACBABBBBCACCAAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe" start= auto displayName= "UserDataSvc_AABCABCBACBABBBCCBBCACCBAAABACABCBACBABBBBCACCAAABA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCABCBACBABBBCCBBCACCBAAABACABCBACBABBBBCACCAAABA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5168
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCABCBACBABBBCCBBCACCBAAABACABCBACBABBBBCACCAAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4580

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCACCBCACCCACCBCCCCABCABCCACCBCACAAACCACACAAAAAABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCACCBCACCCACCBCCCCABCABCCACCBCACAAACCACACAAAAAABBC.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAACAAACBCABBCBBABACBABCCACCCBCBBCBBCBBABBCBBCACBBBCACBABBBAABAACAACCACACBAAABCAABACCACBACAACCCBBBBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBABBCACCBBAACCAAACCBBCCABCBABCCCBCABABBCBBCBCBAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAACAAACBCABBCBBABACBABCCACCCBCBBCBBCBBABBCBBCACBBBCACBABBBAABAACAACCACACBAAABCAABACCACBACAACCCBBBBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBABBCACCBBAACCAAACCBBCCABCBABCCCBCABABBCBBCBCBAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACBACACAABCCCCCCCCACCAACBBCCAABBCCABBACBBBACCBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBABBCACCBBAACCAAACCBBCCABCBABCCCBCABABBCBBCBCBAAAA.exe" start= auto displayName= "UserDataSvc_BBACBACACAABCCCCCCCCACCAACBBCCAABBCCABBACBBBACCBABC"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACBACACAABCCCCCCCCACCAACBBCCAABBCCABBACBBBACCBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBABBCACCBBAACCAAACCBBCCABCBABCCCBCABABBCBBCBCBAAAA.exe" start= auto displayName= "UserDataSvc_BBACBACACAABCCCCCCCCACCAACBBCCAABBCCABBACBBBACCBABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACBACACAABCCCCCCCCACCAACBBCCAABBCCABBACBBBACCBABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBACBACACAABCCCCCCCCACCAACBBCCAABBCCABBACBBBACCBABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6080

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBBCBAABAACAAAACCBBACBAABBACCABCCCBABCBCCACBCAAABCB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBAACACCBBAABBBABABBCCABBBACCBBBBBCBBACCCCACCCBACCACBBAAABCABCBAABBBBCBABACACBACCBCBCCCCACBCCBCBACBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBCCABCABACCCCBBAAABCCCBBCCBBCBABBACAAABCBBBACAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBAACACCBBAABBBABABBCCABBBACCBBBBBCBBACCCCACCCBACCACBBAAABCABCBAABBBBCBABACACBACCBCBCCCCACBCCBCBACBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBCCABCABACCCCBBAAABCCCBBCCBBCBABBACAAABCBBBACAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCABAAACBACABBAAAABCBBCBCBABBCBCAABCBBCABBCBACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBCCABCABACCCCBBAAABCCCBBCCBBCBABBACAAABCBBBACAAA.exe" start= auto displayName= "UserDataSvc_BCBCABAAACBACABBAAAABCBBCBCBABBCBCAABCBBCABBCBACBCA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCABAAACBACABBAAAABCBBCBCBABBCBCAABCBBCABBCBACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBCCABCABACCCCBBAAABCCCBBCCBBCBABBACAAABCBBBACAAA.exe" start= auto displayName= "UserDataSvc_BCBCABAAACBACABBAAAABCBBCBCBABBCBCAABCBBCABBCBACBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCABAAACBACABBAAAABCBBCBCBABBCBCAABCBBCABBCBACBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCABAAACBACABBAAAABCBBCBCBABBCBCAABCBBCABBCBACBCA"
    3⤵
    - Launches sc.exe
    PID:2760

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACACBBBACBCACABCCBACBBCBACABBABAABBAAACBCBCABCBAAACCCACCABACABBBAACACBCCBABABBBCCBCBCBAAAACABABBCACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACACBBBACBCACABCCBACBBCBACABBABAABBAAACBCBCABCBAAACCCACCABACABBBAACACBCCBABABBBCCBCBCBAAAACABABBCACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBCBBBBCABBCCBBAABCBCABAABCABCCAAAACAABCCACABCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe" start= auto displayName= "UserDataSvc_BCBBCBBBBCABBCCBBAABCBCABAABCABCCAAAACAABCCACABCBBC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBCBBBBCABBCCBBAABCBCABAABCABCCAAAACAABCCACABCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe" start= auto displayName= "UserDataSvc_BCBBCBBBBCABBCCBBAABCBCABAABCABCCAAAACAABCCACABCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBCBBBBCABBCCBBAABCBCABAABCABCCAAAACAABCCACABCBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBCBBBBCABBCCBBAABCBCABAABCABCCAAAACAABCCACABCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5012

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCACCACBBCCABCBCABABABCBBBCCABCACCBABBBCABAACCCCBACA.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACACBBBACBCACABCCBACBBCBACABBABAABBAAACBCBCABCBAAACCCACCABACABBBAACACBCCBABABBBCCBCBCBAAAACABABBCACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABACBBBBACACCBCABAABBACBBBACCBCBACBAAAACBBCCAACAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACACBBBACBCACABCCBACBBCBACABBABAABBAAACBCBCABCBAAACCCACCABACABBBAACACBCCBABABBBCCBCBCBAAAACABABBCACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABACBBBBACACCBCABAABBACBBBACCBCBACBAAAACBBCCAACAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBABABCCBABCCCBBBCBCBCBAAACBCBABCBCABCAACACBBBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABACBBBBACACCBCABAABBACBBBACCBCBACBAAAACBBCCAACAABA.exe" start= auto displayName= "UserDataSvc_BACBABABCCBABCCCBBBCBCBCBAAACBCBABCBCABCAACACBBBBAC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBABABCCBABCCCBBBCBCBCBAAACBCBABCBCABCAACACBBBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABACBBBBACACCBCABAABBACBBBACCBCBACBAAAACBBCCAACAABA.exe" start= auto displayName= "UserDataSvc_BACBABABCCBABCCCBBBCBCBCBAAACBCBABCBCABCAACACBBBBAC"
    3⤵
    - Launches sc.exe
    PID:700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBABABCCBABCCCBBBCBCBCBAAACBCBABCBCABCAACACBBBBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBABABCCBABCCCBBBCBCBCBAAACBCBABCBCABCAACACBBBBAC"
    3⤵
    - Launches sc.exe
    PID:4708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBABBCACCBBAACCAAACCBBCCABCBABCCCBCABABBCBBCBCBAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBABBCACCBBAACCAAACCBBCCABCBABCCCBCABABBCBBCBCBAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACCCCABABAAAABCACACCAABABACCABCBBBACBBBBBCCBACAAAAABACABABACABAABBCACCCABCBAACBBBCCBAACACBBABCCBCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBAAABAACCBCBCBBACACCABBABCCBCBCCCCCABBABACBABACCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACCCCABABAAAABCACACCAABABACCABCBBBACBBBBBCCBACAAAAABACABABACABAABBCACCCABCBAACBBBCCBAACACBBABCCBCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBAAABAACCBCBCBBACACCABBABCCBCBCCCCCABBABACBABACCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCACCBBACCBABCCCCCBACCAAABACBABBBBCBBCBBAAAABCACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBAAABAACCBCBCBBACACCABBABCCBCBCCCCCABBABACBABACCCCC.exe" start= auto displayName= "UserDataSvc_BABCACCBBACCBABCCCCCBACCAAABACBABBBBCBBCBBAAAABCACC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6488
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABCACCBBACCBABCCCCCBACCAAABACBABBBBCBBCBBAAAABCACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBAAABAACCBCBCBBACACCABBABCCBCBCCCCCABBABACBABACCCCC.exe" start= auto displayName= "UserDataSvc_BABCACCBBACCBABCCCCCBACCAAABACBABBBBCBBCBBAAAABCACC"
    3⤵
    - Launches sc.exe
    PID:7068

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBABBCACCBBAACCAAACCBBCCABCBABCCCBCABABBCBBCBCBAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBABBCACCBBAACCAAACCBBCCABCBABCCCBCABABBCBBCBCBAAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABCBCCBAACAAAABBABBBACBCBBABBBBBAAAACACABBBCACBCACCBBBBCAABCBACCBCACBABCABBCCCCBAACCAACBACCBBBBABCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABCBCCBAACAAAABBABBBACBCBBABBBBBAAAACACABBBCACBCACCBBBBCAABCBACCBCACBABCABBCCCCBAACCAACBACCBBBBABCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABBBBBAACCBCACABABBBACAACAACBAAABABCBABCABACBCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe" start= auto displayName= "UserDataSvc_CBABBBBBAACCBCACABABBBACAACAACBAAABABCBABCABACBCACB"
  2⤵
  PID:6820
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABBBBBAACCBCACABABBBACAACAACBAAABABCBABCABACBCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe" start= auto displayName= "UserDataSvc_CBABBBBBAACCBCACABABBBACAACAACBAAABABCBABCABACBCACB"
    3⤵
    - Launches sc.exe
    PID:7148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABBBBBAACCBCACABABBBACAACAACBAAABABCBABCABACBCACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4856
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABBBBBAACCBCACABABBBACAACAACBAAABABCBABCABACBCACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4744

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBCCABCABACCCCBBAAABCCCBBCCBBCBABBACAAABCBBBACAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBCCABCABACCCCBBAAABCCCBBCCBBCBABBACAAABCBBBACAAA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABAAAAAAAAABCCCACABACBBBCCBBCABABBCABBBCBCAAACABCBACBAABBCAACCBABCCCACCAAACCBACABBBCCABCCBBACCCCACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCCABABAAAABCACACCAABABACCABCBBBACBBBBBCCBACAAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABAAAAAAAAABCCCACABACBBBCCBBCABABBCABBBCBCAAACABCBACBAABBCAACCBABCCCACCAAACCBACABBBCCABCCBBACCCCACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCCABABAAAABCACACCAABABACCABCBBBACBBBBBCCBACAAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCBCACCABCACCBAACBACCACCBCBBCCCCAABABCBACBCAAABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCCABABAAAABCACACCAABABACCABCBBBACBBBBBCCBACAAAAAB.exe" start= auto displayName= "UserDataSvc_AABCBCACCABCACCBAACBACCACCBCBBCCCCAABABCBACBCAAABAB"
  2⤵
  - Executes a command shell one-liner
  PID:6540
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCBCACCABCACCBAACBACCACCBCBBCCCCAABABCBACBCAAABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCCABABAAAABCACACCAABABACCABCBBBACBBBBBCCBACAAAAAB.exe" start= auto displayName= "UserDataSvc_AABCBCACCABCACCBAACBACCACCBCBBCCCCAABABCBACBCAAABAB"
    3⤵
    - Launches sc.exe
    PID:7092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCBCACCABCACCBAACBACCACCBCBBCCCCAABABCBACBCAAABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6420
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCBCACCABCACCBAACBACCACCBCBBCCCCAABABCBACBCAAABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:7080

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBCCABCABACCCCBBAAABCCCBBCCBBCBABBACAAABCBBBACAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBCCABCABACCCCBBAAABCCCBBCCBBCBABBACAAABCBBBACAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACCABCBACCCBCAACBBCACCAABCCACCCACACBCACBCCABCAAAACCCABAAAABBABAAABBCABCBBCBBBAACBBBBCBBBCACBCCACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCCABBCBBABBBCCCBACACBCACBAACBAABCCBCACCCCBCCBBCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACCABCBACCCBCAACBBCACCAABCCACCCACACBCACBCCABCAAAACCCABAAAABBABAAABBCABCBBCBBBAACBBBBCBBBCACBCCACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCCABBCBBABBBCCCBACACBCACBAACBAABCCBCACCCCBCCBBCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAACAACCBAABBBAACABBBBCBBCBCBAABCCCABABAACACBACAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCCABBCBBABBBCCCBACACBCACBAACBAABCCBCACCCCBCCBBCAAA.exe" start= auto displayName= "UserDataSvc_CBAACAACCBAABBBAACABBBBCBBCBCBAABCCCABABAACACBACAAB"
  2⤵
  PID:6788
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAACAACCBAABBBAACABBBBCBBCBCBAABCCCABABAACACBACAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCCABBCBBABBBCCCBACACBCACBAACBAABCCBCACCCCBCCBBCAAA.exe" start= auto displayName= "UserDataSvc_CBAACAACCBAABBBAACABBBBCBBCBCBAABCCCABABAACACBACAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAACAACCBAABBBAACABBBBCBBCBCBAABCCCABABAACACBACAAB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3152
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAACAACCBAABBBAACABBBBCBBCBCBAABCCCABABAACACBACAAB"
    3⤵
    PID:5796

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4132

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABCBCCBAACAAAABBABBBACBCBBABBBBBAAAACACABBBCACBCACCBBBBCAABCBACCBCACBABCABBCCCCBAACCAACBACCBBBBABCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABCBCCBAACAAAABBABBBACBCBBABBBBBAAAACACABBBCACBCACCBBBBCAABCBACCBCACBABCABBCCCCBAACCAACBACCBBBBABCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAAAABACABBACCAACBCAABCAABCBCCABCCBACAAAACACACBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe" start= auto displayName= "UserDataSvc_CBAAAABACABBACCAACBCAABCAABCBCCABCCBACAAAACACACBCAB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6388
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAAAABACABBACCAACBCAABCAABCBCCABCCBACAAAACACACBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe" start= auto displayName= "UserDataSvc_CBAAAABACABBACCAACBCAABCAABCBCCABCCBACAAAACACACBCAB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7052

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCABBCABBABABBBABBABCBABBCBABBBABACCACCCAACBACCCBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBCCACBBBCCABAABBCCBABBABCAABCABCBCCAACACCCACBAAACCBABBAACAABACBCAABAAAAAABBACCCCCBCBCBCCACCABCACBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4500
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBCCACBBBCCABAABBCCBABBABCAABCABCBCCAACACCCACBAAACCBABBAACAABACBCAABAAAAAABBACCCCCBCBCBCCACCABCACBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABBACAACAACABBAAABABCCABBCBCCBAACBAACBBCBAAAACACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe" start= auto displayName= "UserDataSvc_BABBACAACAACABBAAABABCCABBCBCCBAACBAACBBCBAAAACACBB"
  2⤵
  PID:6528
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABBACAACAACABBAAABABCCABBCBCCBAACBAACBBCBAAAACACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe" start= auto displayName= "UserDataSvc_BABBACAACAACABBAAABABCCABBCBCCBAACBAACBBCBAAAACACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABBACAACAACABBAAABABCCABBCBCCBAACBAACBBCBAAAACACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2084
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABBACAACAACABBAAABABCCABBCBCCBAACBAACBBCBAAAACACBB"
    3⤵
    - Launches sc.exe
    PID:4584

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABACBBBBACACCBCABAABBACBBBACCBCBACBAAAACBBCCAACAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABACBBBBACACCBCABAABBACBBBACCBCBACBAAAACBBCCAACAABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABCBCCBAACAAAABBABBBACBCBBABBBBBAAAACACABBBCACBCACCBBBBCAABCBACCBCACBABCABBCCCCBAACCAACBACCBBBBABCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABCBCCBAACAAAABBABBBACBCBBABBBBBAAAACACABBBCACBCACCBBBBCAABCBACCBCACBABCABBCCCCBAACCAACBACCBBBBABCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCCCBCAACCACBBCBAACBBABCAAACACABBACCCACBCCBACACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe" start= auto displayName= "UserDataSvc_CCCCCCBCAACCACBBCBAACBBABCAAACACABBACCCACBCCBACACCA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6748
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCCCBCAACCACBBCBAACBBABCAAACACABBACCCACBCCBACACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe" start= auto displayName= "UserDataSvc_CCCCCCBCAACCACBBCBAACBBABCAAACACABBACCCACBCCBACACCA"
    3⤵
    - Launches sc.exe
    PID:2448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCCCBCAACCACBBCBAACBBABCAAACACABBACCCACBCCBACACCA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5608
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCCCBCAACCACBBCBAACBBABCAAACACABBACCCACBCCBACACCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:7100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAABBCCBCCCBAACCBBCBCCABBABCBCABAAABBCBBCCAACCBCBBBCABBCCBBBBBABBCCBCCBBBCCCCABACCACABBCCCCACBAABACACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAABBCCBCCCBAACCBBCBCCABBABCBCABAAABBCBBCCAACCBCBBBCABBCCBBBBBABBCCBCCBBBCCCCABACCACABBCCCCACBAABACACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAAAABACABBACCAACBCAABCAABCBCCABCCBACAAAACACACBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe" start= auto displayName= "UserDataSvc_CBAAAABACABBACCAACBCAABCAABCBCCABCCBACAAAACACACBCAB"
  2⤵
  PID:6348
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAAAABACABBACCAACBCAABCAABCBCCABCCBACAAAACACACBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe" start= auto displayName= "UserDataSvc_CBAAAABACABBACCAACBCAABCAABCBCCABCCBACAAAACACACBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAAAABACABBACCAACBCAABCAABCBCCABCCBACAAAACACACBCAB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6180
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAAAABACABBACCAACBCAABCAABCBCCABCCBACAAAACACACBCAB"
    3⤵
    - Launches sc.exe
    PID:6556

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBAABCAAACCBACAACCBBCBBBCCAABABCBABABCACABCCBBBCCCBB.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBCCACBBBCCABAABBCCBABBABCAABCABCBCCAACACCCACBAAACCBABBAACAABACBCAABAAAAAABBACCCCCBCBCBCCACCABCACBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBAAABAACCBCBCBBACACCABBABCCBCBCCCCCABBABACBABACCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBCCACBBBCCABAABBCCBABBABCAABCABCBCCAACACCCACBAAACCBABBAACAABACBCAABAAAAAABBACCCCCBCBCBCCACCABCACBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBAAABAACCBCBCBBACACCABBABCCBCBCCCCCABBABACBABACCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAAAABACABBACCAACBCAABCAABCBCCABCCBACAAAACACACBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBAAABAACCBCBCBBACACCABBABCCBCBCCCCCABBABACBABACCCCC.exe" start= auto displayName= "UserDataSvc_CBAAAABACABBACCAACBCAABCAABCBCCABCCBACAAAACACACBCAB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6376
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAAAABACABBACCAACBCAABCAABCBCCABCCBACAAAACACACBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBAAABAACCBCBCBBACACCABBABCCBCBCCCCCABBABACBABACCCCC.exe" start= auto displayName= "UserDataSvc_CBAAAABACABBACCAACBCAABCAABCBCCABCCBACAAAACACACBCAB"
    3⤵
    - Launches sc.exe
    PID:7020

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABACBBBBACACCBCABAABBACBBBACCBCBACBAAAACBBCCAACAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABACBBBBACACCBCABAABBACBBBACCBCBACBAAAACBBCCAACAABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBCCACBBBCCABAABBCCBABBABCAABCABCBCCAACACCCACBAAACCBABBAACAABACBCAABAAAAAABBACCCCCBCBCBCCACCABCACBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:5484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBCCACBBBCCABAABBCCBABBABCAABCABCBCCAACACCCACBAAACCBABBAACAABACBCAABAAAAAABBACCCCCBCBCBCCACCABCACBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABCBCABBAABACAACBBBCBBCBBCBBAAABCABCBBACCCCAACACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe" start= auto displayName= "UserDataSvc_BCABCBCABBAABACAACBBBCBBCBBCBBAAABCABCBBACCCCAACACB"
  2⤵
  PID:6296
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABCBCABBAABACAACBBBCBBCBBCBBAAABCABCBBACCCCAACACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe" start= auto displayName= "UserDataSvc_BCABCBCABBAABACAACBBBCBBCBBCBBAAABCABCBBACCCCAACACB"
    3⤵
    - Launches sc.exe
    PID:7000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABCBCABBAABACAACBBBCBBCBBCBBAAABCABCBBACCCCAACACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6196
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABCBCABBAABACAACBBBCBBCBBCBBAAABCABCBBACCCCAACACB"
    3⤵
    - Launches sc.exe
    PID:716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCCABBCBBABBBCCCBACACBCACBAACBAABCCBCACCCCBCCBBCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCCABBCBBABBBCCCBACACBCACBAACBAABCCBCACCCCBCCBBCAAA.exe
1⤵
- Executes dropped EXE
PID:7084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCCABACBABCCBBBCCBCBCBCBCBCBCCCABABABCCABBABBACCBAACCBCABCCABABBCABABCCABABACACCCCBCCCBCBCBCCBACCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBBCBBBBABAABBBABCAAACAAACACCBABBCCACACBABBBBBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCCABACBABCCBBBCCBCBCBCBCBCBCCCABABABCCABBABBACCBAACCBCABCCABABBCABABCCABABACACCCCBCCCBCBCBCCBACCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBBCBBBBABAABBBABCAAACAAACACCBABBCCACACBABBBBBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABCBBAAABCBCBCBABCAAACBCAABAABAACBCBBCABBBBAABCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBBCBBBBABAABBBABCAAACAAACACCBABBCCACACBABBBBBCCCC.exe" start= auto displayName= "UserDataSvc_BCABCBBAAABCBCBCBABCAAACBCAABAABAACBCBBCABBBBAABCBC"
  2⤵
  - Executes a command shell one-liner
  PID:7212
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABCBBAAABCBCBCBABCAAACBCAABAABAACBCBBCABBBBAABCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBBCBBBBABAABBBABCAAACAAACACCBABBCCACACBABBBBBCCCC.exe" start= auto displayName= "UserDataSvc_BCABCBBAAABCBCBCBABCAAACBCAABAABAACBCBBCABBBBAABCBC"
    3⤵
    - Launches sc.exe
    PID:4564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABCBBAAABCBCBCBABCAAACBCAABAABAACBCBBCABBBBAABCBC"
  2⤵
  - Executes a command shell one-liner
  PID:8376
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABCBBAAABCBCBCBABCAAACBCAABAABAACBCBBCABBBBAABCBC"
    3⤵
    - Launches sc.exe
    PID:8804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe
1⤵
- Executes dropped EXE
PID:7160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBBCABBBABBCBBCACCACBAAAACBBAACABCBABACCBCBCABBBCBBCCCACCBACACABCCBBCBCCBCCBBCBBABABBABCAABABBCACBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBCCBBCBCBCAABBBBCBCAAACCBACBCCBAACCABBABABABBAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:8356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBBCABBBABBCBBCACCACBAAAACBBAACABCBABACCBCBCABBBCBBCCCACCBACACABCCBBCBCCBCCBBCBBABABBABCAABABBCACBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBCCBBCBCBCAABBBBCBCAAACCBACBCCBAACCABBABABABBAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABABABABCCACAAACAABACAABAABBBBBCACBBBBBACABBABCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBCCBBCBCBCAABBBBCBCAAACCBACBCCBAACCABBABABABBAABAB.exe" start= auto displayName= "UserDataSvc_BABABABABCCACAAACAABACAABAABBBBBCACBBBBBACABBABCCBC"
  2⤵
  - Executes a command shell one-liner
  PID:8200
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABABABABCCACAAACAABACAABAABBBBBCACBBBBBACABBABCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBCCBBCBCBCAABBBBCBCAAACCBACBCCBAACCABBABABABBAABAB.exe" start= auto displayName= "UserDataSvc_BABABABABCCACAAACAABACAABAABBBBBCACBBBBBACABBABCCBC"
    3⤵
    PID:8372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABABABABCCACAAACAABACAABAABBBBBCACBBBBBACABBABCCBC"
  2⤵
  PID:9772
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABABABABCCACAAACAABACAABAABBBBBCACBBBBBACABBABCCBC"
    3⤵
    - Launches sc.exe
    PID:9632

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCACCCAAABCACBACCCABBABBCBBBACAAAABCAAAAACACCACBCCCABAACACACABCABBBCCCAAACCCCAABACABCBCACCBAAAABABACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCBBABABBBACABAABCBCACAABBBABBBCCBBAACAABCBBACACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCACCCAAABCACBACCCABBABBCBBBACAAAABCAAAAACACCACBCCCABAACACACABCABBBCCCAAACCCCAABACABCBCACCBAAAABABACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCBBABABBBACABAABCBCACAABBBABBBCCBBAACAABCBBACACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBBACCBCBCCBABCACCBCBBCBCABBACBCBABCAACBACCBCCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCBBABABBBACABAABCBCACAABBBABBBCCBBAACAABCBBACACCC.exe" start= auto displayName= "UserDataSvc_ACCBBACCBCBCCBABCACCBCBBCBCABBACBCBABCAACBACCBCCBAC"
  2⤵
  PID:8996
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBBACCBCBCCBABCACCBCBBCBCABBACBCBABCAACBACCBCCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCBBABABBBACABAABCBCACAABBBABBBCCBBAACAABCBBACACCC.exe" start= auto displayName= "UserDataSvc_ACCBBACCBCBCCBABCACCBCBBCBCABBACBCBABCAACBACCBCCBAC"
    3⤵
    PID:8344

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAAAABCCBBACBBCAAAABBCCCCABCACBCBBBBBBABCCABCBBCCCCBBBBBAAACAACCBCCBAABBACBABBACBCACBCCAACCAAAAABBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCBBCBCCBCBCCABCCACBBCAAACBCCACCABBACCCBAAAAAAAACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAAAABCCBBACBBCAAAABBCCCCABCACBCBBBBBBABCCABCBBCCCCBBBBBAAACAACCBCCBAABBACBABBACBCACBCCAACCAAAAABBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCBBCBCCBCBCCABCCACBBCAAACBCCACCABBACCCBAAAAAAAACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBABBAACBCABBACABCCCCBCABCCAACBCAAACABAABCBBBAACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCBBCBCCBCBCCABCCACBBCAAACBCCACCABBACCCBAAAAAAAACCA.exe" start= auto displayName= "UserDataSvc_ACBABBAACBCABBACABCCCCBCABCCAACBCAAACABAABCBBBAACBC"
  2⤵
  - Executes a command shell one-liner
  PID:6972
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBABBAACBCABBACABCCCCBCABCCAACBCAAACABAABCBBBAACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCBBCBCCBCBCCABCCACBBCAAACBCCACCABBACCCBAAAAAAAACCA.exe" start= auto displayName= "UserDataSvc_ACBABBAACBCABBACABCCCCBCABCCAACBCAAACABAABCBBBAACBC"
    3⤵
    PID:6912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBABBAACBCABBACABCCCCBCABCCAACBCAAACABAABCBBBAACBC"
  2⤵
  PID:4992
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBABBAACBCABBACABCCCCBCABCCAACBCAAACABAABCBBBAACBC"
    3⤵
    PID:952

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBABAACCABCAACCAABCABAABCACAABABBBCBAAACCCCABABCAAAABAAACBBCBCBCABABABBAABCACACAABCBBCABAAACACBCBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACACAAABCABBCCBBCCBABBABACAACBBBBCABCCACCBACBBBCABBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBABAACCABCAACCAABCABAABCACAABABBBCBAAACCCCABABCAAAABAAACBBCBCBCABABABBAABCACACAABCBBCABAAACACBCBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACACAAABCABBCCBBCCBABBABACAACBBBBCABCCACCBACBBBCABBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACBBBBBBCAABACABBBACABACACACABBACBAABACCCCAABCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACACAAABCABBCCBBCCBABBABACAACBBBBCABCCACCBACBBBCABBCB.exe" start= auto displayName= "UserDataSvc_BAACBBBBBBCAABACABBBACABACACACABBACBAABACCCCAABCCBB"
  2⤵
  PID:6476
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAACBBBBBBCAABACABBBACABACACACABBACBAABACCCCAABCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACACAAABCABBCCBBCCBABBABACAACBBBBCABCCACCBACBBBCABBCB.exe" start= auto displayName= "UserDataSvc_BAACBBBBBBCAABACABBBACABACACACABBACBAABACCCCAABCCBB"
    3⤵
    PID:928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACBBBBBBCAABACABBBACABACACACABBACBAABACCCCAABCCBB"
  2⤵
  PID:7060
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAACBBBBBBCAABACABBBACABACACACABBACBAABACCCCAABCCBB"
    3⤵
    - Launches sc.exe
    PID:5048

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBAAABAACCBCBCBBACACCABBABCCBCBCCCCCABBABACBABACCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBAAABAACCBCBCBBACACCABBABCCBCBCCCCCABBABACBABACCCCC.exe
1⤵
- Executes dropped EXE
PID:5700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABAABCCCACACBAAACACCCBBACCBBBCCBACCBCCBBACCCBACCCACABAACACCAABCCAABBBAAACBAAAABBBABBACBCBABAAAABBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCACCCBBCACCACBBACCAABBCCACBACCCCACCACCAABBAAABCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:6000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABAABCCCACACBAAACACCCBBACCBBBCCBACCBCCBBACCCBACCCACABAACACCAABCCAABBBAAACBAAAABBBABBACBCBABAAAABBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCACCCBBCACCACBBACCAABBCCACBACCCCACCACCAABBAAABCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACABCACCCCBCAAAABCABBAAACCBABBCBCCBABBCACBBBACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCACCCBBCACCACBBACCAABBCCACBACCCCACCACCAABBAAABCBCB.exe" start= auto displayName= "UserDataSvc_BCACABCACCCCBCAAAABCABBAAACCBABBCBCCBABBCACBBBACCBB"
  2⤵
  PID:4628
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACABCACCCCBCAAAABCABBAAACCBABBCBCCBABBCACBBBACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCACCCBBCACCACBBACCAABBCCACBACCCCACCACCAABBAAABCBCB.exe" start= auto displayName= "UserDataSvc_BCACABCACCCCBCAAAABCABBAAACCBABBCBCCBABBCACBBBACCBB"
    3⤵
    PID:5548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACABCACCCCBCAAAABCABBAAACCBABBCBCCBABBCACBBBACCBB"
  2⤵
  PID:6244
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACABCACCCCBCAAAABCABBAAACCBABBCBCCBABBCACBBBACCBB"
    3⤵
    - Launches sc.exe
    PID:5836

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCCABABAAAABCACACCAABABACCABCBBBACBBBBBCCBACAAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCCABABAAAABCACACCAABABACCABCBBBACBBBBBCCBACAAAAAB.exe
1⤵
- Executes dropped EXE
PID:6872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCAABCAACBABAAAAACCBBCAAACCABBCABBAABCAABAAABABBAACACBCCCACAAAABCABACAABCAAAAAACAABABBBCBCCCCAAAACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCAACCBCABACCCABCACCACBCCBAABBABAAACBCCCCABBBCAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCAABCAACBABAAAAACCBBCAAACCABBCABBAABCAABAAABABBAACACBCCCACAAAABCABACAABCAAAAAACAABABBBCBCCCCAAAACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCAACCBCABACCCABCACCACBCCBAABBABAAACBCCCCABBBCAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBBBABBBBCCACCCCABCACAAAAAABACCAACABCCABCCACAACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCAACCBCABACCCABCACCACBCCBAABBABAAACBCCCCABBBCAABBB.exe" start= auto displayName= "UserDataSvc_BBBBBABBBBCCACCCCABCACAAAAAABACCAACABCCABCCACAACBCA"
  2⤵
  PID:2876
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBBBABBBBCCACCCCABCACAAAAAABACCAACABCCABCCACAACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCAACCBCABACCCABCACCACBCCBAABBABAAACBCCCCABBBCAABBB.exe" start= auto displayName= "UserDataSvc_BBBBBABBBBCCACCCCABCACAAAAAABACCAACABCCABCCACAACBCA"
    3⤵
    - Launches sc.exe
    PID:7012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBBBABBBBCCACCCCABCACAAAAAABACCAACABCCABCCACAACBCA"
  2⤵
  PID:928
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBBBABBBBCCACCCCABCACAAAAAABACCAACABCCABCCACAACBCA"
    3⤵
    PID:3424

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe
1⤵
- Executes dropped EXE
PID:6904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCBACBAABBBACACABBBBAACBAABBCCCCCBABBBCBACBCBCABCCCCCBABBCAAABBCCCAACBBCACBCCCBABBCBBCBAACBACBCCBACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACABABCBBCBABBBAACBACABACABCABAABACABBBABCBAAABCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCBACBAABBBACACABBBBAACBAABBCCCCCBABBBCBACBCBCABCCCCCBABBCAAABBCCCAACBBCACBCCCBABBCBBCBAACBACBCCBACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACABABCBBCBABBBAACBACABACABCABAABACABBBABCBAAABCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCABCCBBCCCAACBBCBABCBBCACCCBBACCACABCCBBBCBACCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACABABCBBCBABBBAACBACABACABCABAABACABBBABCBAAABCBAA.exe" start= auto displayName= "UserDataSvc_AACCABCCBBCCCAACBBCBABCBBCACCCBBACCACABCCBBBCBACCAC"
  2⤵
  - Executes a command shell one-liner
  PID:6992
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCABCCBBCCCAACBBCBABCBBCACCCBBACCACABCCBBBCBACCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACABABCBBCBABBBAACBACABACABCABAABACABBBABCBAAABCBAA.exe" start= auto displayName= "UserDataSvc_AACCABCCBBCCCAACBBCBABCBBCACCCBBACCACABCCBBBCBACCAC"
    3⤵
    PID:2760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCABCCBBCCCAACBBCBABCBBCACCCBBACCACABCCBBBCBACCAC"
  2⤵
  PID:1056
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCABCCBBCCCAACBBCBABCBBCACCCBBACCACABCCBBBCBACCAC"
    3⤵
    - Launches sc.exe
    PID:6724

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBCCBCAAAAAABCCACCACCBAABBABBCAAAACCCCACACBABBBBAAB.exe
1⤵
- Executes dropped EXE
PID:7124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACABAABCAABBABCCBAACCCCCBACCABBBCBCBACCBCBCACAABAACABCCCCCCBACCBCCAACCCBACBBBAAAAABAABCCBCBCCACBCACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCCAACABCCBCACCCACBBCABABBCABCBBBCBBCBBCABAABACACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:5640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACABAABCAABBABCCBAACCCCCBACCABBBCBCBACCBCBCACAABAACABCCCCCCBACCBCCAACCCBACBBBAAAAABAABCCBCBCCACBCACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCCAACABCCBCACCCACBBCABABBCABCBBBCBBCBBCABAABACACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCBACCCACCBCCCACBAABBABBCABCABAACAAAAABCCBBCACBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCCAACABCCBCACCCACBBCABABBCABCBBBCBBCBBCABAABACACBA.exe" start= auto displayName= "UserDataSvc_BBBCBACCCACCBCCCACBAABBABBCABCABAACAAAAABCCBBCACBBC"
  2⤵
  PID:3340
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCBACCCACCBCCCACBAABBABBCABCABAACAAAAABCCBBCACBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCCAACABCCBCACCCACBBCABABBCABCBBBCBBCBBCABAABACACBA.exe" start= auto displayName= "UserDataSvc_BBBCBACCCACCBCCCACBAABBABBCABCABAACAAAAABCCBBCACBBC"
    3⤵
    - Launches sc.exe
    PID:2408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCBACCCACCBCCCACBAABBABBCABCABAACAAAAABCCBBCACBBC"
  2⤵
  PID:4472
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCBACCCACCBCCCACBAABBABBCABCABAACAAAAABCCBBCACBBC"
    3⤵
    - Launches sc.exe
    PID:2396

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCCABBCBBABBBCCCBACACBCACBAACBAABCCBCACCCCBCCBBCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCCABBCBBABBBCCCBACACBCACBAACBAABCCBCACCCCBCCBBCAAA.exe
1⤵
- Executes dropped EXE
PID:7116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCABBBBAABBBCBCBCBAAAAABAABCBCBAABBCBBBCCBAACAACBCABBABAAABBABBACACBACCCACABBBCBAABBABCCCCCACBCAACABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABCACCABACABABCABCCAAABBBCCCCABCACABAAAAAABCAAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCABBBBAABBBCBCBCBAAAAABAABCBCBAABBCBBBCCBAACAACBCABBABAAABBABBACACBACCCACABBBCBAABBABCCCCCACBCAACABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABCACCABACABABCABCCAAABBBCCCCABCACABAAAAAABCAAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABBBBCBCBCABCCCCAAABCAACCBCCCCBBBBCBAACCAACCCAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABCACCABACABABCABCCAAABBBCCCCABCACABAAAAAABCAAAACB.exe" start= auto displayName= "UserDataSvc_BBABBBBCBCBCABCCCCAAABCAACCBCCCCBBBBCBAACCAACCCAACB"
  2⤵
  PID:3324
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBABBBBCBCBCABCCCCAAABCAACCBCCCCBBBBCBAACCAACCCAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABCACCABACABABCABCCAAABBBCCCCABCACABAAAAAABCAAAACB.exe" start= auto displayName= "UserDataSvc_BBABBBBCBCBCABCCCCAAABCAACCBCCCCBBBBCBAACCAACCCAACB"
    3⤵
    - Launches sc.exe
    PID:6984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABBBBCBCBCABCCCCAAABCAACCBCCCCBBBBCBAACCAACCCAACB"
  2⤵
  PID:6212
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBABBBBCBCBCABCCCCAAABCAACCBCCCCBBBBCBAACCAACCCAACB"
    3⤵
    PID:3004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCCABABAAAABCACACCAABABACCABCBBBACBBBBBCCBACAAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCCABABAAAABCACACCAABABACCABCBBBACBBBBBCCBACAAAAAB.exe
1⤵
- Executes dropped EXE
PID:252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCBAACBAABAAAACAAABBAABCCACCBACBBABAAAACCAACBACCCCCBABAACBCCCCCBAAACABCBACACACBBCACBCABBAAACAAAACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBACABCBCCBBBBBBCBCCBBCAACCABACBACBBABCCCAABBBBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCBAACBAABAAAACAAABBAABCCACCBACBBABAAAACCAACBACCCCCBABAACBCCCCCBAAACABCBACACACBBCACBCABBAAACAAAACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBACABCBCCBBBBBBCBCCBBCAACCABACBACBBABCCCAABBBBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACBBAABCCCCAAACAABAACBBBBAACBCAABACBCCCABBBCBCABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBACABCBCCBBBBBBCBCCBBCAACCABACBACBBABCCCAABBBBACC.exe" start= auto displayName= "UserDataSvc_AACBBAABCCCCAAACAABAACBBBBAACBCAABACBCCCABBBCBCABAB"
  2⤵
  - Executes a command shell one-liner
  PID:1964
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACBBAABCCCCAAACAABAACBBBBAACBCAABACBCCCABBBCBCABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBACABCBCCBBBBBBCBCCBBCAACCABACBACBBABCCCAABBBBACC.exe" start= auto displayName= "UserDataSvc_AACBBAABCCCCAAACAABAACBBBBAACBCAABACBCCCABBBCBCABAB"
    3⤵
    - Launches sc.exe
    PID:1360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACBBAABCCCCAAACAABAACBBBBAACBCAABACBCCCABBBCBCABAB"
  2⤵
  PID:2716
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACBBAABCCCCAAACAABAACBBBBAACBCAABACBCCCABBBCBCABAB"
    3⤵
    - Launches sc.exe
    PID:3532

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABCBACBABCACABAACABCACBACBCBAAABACBCBCCCCCBCBBBBBBA.exe
1⤵
- Executes dropped EXE
PID:7096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACABCBCBAABCBACAABBABACAACABBACCBBACCCACBBABABBABBBBBCBABBABBCCABBACBCACCCBABACBABBAABCBCABCBCAAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAACBABBCABCCCBCBBCCCBBBACACCCCACBAAABBCCAACCCCAABABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:2024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACABCBCBAABCBACAABBABACAACABBACCBBACCCACBBABABBABBBBBCBABBABBCCABBACBCACCCBABACBABBAABCBCABCBCAAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAACBABBCABCCCBCBBCCCBBBACACCCCACBAAABBCCAACCCCAABABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBACBBBAAACCCCBBCABAACCCBCBCACAACCABABBCAAABACACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAACBABBCABCCCBCBBCCCBBBACACCCCACBAAABBCCAACCCCAABABC.exe" start= auto displayName= "UserDataSvc_ACBACBBBAAACCCCBBCABAACCCBCBCACAACCABABBCAAABACACCC"
  2⤵
  PID:2144
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBACBBBAAACCCCBBCABAACCCBCBCACAACCABABBCAAABACACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAACBABBCABCCCBCBBCCCBBBACACCCCACBAAABBCCAACCCCAABABC.exe" start= auto displayName= "UserDataSvc_ACBACBBBAAACCCCBBCABAACCCBCBCACAACCABABBCAAABACACCC"
    3⤵
    - Launches sc.exe
    PID:3916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBACBBBAAACCCCBBCABAACCCBCBCACAACCABABBCAAABACACCC"
  2⤵
  PID:6124
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBACBBBAAACCCCBBCABAACCCBCBCACAACCABABBCAAABACACCC"
    3⤵
    - Launches sc.exe
    PID:5900

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCBBCBCCBCBCCABCCACBBCAAACBCCACCABBACCCBAAAAAAAACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCBBCBCCBCBCCABCCACBBCAAACBCCACCABBACCCBAAAAAAAACCA.exe
1⤵
PID:6764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBABBABCAAABCBAACCACCCACAACAABACABCCACBCCBBBAABBCCAABBAABCBCBBBCABCBCCACBBABBCAAACBAACABACBAACCBACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBABBBCBBAACCCACBCBCBBABCAAAACACBCCABBCBABBBBBBCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:3768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBABBABCAAABCBAACCACCCACAACAABACABCCACBCCBBBAABBCCAABBAABCBCBBBCABCBCCACBBABBCAAACBAACABACBAACCBACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBABBBCBBAACCCACBCBCBBABCAAAACACBCCABBCBABBBBBBCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCACAAABACBBBBCBACCCBABBABCACCCABAABCCBABAACBBBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBABBBCBBAACCCACBCBCBBABCAAAACACBCCABBCBABBBBBBCCBC.exe" start= auto displayName= "UserDataSvc_CCCACAAABACBBBBCBACCCBABBABCACCCABAABCCBABAACBBBBCA"
  2⤵
  PID:7300
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCACAAABACBBBBCBACCCBABBABCACCCABAABCCBABAACBBBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBABBBCBBAACCCACBCBCBBABCAAAACACBCCABBCBABBBBBBCCBC.exe" start= auto displayName= "UserDataSvc_CCCACAAABACBBBBCBACCCBABBABCACCCABAABCCBABAACBBBBCA"
    3⤵
    PID:7472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCACAAABACBBBBCBACCCBABBABCACCCABAABCCBABAACBBBBCA"
  2⤵
  - Executes a command shell one-liner
  PID:7628
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCACAAABACBBBBCBACCCBABBABCACCCABAABCCBABAACBBBBCA"
    3⤵
    PID:7748

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCBBCBCCBCBCCABCCACBBCAAACBCCACCABBACCCBAAAAAAAACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCBBCBCCBCBCCABCCACBBCAAACBCCACCABBACCCBAAAAAAAACCA.exe
1⤵
PID:6740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBABBABCAAABCBAACCACCCACAACAABACABCCACBCCBBBAABBCCAABBAABCBCBBBCABCBCCACBBABBCAAACBAACABACBAACCBACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACAAABBBBAAACAABCCACABCACCABBBCCBAACCCABBABBABBBBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:1948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBABBABCAAABCBAACCACCCACAACAABACABCCACBCCBBBAABBCCAABBAABCBCBBBCABCBCCACBBABBCAAACBAACABACBAACCBACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACAAABBBBAAACAABCCACABCACCABBBCCBAACCCABBABBABBBBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCCBBCACBACCCCAABABBACACAABCBABBACBAABAAAAAAACCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACAAABBBBAAACAABCCACABCACCABBBCCBAACCCABBABBABBBBACB.exe" start= auto displayName= "UserDataSvc_CABCCBBCACBACCCCAABABBACACAABCBABBACBAABAAAAAAACCAB"
  2⤵
  PID:7196
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCCBBCACBACCCCAABABBACACAABCBABBACBAABAAAAAAACCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACAAABBBBAAACAABCCACABCACCABBBCCBAACCCABBABBABBBBACB.exe" start= auto displayName= "UserDataSvc_CABCCBBCACBACCCCAABABBACACAABCBABBACBAABAAAAAAACCAB"
    3⤵
    PID:7444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCCBBCACBACCCCAABABBACACAABCBABBACBAABAAAAAAACCAB"
  2⤵
  PID:7512
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCCBBCACBACCCCAABABBACACAABCBABBACBAABAAAAAAACCAB"
    3⤵
    - Launches sc.exe
    PID:7692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACACAAABCABBCCBBCCBABBABACAACBBBBCABCCACCBACBBBCABBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACACAAABCABBCCBBCCBABBABACAACBBBBCABCCACCBACBBBCABBCB.exe
1⤵
PID:6432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBACACBCCCCABABCBCABACCCCBCAABABCCABCABCCCBCACAABCCABCACABABCCABBCCACBCACBCACCABBCABBBABAACCBABABAABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBBBCBCCCBBABBBBABBAACACBABCCBCAABBBBABCABABABAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBACACBCCCCABABCBCABACCCCBCAABABCCABCABCCCBCACAABCCABCACABABCCABBCCACBCACBCACCABBCABBBABAACCBABABAABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBBBCBCCCBBABBBBABBAACACBABCCBCAABBBBABCABABABAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCABACCABCAABBBBBCAABBABCBCCCBAABBABCAABCBBBCCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBBBCBCCCBBABBBBABBAACACBABCCBCAABBBBABCABABABAACC.exe" start= auto displayName= "UserDataSvc_ABBCABACCABCAABBBBBCAABBABCBCCCBAABBABCAABCBBBCCCCC"
  2⤵
  PID:2792
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBCABACCABCAABBBBBCAABBABCBCCCBAABBABCAABCBBBCCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBBBCBCCCBBABBBBABBAACACBABCCBCAABBBBABCABABABAACC.exe" start= auto displayName= "UserDataSvc_ABBCABACCABCAABBBBBCAABBABCBCCCBAABBABCAABCBBBCCCCC"
    3⤵
    - Launches sc.exe
    PID:7624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBCABACCABCAABBBBBCAABBABCBCCCBAABBABCAABCBBBCCCCC"
  2⤵
  PID:7608
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBCABACCABCAABBBBBCAABBABCBCCCBAABBABCAABCBBBCCCCC"
    3⤵
    - Launches sc.exe
    PID:7924

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACACAAABCABBCCBBCCBABBABACAACBBBBCABCCACCBACBBBCABBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACACAAABCABBCCBBCCBABBABACAACBBBBCABCCACCBACBBBCABBCB.exe
1⤵
PID:6492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBCBBBCBCCCBBABBBBABBAACACBABCCBCAABBBBABCABABABAACCAAABABBBCACAAABCABAACCBACCBCBBBCBBABAABCABAAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABABAAAACCBBBCABAAAACABCCCCAABCCAABABABBCCCCBBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:7916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBCBBBCBCCCBBABBBBABBAACACBABCCBCAABBBBABCABABABAACCAAABABBBCACAAABCABAACCBACCBCBBBCBBABAABCABAAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABABAAAACCBBBCABAAAACABCCCCAABCCAABABABBCCCCBBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABABBBAABABCBBBABBCBCCBBABABAABBABBBCCCBBBBCABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABABAAAACCBBBCABAAAACABCCCCAABCCAABABABBCCCCBBACC.exe" start= auto displayName= "UserDataSvc_CBABABBBAABABCBBBABBCBCCBBABABAABBABBBCCCBBBBCABBAB"
  2⤵
  PID:1720
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABABBBAABABCBBBABBCBCCBBABABAABBABBBCCCBBBBCABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABABAAAACCBBBCABAAAACABCCCCAABCCAABABABBCCCCBBACC.exe" start= auto displayName= "UserDataSvc_CBABABBBAABABCBBBABBCBCCBBABABAABBABBBCCCBBBBCABBAB"
    3⤵
    - Launches sc.exe
    PID:7228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABABBBAABABCBBBABBCBCCBBABABAABBABBBCCCBBBBCABBAB"
  2⤵
  - Executes a command shell one-liner
  PID:7576
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABABBBAABABCBBBABBCBCCBBABABAABBABBBCCCBBBBCABBAB"
    3⤵
    - Launches sc.exe
    PID:7600

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCACCCBBCACCACBBACCAABBCCACBACCCCACCACCAABBAAABCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCACCCBBCACCACBBACCAABBCCACBACCCCACCACCAABBAAABCBCB.exe
1⤵
PID:4872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBCABAACCACCCABBBABAABABCBCCCABBBABCBBACCACCBBCABBAABCBCABABABBAACABAABCBBBBBBAAACCCCCCAABBCABCBABCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBBACCCBCCACBAABCBAABCABBAACBBABBCCCAACCACBAAAACABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:8928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBCABAACCACCCABBBABAABABCBCCCABBBABCBBACCACCBBCABBAABCBCABABABBAACABAABCBBBBBBAAACCCCCCAABBCABCBABCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBBACCCBCCACBAABCBAABCABBAACBBABBCCCAACCACBAAAACABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABAACCCCCCBCABBBBACBBCBBCACACACCCBACCCBBCABBABCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBBACCCBCCACBAABCBAABCABBAACBBABBCCCAACCACBAAAACABC.exe" start= auto displayName= "UserDataSvc_CCABAACCCCCCBCABBBBACBBCBBCACACACCCBACCCBBCABBABCBA"
  2⤵
  - Executes a command shell one-liner
  PID:9564
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABAACCCCCCBCABBBBACBBCBBCACACACCCBACCCBBCABBABCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBBACCCBCCACBAABCBAABCABBAACBBABBCCCAACCACBAAAACABC.exe" start= auto displayName= "UserDataSvc_CCABAACCCCCCBCABBBBACBBCBBCACACACCCBACCCBBCABBABCBA"
    3⤵
    - Launches sc.exe
    PID:9640

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCACCCBBCACCACBBACCAABBCCACBACCCCACCACCAABBAAABCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCACCCBBCACCACBBACCAABBCCACBACCCCACCACCAABBAAABCBCB.exe
1⤵
PID:244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCCABCACCACABBAABABACACCACCBCABCACBCABCCBCAACCCABABCCCAABBABCCBCBABABBCAABBBAAABBCAABBCCBCBBACACBCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAACCACBABABBCACCACAABBCABABCBCCBACCBAABAACCBACACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCCABCACCACABBAABABACACCACCBCABCACBCABCCBCAACCCABABCCCAABBABCCBCBABABBCAABBBAAABBCAABBCCBCBBACACBCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAACCACBABABBCACCACAABBCABABCBCCBACCBAABAACCBACACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBABABAACACCCCCBCBBCBCABAABCACBACCBCCBACBBACACAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAACCACBABABBCACCACAABBCABABCBCCBACCBAABAACCBACACAAC.exe" start= auto displayName= "UserDataSvc_CBBABABAACACCCCCBCBBCBCABAABCACBACCBCCBACBBACACAACB"
  2⤵
  PID:7800
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBABABAACACCCCCBCBBCBCABAABCACBACCBCCBACBBACACAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAACCACBABABBCACCACAABBCABABCBCCBACCBAABAACCBACACAAC.exe" start= auto displayName= "UserDataSvc_CBBABABAACACCCCCBCBBCBCABAABCACBACCBCCBACBBACACAACB"
    3⤵
    - Launches sc.exe
    PID:7848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBABABAACACCCCCBCBBCBCABAABCACBACCBCCBACBBACACAACB"
  2⤵
  - Executes a command shell one-liner
  PID:7896
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBABABAACACCCCCBCBBCBCABAABCACBACCBCCBACBBACACAACB"
    3⤵
    - Launches sc.exe
    PID:8064

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCAACCBCABACCCABCACCACBCCBAABBABAAACBCCCCABBBCAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCAACCBCABACCCABCACCACBCCBAABBABAAACBCCCCABBBCAABBB.exe
1⤵
PID:5936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACABACBAAACCACABABACBACBBCCBBABAABAAABCBAAACCCBCBCCCCCCBCACACCAABACAAABCCABCCBBAABBABBBACCBBCACACAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCBCACBBBBBBBCAAACCCABCBABCCAABACAABCBCBCCCBAACABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACABACBAAACCACABABACBACBBCCBBABAABAAABCBAAACCCBCBCCCCCCBCACACCAABACAAABCCABCCBBAABBABBBACCBBCACACAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCBCACBBBBBBBCAAACCCABCBABCCAABACAABCBCBCCCBAACABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBABBAAAABBAABBCCACCACACABCBABBAAAABABCBCAACABCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCBCACBBBBBBBCAAACCCABCBABCCAABACAABCBCBCCCBAACABCA.exe" start= auto displayName= "UserDataSvc_ABBABBAAAABBAABBCCACCACACABCBABBAAAABABCBCAACABCACA"
  2⤵
  - Executes a command shell one-liner
  PID:7448
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBABBAAAABBAABBCCACCACACABCBABBAAAABABCBCAACABCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCBCACBBBBBBBCAAACCCABCBABCCAABACAABCBCBCCCBAACABCA.exe" start= auto displayName= "UserDataSvc_ABBABBAAAABBAABBCCACCACACABCBABBAAAABABCBCAACABCACA"
    3⤵
    - Launches sc.exe
    PID:6796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBABBAAAABBAABBCCACCACACABCBABBAAAABABCBCAACABCACA"
  2⤵
  - Executes a command shell one-liner
  PID:7552
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBABBAAAABBAABBCCACCACACABCBABBAAAABABCBCAACABCACA"
    3⤵
    - Launches sc.exe
    PID:7940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCAACCBCABACCCABCACCACBCCBAABBABAAACBCCCCABBBCAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCAACCBCABACCCABCACCACBCCBAABBABAAACBCCCCABBBCAABBB.exe
1⤵
PID:4684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCBBAACAACACABBCBAACBAACAAAAABABABBCABACCCCBCAABACCABCCBBABCCCBBCCCAACBAACACBCAAACBBBCABAABBCACACABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABABBCBBCBBBABAACAACAAABBBABCCBCABBCBACCBBCBBCACACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:8012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCBBAACAACACABBCBAACBAACAAAAABABABBCABACCCCBCAABACCABCCBBABCCCBBCCCAACBAACACBCAAACBBBCABAABBCACACABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABABBCBBCBBBABAACAACAAABBBABCCBCABBCBACCBBCBBCACACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACBBACBAAABAAAACBBABAAABCBABAACCACBCAABBACBBCBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABABBCBBCBBBABAACAACAAABBBABCCBCABBCBACCBBCBBCACACABA.exe" start= auto displayName= "UserDataSvc_CBACBBACBAAABAAAACBBABAAABCBABAACCACBCAABBACBBCBCBC"
  2⤵
  PID:7492
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACBBACBAAABAAAACBBABAAABCBABAACCACBCAABBACBBCBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABABBCBBCBBBABAACAACAAABBBABCCBCABBCBACCBBCBBCACACABA.exe" start= auto displayName= "UserDataSvc_CBACBBACBAAABAAAACBBABAAABCBABAACCACBCAABBACBBCBCBC"
    3⤵
    - Launches sc.exe
    PID:8024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACBBACBAAABAAAACBBABAAABCBABAACCACBCAABBACBBCBCBC"
  2⤵
  PID:8176
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACBBACBAAABAAAACBBABAAABCBABAACCACBCAABBACBBCBCBC"
    3⤵
    - Launches sc.exe
    PID:6796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACABABCBBCBABBBAACBACABACABCABAABACABBBABCBAAABCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACABABCBBCBABBBAACBACABACABCABAABACABBBABCBAAABCBAA.exe
1⤵
PID:5548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCBBAAAACBACBBAABCBBBCABACACAABCCCABAACABCBACACAACACAABACAACBABBACAABBABCBCBCBAABBAACACCCABBBBCCCCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACBAABAACCCBCBCBAABCBABACCAABBACACACBBCABAABCBCCCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:8300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCBBAAAACBACBBAABCBBBCABACACAABCCCABAACABCBACACAACACAABACAACBABBACAABBABCBCBCBAABBAACACCCABBBBCCCCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACBAABAACCCBCBCBAABCBABACCAABBACACACBBCABAABCBCCCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBBACCBCBCCBABCACCBCBBCBCABBACBCBABCAACBACCBCCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACBAABAACCCBCBCBAABCBABACCAABBACACACBBCABAABCBCCCBAA.exe" start= auto displayName= "UserDataSvc_ACCBBACCBCBCCBABCACCBCBBCBCABBACBCBABCAACBACCBCCBAC"
  2⤵
  - Executes a command shell one-liner
  PID:9008
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBBACCBCBCCBABCACCBCBBCBCABBACBCBABCAACBACCBCCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACBAABAACCCBCBCBAABCBABACCAABBACACACBBCABAABCBCCCBAA.exe" start= auto displayName= "UserDataSvc_ACCBBACCBCBCCBABCACCBCBBCBCABBACBCBABCAACBACCBCCBAC"
    3⤵
    PID:8096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBBACCBCBCCBABCACCBCBBCBCABBACBCBABCAACBACCBCCBAC"
  2⤵
  - Executes a command shell one-liner
  PID:5740
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBBACCBCBCCBABCACCBCBBCBCABBACBCBABCAACBACCBCCBAC"
    3⤵
    - Launches sc.exe
    PID:9996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACABABCBBCBABBBAACBACABACABCABAABACABBBABCBAAABCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACABABCBBCBABBBAACBACABACABCABAABACABBBABCBAAABCBAA.exe
1⤵
PID:6688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCCCBBCABACCCCBAABBBBACBBBACACCCCABCCACACBCCBCACCCACCCBACCBBABBAABAAACCCBACAAACCCAAABABAABBCCBCBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABABABBBCBBAAABBBBBABCBBBBCCABACCBCACCCCBAAAABCBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8232
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCCCBBCABACCCCBAABBBBACBBBACACCCCABCCACACBCCBCACCCACCCBACCBBABBAABAAACCCBACAAACCCAAABABAABBCCBCBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABABABBBCBBAAABBBBBABCBBBBCCABACCBCACCCCBAAAABCBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBBABAACAACAAABAAACACCCBCBCBACCBAAACCBBACAABBAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABABABBBCBBAAABBBBBABCBBBBCCABACCBCACCCCBAAAABCBBBC.exe" start= auto displayName= "UserDataSvc_CBBBABAACAACAAABAAACACCCBCBCBACCBAAACCBBACAABBAACBB"
  2⤵
  - Executes a command shell one-liner
  PID:8824
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBBABAACAACAAABAAACACCCBCBCBACCBAAACCBBACAABBAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABABABBBCBBAAABBBBBABCBBBBCCABACCBCACCCCBAAAABCBBBC.exe" start= auto displayName= "UserDataSvc_CBBBABAACAACAAABAAACACCCBCBCBACCBAAACCBBACAABBAACBB"
    3⤵
    PID:8028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBBABAACAACAAABAAACACCCBCBCBACCBAAACCBBACAABBAACBB"
  2⤵
  - Executes a command shell one-liner
  PID:9388
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBBABAACAACAAABAAACACCCBCBCBACCBAAACCBBACAABBAACBB"
    3⤵
    - Launches sc.exe
    PID:5296

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCCAACABCCBCACCCACBBCABABBCABCBBBCBBCBBCABAABACACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCCAACABCCBCACCCACBBCABABBCABCBBBCBBCBBCABAABACACBA.exe
1⤵
PID:7044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBACBCCCBABCABAACBCBBBBBABAAAAAAABCABAABCBBCABBBCACBCAAAACABAAACBAACBBCBCCAAACACBABBBBAACACAABBBCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABCBACCBAACBBCBABBBACBCBBABBBCBCAABBAAACCBCCBCABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2348
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBACBCCCBABCABAACBCBBBBBABAAAAAAABCABAABCBBCABBBCACBCAAAACABAAACBAACBBCBCCAAACACBABBBBAACACAABBBCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABCBACCBAACBBCBABBBACBCBBABBBCBCAABBAAACCBCCBCABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCCAACABCCBCACCCACBBCABABBCABCBBBCBBCBBCABAABACACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCCAACABCCBCACCCACBBCABABBCABCBBBCBBCBBCABAABACACBA.exe
1⤵
PID:6612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABAAABBABBCBACBACAAACBBCBCCCBCCABABCABABBABAAACCBBBAACCBCBBBBAACCBCBBBAACCCAACBAABBBBABCABCACAAAAABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABACBCBCBCBCBBBCCBBABBCCACACBAACACACCAACACACCBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:8532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABAAABBABBCBACBACAAACBBCBCCCBCCABABCABABBABAAACCBBBAACCBCBBBBAACCBCBBBAACCCAACBAABBBBABCABCACAAAAABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABACBCBCBCBCBBBCCBBABBCCACACBAACACACCAACACACCBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAABBAAABACCABCACBBCABCCCABBAACBCCCCBABABCBBAACAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABACBCBCBCBCBBBCCBBABBCCACACBAACACACCAACACACCBACBC.exe" start= auto displayName= "UserDataSvc_BBAABBAAABACCABCACBBCABCCCABBAACBCCCCBABABCBBAACAAB"
  2⤵
  - Executes a command shell one-liner
  PID:4584

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABCACCABACABABCABCCAAABBBCCCCABCACABAAAAAABCAAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABCACCABACABABCABCCAAABBBCCCCABCACABAAAAAABCAAAACB.exe
1⤵
PID:5992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCBBBBABABABACBBACAACBCBBBAAACCBAAABCACCBABBCAABCABCABBAABAABBCCBCAAABCBCCACABBCCABCABBBACCACBBBCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCCBCCACBABCCBBACCCCBCACBCAABABAAAAABBCBBCBBAABBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCBBBBABABABACBBACAACBCBBBAAACCBAAABCACCBABBCAABCABCABBAABAABBCCBCAAABCBCCACABBCCABCABBBACCACBBBCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCCBCCACBABCCBBACCCCBCACBCAABABAAAAABBCBBCBBAABBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2420

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABCACCABACABABCABCCAAABBBCCCCABCACABAAAAAABCAAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABCACCABACABABCABCCAAABBBCCCCABCACABAAAAAABCAAAACB.exe
1⤵
PID:6956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBAACACAAABCBACBAAABCCAAABBCBBBBCBABACACABBCCBCAAABBBCCBCAABCCAACCAACCABBACABBAAAABBAABAABABCABBCCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBBAAABBBCCBBBBACAAACCBCAABACACBCCBCBACACBCCCCACCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:9680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBAACACAAABCBACBAAABCCAAABBCBBBBCBABACACABBCCBCAAABBBCCBCAABCCAACCAACCABBACABBAAAABBAABAABABCABBCCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBBAAABBBCCBBBBACAAACCBCAABACACBCCBCBACACBCCCCACCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBACABCBCCBBBBBBCBCCBBCAACCABACBACBBABCCCAABBBBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBACABCBCCBBBBBBCBCCBBCAACCABACBACBBABCCCAABBBBACC.exe
1⤵
PID:2064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCACAACCBAAACCCBCCBACCAAABBAABACBABBBAAABCCAACCABABBABBAAABBCABAABBBAABBBCCBABABCCCBBBCCCBCABCACBCBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABCCACCCBBCABCCCCABBABBAACBCCCCCABACCCCBABCABABABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBACABCBCCBBBBBBCBCCBBCAACCABACBACBBABCCCAABBBBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBACABCBCCBBBBBBCBCCBBCAACCABACBACBBABCCCAABBBBACC.exe
1⤵
PID:6844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABABCAABABABACBCCAABBAABAABCACAABBBBAAAACABCBABCCBBACCACABACCACBCBABAACCACCABBCCAAACCBABBACBCAAAACACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCACABBACCCCCBBACAACABBBCAABACCACBBACBAACACCBBCCCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6976

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAACBABBCABCCCBCBBCCCBBBACACCCCACBAAABBCCAACCCCAABABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAACBABBCABCCCBCBBCCCBBBACACCCCACBAAABBCCAACCCCAABABC.exe
1⤵
PID:7332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACBABCCACCAACAABCCCACCBBACAACCCCACACCCABACBAABABAACBACBCBABCBABCBAACCCCAAACBBBCCCABCCCCCABCABCCAAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCACCCAAACAACBACBBBCCBABBCCBCCABCACBBCCBACBCBCCCBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:8924

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAACBABBCABCCCBCBBCCCBBBACACCCCACBAAABBCCAACCCCAABABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAACBABBCABCCCBCBBCCCBBBACACCCCACBAAABBCCAACCCCAABABC.exe
1⤵
PID:7340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCCBACCCBABACCBBABCBBBAABCBBBBAAACABBCBACBBCACCABBBCBCBABCABCCCACCCACCABABCABAABBACBBBBBCCACBAAACCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCCCBACBCCCBCCCCCABAACABBBCABCCABCAACABACCABBCABBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10120

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACAAABBBBAAACAABCCACABCACCABBBCCBAACCCABBABBABBBBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACAAABBBBAAACAABCCACABCACCABBBCCBAACCCABBABBABBBBACB.exe
1⤵
PID:7676

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBABBBCBBAACCCACBCBCBBABCAAAACACBCCABBCBABBBBBBCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBABBBCBBAACCCACBCBCBBABCAAAACACBCCABBCBABBBBBBCCBC.exe
1⤵
PID:7684

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACAAABBBBAAACAABCCACABCACCABBBCCBAACCCABBABBABBBBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACAAABBBBAAACAABCCACABCACCABBBCCBAACCCABBABBABBBBACB.exe
1⤵
PID:7716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBABBBCBBAACCCACBCBCBBABCAAAACACBCCABBCBABBBBBBCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBABBBCBBAACCCACBCBCBBABCAAAACACBCCABBCBABBBBBBCCBC.exe
1⤵
PID:7780

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAACCACBABABBCACCACAABBCABABCBCCBACCBAABAACCBACACAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAACCACBABABBCACCACAABBCABABCBCCBACCBAABAACCBACACAAC.exe
1⤵
PID:7220

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABABAAAACCBBBCABAAAACABCCCCAABCCAABABABBCCCCBBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABABAAAACCBBBCABAAAACABCCCCAABCCAABABABBCCCCBBACC.exe
1⤵
PID:7820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBCACCABACACCACCABCBABCAAAACBCABAACBACCAABCABBACBCBABBCBABACACACBCBBBBCAACCCACAABBACCCCBABCBBBAACCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBCBCABABCBBACBCBCCAAABCCCCAACBAACAACBABCBAABBBBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:8424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBCACCABACACCACCABCBABCAAAACBCABAACBACCAABCABBACBCBABBCBABACACACBCBBBBCAACCCACAABBACCCCBABCBBBAACCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBCBCABABCBBACBCBCCAAABCCCCAACBAACAACBABCBAABBBBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACACBAABABBBCBACBBACABBBCABCCCCACCBACACACBBBABCBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBCBCABABCBBACBCBCCAAABCCCCAACBAACAACBABCBAABBBBBCB.exe" start= auto displayName= "UserDataSvc_ACACBAABABBBCBACBBACABBBCABCCCCACCBACACACBBBABCBCAA"
  2⤵
  - Executes a command shell one-liner
  PID:9476
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACACBAABABBBCBACBBACABBBCABCCCCACCBACACACBBBABCBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBCBCABABCBBACBCBCCAAABCCCCAACBAACAACBABCBAABBBBBCB.exe" start= auto displayName= "UserDataSvc_ACACBAABABBBCBACBBACABBBCABCCCCACCBACACACBBBABCBCAA"
    3⤵
    - Launches sc.exe
    PID:5276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABABAAAACCBBBCABAAAACABCCCCAABCCAABABABBCCCCBBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABABAAAACCBBBCABAAAACABCCCCAABCCAABABABBCCCCBBACC.exe
1⤵
PID:7852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACAAAAAABBBCCBCCAAACBACBACCBCBBCABBCCACBCBCBBCBCCCABBBBCACCCBBBAACCBBBBACCBCBCBBBCBBCBCACACAAABCBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAAABBABBCBACBACAAACBBCBCCCBCCABABCABABBABAAACCBBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:8252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACAAAAAABBBCCBCCAAACBACBACCBCBBCABBCCACBCBCBBCBCCCABBBBCACCCBBBAACCBBBBACCBCBCBBBCBBCBCACACAAABCBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAAABBABBCBACBACAAACBBCBCCCBCCABABCABABBABAAACCBBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCBABCBACCBCCBBBCCABBBBBCCCCAACBABACAACABCCBBABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAAABBABBCBACBACAAACBBCBCCCBCCABABCABABBABAAACCBBBAA.exe" start= auto displayName= "UserDataSvc_CABCBABCBACCBCCBBBCCABBBBBCCCCAACBABACAACABCCBBABAC"
  2⤵
  - Executes a command shell one-liner
  PID:8316

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBBBCBCCCBBABBBBABBAACACBABCCBCAABBBBABCABABABAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBBBCBCCCBBABBBBABBAACACBABCCBCAABBBBABCABABABAACC.exe
1⤵
PID:7868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAABCACCACABCAAACCCACCCBABABAABBCBCCBACBCBBABBCAACBACCABACBAACCCBBACCCCCCBBCBCBABBCBACCCABACABCCCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABABCCCBAAACBBABCACABBAACBCAAABCABBCAAABCBBCAAAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:8368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAABCACCACABCAAACCCACCCBABABAABBCBCCBACBCBBABBCAACBACCABACBAACCCBBACCCCCCBBCBCBABBCBACCCABACABCCCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABABCCCBAAACBBABCACABBAACBCAAABCABBCAAABCBBCAAAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCBACCAAACCCACBCCBACBACACBACCBCBCACBBCCCCCBAAACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABABCCCBAAACBBABCACABBAACBCAAABCABBCAAABCBBCAAAACAA.exe" start= auto displayName= "UserDataSvc_ACCCBACCAAACCCACBCCBACBACACBACCBCBCACBBCCCCCBAAACAB"
  2⤵
  PID:10044

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBBBCBCCCBBABBBBABBAACACBABCCBCAABBBBABCABABABAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBBBCBCCCBBABBBBABBAACACBABCCBCAABBBBABCABABABAACC.exe
1⤵
PID:7832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAACBABAACCCBACCCBAABBBCBBCACABACCCACBCBBBABAAAACBCBBCAAABBACABCABCBAABBACBACBBBCABCBAACCABCBBCBABBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCACCABACACCACCABCBABCAAAACBCABAACBACCAABCABBACBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAACBABAACCCBACCCBAABBBCBBCACABACCCACBCBBBABAAAACBCBBCAAABBACABCABCBAABBACBACBBBCABCBAACCABCBBCBABBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCACCABACACCACCABCBABCAAAACBCABAACBACCAABCABBACBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBAAAABBCCABAABABCBBACAABABBCBCCCBBBCAABCCBBCACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCACCABACACCACCABCBABCAAAACBCABAACBACCAABCABBACBCBAB.exe" start= auto displayName= "UserDataSvc_BCCBAAAABBCCABAABABCBBACAABABBCBCCCBBBCAABCCBBCACCB"
  2⤵
  PID:10152

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCBCACBBBBBBBCAAACCCABCBABCCAABACAABCBCBCCCBAACABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBCBCACBBBBBBBCAAACCCABCBABCCAABACAABCBCBCCCBAACABCA.exe
1⤵
PID:2936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABABCAABABABACBCCAABBAABAABCACAABBBBAAAACABCBABCCBBACCACABACCACBCBABAACCACCABBCCAAACCBABBACBCAAAACACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBABAABABABAACBBBAAABBBCAACABCCCBAACACABBAAAACBCCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:9928

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABABBCBBCBBBABAACAACAAABBBABCCBCABBCBACCBBCBBCACACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABABBCBBCBBBABAACAACAAABBBABCCBCABBCBACCBBCBBCACACABA.exe
1⤵
PID:1916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBABBBCABCBAACBABABACACCCCBCAABCBBABBAABCCCBBBAAACCBCCAACCACABAACBABCAACACCAACBBABCBACCBBBCCACABCCCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACAACCAABCBCBACCCACABCBACCCABAABCCBABBACCBCBCBABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBABBBCABCBAACBABABACACCCCBCAABCBBABBAABCCCBBBAAACCBCCAACCACABAACBABCAACACCAACBBABCBACCBBBCCACABCCCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACAACCAABCBCBACCCACABCBACCCABAABCCBABBACCBCBCBABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9360

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABABBCBBCBBBABAACAACAAABBBABCCBCABBCBACCBBCBBCACACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABABBCBBCBBBABAACAACAAABBBABCCBCABBCBACCBBCBBCACACABA.exe
1⤵
PID:1760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAACAACCAABCBCBACCCACABCBACCCABAABCCBABBACCBCBCBABBABABBCCBCCACCCACBBCABACBBCCBBCBABCBAACBABCBCCBAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACBACBCCAABAABCACBCCAAACABABBACABCABBAAABCCCCCCCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:8028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAACAACCAABCBCBACCCACABCBACCCABAABCCBABBACCBCBCBABBABABBCCBCCACCCACBBCABACBBCCBBCBABCBAACBABCBCCBAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACBACBCCAABAABCACBCCAAACABABBACABCABBAAABCCCCCCCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCACBAABCCBABCBABCACCCCBCCCBBBBACBBACABAACCACBABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACBACBCCAABAABCACBCCAAACABABBACABCABBAAABCCCCCCCABB.exe" start= auto displayName= "UserDataSvc_BBCACBAABCCBABCBABCACCCCBCCCBBBBACBBACABAACCACBABAA"
  2⤵
  PID:7156

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBBCBBBBABAABBBABCAAACAAACACCBABBCCACACBABBBBBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBBCBBBBABAABBBABCAAACAAACACCBABBCCACACBABBBBBCCCC.exe
1⤵
PID:8848

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBBCBBBBABAABBBABCAAACAAACACCBABBCCACACBABBBBBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCBBCBBBBABAABBBABCAAACAAACACCBABBCCACACBABBBBBCCCC.exe
1⤵
PID:8868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCCBACCCBABACCBBABCBBBAABCBBBBAAACABBCBACBBCACCABBBCBCBABCABCCCACCCACCABABCABAABBACBBBBBCCACBAAACCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCCAABABBBACBCACABCCACABAABCBBBBCBBBBBBBAACCBCCACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:6176

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABABABBBCBBAAABBBBBABCBBBBCCABACCBCACCCCBAAAABCBBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABABABBBCBBAAABBBBBABCBBBBCCABACCBCACCCCBAAAABCBBBC.exe
1⤵
PID:8908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCBBABABBBACABAABCBCACAABBBABBBCCBBAACAABCBBACACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCBBABABBBACABAABCBCACAABBBABBBCCBBAACAABCBBACACCC.exe
1⤵
PID:8820

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBCCBBCBCBCAABBBBCBCAAACCBACBCCBAACCABBABABABBAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBCCBBCBCBCAABBBBCBCAAACCBACBCCBAACCABBABABABBAABAB.exe
1⤵
PID:8800

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBBACCCBCCACBAABCBAABCABBAACBBABBCCCAACCACBAAAACABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBBACCCBCCACBAABCBAABCABBAACBBABBCCCAACCACBAAAACABC.exe
1⤵
PID:9848

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACBAABAACCCBCBCBAABCBABACCAABBACACACBBCABAABCBCCCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACBAABAACCCBCBCBAABCBABACCAABBACACACBBCABAABCBCCCBAA.exe
1⤵
PID:9868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACBAABAACCCBCBCBAABCBABACCAABBACACACBBCABAABCBCCCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACBAABAACCCBCBCBAABCBABACCAABBACACACBBCABAABCBCCCBAA.exe
1⤵
PID:9244

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBCCBBCBCBCAABBBBCBCAAACCBACBCCBAACCABBABABABBAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBCCBBCBCBCAABBBBCBCAAACCBACBCCBAACCABBABABABBAABAB.exe
1⤵
PID:6840

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABABABBBCBBAAABBBBBABCBBBBCCABACCBCACCCCBAAAABCBBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABABABBBCBBAAABBBBBABCBBBBCCABACCBCACCCCBAAAABCBBBC.exe
1⤵
PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 93f5490fb23b994cb099ef44a2131a595d6229ca8b2a8b32b9f0e0dbe50f82a1
MD5 fbccdfc466cae863d6d90652b70ca100
SHA1 cbf0f1cf38f7325458765e24110bb731e29d3fec
SHA512 c8af716a7402192e76506f0da6476759129333a89ce857cefd7d171cbd9670058b5ce928dfc887ab371afb710a5271f220adba1c7fa9c3879b1fc91857682e35
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Program Files\Common Files\DESIGNER\qap`g`v~dtlq
Size 10B
SHA256 780274222d584bb3da048f4ecc63adb95c95015a16762cf90958388a301fc6a1
MD5 2b4418100f58389c6d16258c8d22b213
SHA1 a336dae19c1e98be8de9c14ff955d42a096ebb28
SHA512 9756865e012915a9473857509abbaf81cf4774f55d17dc1f3e4488fb799d45ce1430435c5553a83ef562954ec68fbf810f825d4d6a2840e2d238ace24d161da6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Program Files\Common Files\microsoft shared\Source Engine\qap`g`v~dtlq
Size 10B
SHA256 188ded7eff918792f69837b88ca6f8481817e6367c0e66d8117ab40dde73106f
MD5 4d6bda6dd2ac46879a69d7b4ef9ceb4a
SHA1 b74fdb4063f540d600471f72beed7a79ed5cbda3
SHA512 343841e8fbbb5b2cfa0ab5524208f90a9902084e5ea16a357b1d39d2f33682852eb4de555dd1b6933bff0fe93bf8d101f7761c605117af47a4244bbfb08b5b59
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Program Files\Common Files\microsoft shared\ink\as-IN\qap`g`v~dtlq
Size 10B
SHA256 aa81d7206affcde0bdca5404c2876013e08d44839ca5490bee0c23b125f4d5fc
MD5 9c36a1448bd2f62e690ef37d3c7b29c0
SHA1 a915d50a7cce168679a2d735ef98be945a56df06
SHA512 33ac1a67267b375b83c8673e71b68d87d8749ab501f32d7c4b744ac33973134b212683e903ee7b2d6a890f8721e9422d89d87ebf7f27312f2d6ffa527a813aec
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Admin\AppData\Local\Temp\virus_log.txt
Size 2KB
SHA256 9f54ece8efd30407ad93a638f55a554c7876b53761b8a683894e31c2ddb9040e
MD5 37c4099dbd3a69663b8defc002b5ecf2
SHA1 04d0666256b25ba64754e901e67db341a4968a24
SHA512 df444df9ab810d90b34c968752d93ccc64b8e9b12e81a040bed575aeac57abcdcb8ba8f29299e2bdd0206155e02688fba8a0aeaa00fbe2a964fa6e16a53b4840
TLSH
T10B41879289FD9C33951158CBE627EDCD94F8775F3D48AA54A348491673808B3DCAA881
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d3257a03c82dddc5b450729e49cefc217b1e09dced295f2ca40661cbeee8d571
MD5 50b3cf48d5b8f42e6339421bfd1afd15
SHA1 bf8f12a4fb2ebfbd7df5de1619f08cbf4e238e2e
SHA512 1c37436f641e1380e2f4dcff251b50c684582a9f7b8521ab29344226a2e45d81525a85f4d4a0f69a8d4eef54c642d27e4c2906f1cba57e92a5e2dce60c1d19a4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c0113b5db560cc9f26ceb6e67adcd6134992fd18c96c0c53cc231f72237c0d38
MD5 7c2e2816660bbbeb57c777b4b3542b49
SHA1 b8e4ccbe74ed09a0c255993a092109088f3c6f6a
SHA512 1dea0ef8777465eb6760d4cac4c3ce3c7d5ddec148e4d67f88ca1f86d96ef3cd27b466c6aa578e85cc7bbecdb942b42f25e04e8cd968f5a9cc977a0dd3f2b050
MD5 SHA1 SHA512

Submit Download

svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACCCAABABACCBCCCABAAABACBBBACABBABAACCCAABACCBACC.exe
Size 41.2MB
SHA256 591ddbb54a545842a189be259e690cac15aa3e99ea86fffce4aa9c65c35dd428
MD5 0acaa9a8ba9bf8b69f8dbb9ec5c4f7df
SHA1 e6d2258e470eb02a6c35c90ba1984b1e2b7412a8
SHA512 0ab52c614af2b4d1c32261c4e67b463e7313bdc1984387a1f5ce0863d68c2f9387c4df0ebe027046167cafeeef267b5fa50ba8a12c60fa6f7b5bba81b22f921b
SSDEEP 98304:z4TD4TD4TD4T5OU/jIEeQfoR/IuOFVjUu5A:z000SFIF0wuG
TLSH
T1C0978E01FADA00B5F0730670DDBAE27A5935FDE99912C96EF64DA50F2633F10C929326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 33760e0da5474ec7763978489f85951146e64e4db21cc14114b8a1d79c9f4be6
MD5 0e185c97e15ffeeaf725b943c130edff
SHA1 81bb6b4875084e4e7f062ba061e55953e121a900
SHA512 3659d7cadc452b2db8738d5ccf03f54b9f4cce1c12de01bd24bfaf0a85e20b1174ec825c3c92fe083035b53b2ecf00ce27a572cfd979a7b59663e71bc4b5bc03
SSDEEP 96:oDR1/M4PqMa+uPT+fbLt1tMh4M2f+dqbpFT1AcP4c6bZoFT1ADm4D7ulJ+J+w8lY:KSmNpUMf9zuQ+
TLSH
T1D89138F1E5B59C73E23268CB96199AD10CF8739FBD8C9A14620D8A1CA795833CC6D4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 3b6bc5c44522555fce1d9e53b15580da4fb209e2acbe68c16fc7ee59d7071bdd
MD5 f461c8a0596c3aaa8ac5f03b95d7925f
SHA1 86d602d4b7efbf1629843b06eaa41937e798817c
SHA512 f8387c3843a2308af4d10d12b2785ace43547dc8aad95078a92c29b82cb31e05e16b7754ed7046928546dd1321d10298b879055fe6fff3df478383a3bd5070ca
SSDEEP 96:oDR1/M4PqMa+uPT+fbLt1tMh4M2f+dqbpFT1AcP4c6bZoFT1ADm4D7ulJ+J+w8l/:KSmNpUMf9zuQmo
TLSH
T11AA15CF1E5B58C73E63268CB9A19D9D14CF8739FB98C9A10620D4A1CE794833CC6D4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 5561feeeba06851bead6c7327f84bcff695b17747c348cab8b3072152f650ce2
MD5 04df785011681be9354d07453b073d47
SHA1 df6a36089e59f15312d9e1d205b26253a1b7a986
SHA512 5227770097e12cf8747fe32d52766eb4becd8021154be8973da48a5a096cc75492ef377fe232c2277814bb33d8fc9c7fd0e35eb8234ff03aa3d3189d1af61b4c
SSDEEP 96:oDR1/M4PqMa+uPT+fbLt1tMh4M2f+dqbpFT1AcP4c6bZoFT1ADm4D7ulJ+J+w8lg:KSmNpUMf9zuQmwBL4
TLSH
T18FD12BF1E5B59C73E63268CB9A199AD24CF8738FBD8C9A14220D471CA794833CC5D4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 308dde9c4b302a03d25d8c062d8e4b807be74dbd35c268f053d79cc3ccca6327
MD5 9f25226dcb67d854e22389c4cd49912c
SHA1 a2394fb63d04846be0760baf3fee4960f73f5275
SHA512 2f9cd5b0c3da094348d6ce94bdba23fa6923e45aeb6ea61a51d616c4cc63e5ea484ef0acc285e5b24e2a6415cb05b8a30d2337d3daa8648ba4028e38f5f3557e
SSDEEP 96:oDR1/M4PqMa+uPT+fbLt1tMh4M2f+dqbpFT1AcP4c6bZoFT1ADm4D7ulJ+J+w8lm:KSmNpUMf9zuQmwBLJc
TLSH
T136D11AF1E5B59C73E63268CB9A199AD24CF8739FBD8C9A14220D4B18A794833CC5D4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 9ef433a01215cb9c403e00139d880b521670a8981c57052eb5d1b1fb5bd91f73
MD5 548be39b48fdec94348c8b4076a4d2e7
SHA1 ccfce324d489001d3a40e766a87b14fd1150afba
SHA512 500acdb1a3db779e5ed13956587e9f19fa1673f24d325708dbc277a88d0994448cba6202f880c328e122d2af9c8e389fc7a915937134920d9090974861befff1
SSDEEP 96:oDR1/M4PqMa+uPT+fbLt1tMh4M2f+dqbpFT1AcP4c6bZoFT1ADm4D7ulJ+J+w8lI:KSmNpUMf9zuQmwBLJUJ
TLSH
T163D11AF1E5B59C73E63258CB9A29DAD24CF8739FBD8C9A14220D4B18A794833CC5D4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 c0deca7337de8d10f58e92ef64ebe55591d1c6b6954c947891e142851f8d49f3
MD5 240455ef1485bf53a054a852fd27b7dd
SHA1 446bb1bcfc4e74bdadafc63562a82a7b6f396dbb
SHA512 92e2b423aa186424431f639a4c0e04a485c713c029cf16b2ad32fa2e9ba7a38ab15835d5e2f8a7bf1e9a3c19195a4dbcb2119db19921ae82b25b925cbf79d071
SSDEEP 96:oDR1/M4PqMa+uPT+fbLt1tMh4M2f+dqbpFT1AcP4c6bZoFT1ADm4D7ulJ+J+w8ly:KSmNpUMf9zuQmwBLJUlmQ
TLSH
T1E2E119F1E5B59C73E63258CB9A29DAD24CF8739FBD8C9A10230D4A18A794833CC6D4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 8KB
SHA256 45332fc823627a9778137329a04993003b00cb56fd17f90605b5ebcfbae0cb55
MD5 834ab199263cc2b1c2e678997741de23
SHA1 c66329ae2ac723beceed95de3ba6dc7378512a7a
SHA512 5f97f00aa2f5914bc8307c9ce5bd1a4c9c8f95d00d937eaf29955a1b1ff5562e6d698bbcdf54ba26613ad2eb1d472780b24fa3ad6b31a5837f59f2fdc1018dc8
SSDEEP 96:oDR1/M4PqMa+uPT+fbLt1tMh4M2f+dqbpFT1AcP4c6bZoFT1ADm4D7ulJ+J+w8lt:KSmNpUMf9zuQmwBLJUlmBuzcm2
TLSH
T1E5020BF1E5B59C73E63258CB9A29DAD24CF8739FBD8C9A14230D8618A794833CC6D4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 3b197c8e964ed17907c27272bff7297300dc5b704e7bc301d2e55b8dac5be335
MD5 1f9591c60e587ff541a72ee2a980ce19
SHA1 a88829748a6ead0417c1ad7da1cefcaf993a9499
SHA512 82b9cbefe3211c101f29c6279021a19239112fea801545cc83888e0bff6beac6986132d33064e56a5ba8b7c6db3024bb4821fd5379f7d9c7fb34162b224bd5ba
SSDEEP 96:oDR1/M4PqMa+uPT+fbLt1tMh4M2f+dqbpFT1AcP4c6bZoFT1ADm4D7ulJ+J+w8ln:KSmNpUMf9zuQmwBLJUlmBuzcm/oj
TLSH
T143122AE1E5B59C73E63258CB9A29DAD14CFC739FBD8C9A14230D8A18A794833CC6D4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 8ac7ff6425f136da66ff1324c71b1008ef537e5477b6b783e36d2e00dfa7b85b
MD5 3cddd632a79a79a8592bdb6927cab97f
SHA1 bdebeff907b9a50ce87c6cb0fb594b2a68cbffc8
SHA512 bf91bf816fe5a77a15facfa30d2565514b276cb1d72c8a5695cf613a849922fd7bbc3cc894d6fa30a81d563ebdc822a2e02cde3486a6e30459c91159fa9cde50
SSDEEP 96:oDR1/M4PqMa+uPT+fbLt1tMh4M2f+dqbpFT1AcP4c6bZoFT1ADm4D7ulJ+J+w8l7:KSmNpUMf9zuQmwBLJUlmBuzcm/oEeAGj
TLSH
T19C2236E1E5B59C73E63258CB9A29DAD14CF8739FBD8C9A10630D8A18B794833CC6D4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 11KB
SHA256 1728139706fcd518f6aa730c585421522b47664a9aa56639aba4a441fdc97196
MD5 270c4110f0b0d475a265a83738c5972f
SHA1 4243c02781b9d9a8417be00508ef4a7a33e22571
SHA512 5e59676b7f78365646f894383ac8544684283d3b39f9d71e93df5697dfae529c97f7296ccf82d19c96b8a0d62b76d93b3f98a82542e6510cfc1b3a141a627389
SSDEEP 192:KSmNpUMf9zuQmwBLJUlmBuzcm/oEeAGbG4TQ:hmrUMNuQmmFUluuzcgoEeAGbI
TLSH
T14B3237E1E5B5DC73E63258C79A29DAD14CF8739FBD8C9A1423098A18B794833CC694D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 11KB
SHA256 00f37a4e978bd55ca6d3c18d4174a47a51da59cb80117aa4e0e5ea04b2130413
MD5 677180c9b6c0682efb9095a788e9c7b4
SHA1 0f2edf52cd702f0faf1c4d40a2d9a81669ed0a3a
SHA512 0b3b834bfa007b9fd38b5a96d133739ab76a4e8dd352174665676a990eae864e0371a340871feb1bdabe89110433b469152167b19d3d0c23649f67635fe517ec
SSDEEP 192:KSmNpUMf9zuQmwBLJUlmBuzcm/oEeAGbG4TlJ:hmrUMNuQmmFUluuzcgoEeAGb9J
TLSH
T11E4247E1E5B5DC73E63258C79A29DAD24CF8739FBD8C9A1423098A18B794833CC6D4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 11KB
SHA256 44a2123414de377a40567cafc24f7f364cfa47f78c417105a852aad9fca3db14
MD5 a5bd7f09b999b15a603dc9c9f7dfc5c1
SHA1 6e7f72a2bc0bdd0cd93f1ff646c0605dcc56e08a
SHA512 06b65222e27c3ff3e221b27c1e2d86f62168ef898cb81ed7db30e1aa77e94a703c81838d9e77820c68183c28d26efea173781b961111a65056b53cfcd97a7c53
SSDEEP 192:KSmNpUMf9zuQmwBLJUlmBuzcm/oEeAGbG4Tl2Q:hmrUMNuQmmFUluuzcgoEeAGb92Q
TLSH
T1334235E1F5B5DC73E63258CB9A29DAD14DF8739FBD8C9A1023098A18B794833CC694D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 09039f8e335f8482b3bb9d217b825e5d558609a32b54506f84bf719670b9bc9b
MD5 4e66328a080b16428285c17c19c2dde3
SHA1 8105dbaac08cf318fa019ed1935581da2e448e18
SHA512 4361a70cccbe8d99e009c1e3975d1650864105ee62f387143258518a9583e6ad75b5a5a79a6f28e733c589edaa6eb3905c016a3bd2d665d55d776dd35970df68
SSDEEP 192:KSmNpUMf9zuQmwBLJUlmBuzcm/oEeAGbG4Tl2TQ:hmrUMNuQmmFUluuzcgoEeAGb92TQ
TLSH
T1D14224E1F5B5DC73E63258CB9A29DAD149F8739FBD8C9A10230D8A18B794833CC694D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 ba20550aea420c1147ec8250aea9dff6f0bc0aceb6a56adf1ed2f69e10f2392a
MD5 4b5697a52d1c8b3d2e885f3ee8c778ab
SHA1 eb1099bc12884a580969f5c4e46813dcecf7ce65
SHA512 1efa5fa9657ddea4fa716dcc609567df05120dfeb55229bd56f0ea0f23315bd3041e3e21afd82afc1a2f1e62cd3f929c8779d731553088b9fbbc75f17fdc6063
SSDEEP 192:KSmNpUMf9zuQmwBLJUlmBuzcm/oEeAGbG4Tl2TBVj:hmrUMNuQmmFUluuzcgoEeAGb92TBVj
TLSH
T1F94224E1F5B5DC73E63258CB9A29DAD149F8739FBD8C9A10230D8A18B794833CC694D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 e3bd420166e1b959a727cce5c03f2e33fd24ddbff573a3909f2dfe8701759276
MD5 ca1c2ebddf80580f886e6b51401fb330
SHA1 89f6cdce9dd10cb9f9dfa248c30f6bc822ec9942
SHA512 2c167b40a82c570fdb11cf702f3059dd02bb2ced930e904a5fa31c0040aff94c6210f36eab23a9037566a064419d7c849bfa871d7c926398f66dac9f43cd5484
SSDEEP 192:KSmNpUMf9zuQmwBLJUlmBuzcm/oEeAGbG4Tl2TBVicr/RgK:hmrUMNuQmmFUluuzcgoEeAGb92TBVj
TLSH
T1A06228E1E5F5DC73E53258C79A29DAD248F8739FBD8C9A2023098A18B794C33CD694D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 20KB
SHA256 742173b0a3aa2744d7ff388ae22f07b9568eff497865d938157f062cc1ee1fdb
MD5 c5bf4b4b077b6f93c5348218d60b2116
SHA1 56248c87a0e6fc540ff950886172fbd22e91ce4b
SHA512 03d3667a34c111828f3839f1d3b03607623304e0dff61ec6d4c8e3fce755e3a713d91f7c679b33ffc62ae44d6b49b39032b4e6ca575f97d7ccaa347aacef0222
SSDEEP 384:hmrUMNuQmmFUluuzcgoEeAGb92TBVj1g1MRy1aJL5:hYzNuQJusuogoErGboT/1g1MRy1aJL5
TLSH
T1189228E1E5F5DC73E53268C79A29DAD24CF8739FBC8C9A14230D8618A764833CD694D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 20KB
SHA256 18462a7ef40f35b714b95b851da3f60c07b288a3735c91a4ca59e61afff06bc9
MD5 cc6c30e6ee79c8be4edc7853d745280f
SHA1 89a71b58358059043fdf203cc22593bc2379a1dd
SHA512 16a7e55d50723edf90797e6521cc6545f064100b61d5dfd3b99e4e3c7502836d117b7ddc908db7d8819f1fcaaab991da0a653429f0df95855401344525ebb55d
SSDEEP 384:hmrUMNuQmmFUluuzcgoEeAGb92TBVj1g1MRy1aB:hYzNuQJusuogoErGboT/1g1MRy1aB
TLSH
T1739218E1E5F5DC73E53268C79A29DAD24CF8739FBC8C9A14230D8618A7A4833CD694D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 feee179da57d5264376cdd79ab40286fb16e5a1d77a60a0d391d474d2c2ef401
MD5 e86a5f1cb21c283614b76f77c922d219
SHA1 4913ffd73e238fe6bfbb02a9c152a11ec52b452d
SHA512 4d784f6c82de45c00ee7842826b4ebbe1080c451572546db40255e10cf3db39eb143b8be305d15b1a4763bce158f291820a9264a78c2015ecf87b7871f365dfb
TLSH
T1F62159F1A5B48CB7E2322CC7A21A9DC14CF8735F79DC9A10B2094518A795C77DC6D4D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 c7387650fe630f0f5db898ec2bf4e6112dd7e68e281a0edd9e6cdcdfa690eb1a
MD5 61bf40edef790b13afdd1fb76a02ded4
SHA1 b08fbf8286323e5a747c2b3d61694421a1629d31
SHA512 8070c499868497510db6dcd93fcb654a0498bceb525b660000d52fc14b08e2e22fbccec206ffcd90f187a8b80a3aa8405525a57b78f0301b65eff82a7b50b7cb
TLSH
T1BD5137F1E4B48CB3E63268C7A61AD9D10CE8739F79CC9A1462094A18A795C73DC6D4E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 8d2216c972c922363173ca540ccd0dde642452695cc76723c2ddfe4fc49a0179
MD5 3f9eef86570821dd050cd85b8152dfb7
SHA1 661628c015f22ea29add180be4f37237c69a5de4
SHA512 ea63638714f407a52e1f224242ca72481c465587c7d75acc48d30585c2c26e7a43523a7439dfdd56ecd6564471448df2c01cf6eb985e8146e858395b1ddd40bd
TLSH
T1B86168F1E5B5DC73E23228CB961A8DD20CF8739FBD8C9A1462094A18A795C33DC6D4E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 03ffbc5e6b698642fe938fe80fdb6fd881fdbf49ae57f9296e74d8ad373823e1
MD5 3990791558b1573b490f51b42f7c81d7
SHA1 4d4a3c45c54523cbcfcfb0133dd3f53c3eb0f18e
SHA512 0e310b3f21f3ba2fa2eb756feccde638b46bcc50c2c2c37c36f04d8ff3f191cb21afdebf0b720246652d03b8bbd962cc92403bf7b2540f74d3cca6ca87890e23
TLSH
T15D618BF1A5B4CC73E23268CB961A8DD20CF8738FBD8C9A2462094A18A795C33DC6D4D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 157d84ec3f675192da6fc68dafe628b0e72982a6752a41897c72cd49f93ca55e
MD5 391c3affd8cf0a0bbeec5e5e3e9e8e5a
SHA1 d6b41955cadff811a9b49e889c643204151c27b0
SHA512 35b58d6de1d5ba403a7c1ae8aa36a9562e764c1b3876917125b864047603b863b901352e0d43de22da65a599fa18f11ff740c38c762499bdc52cd98a47eef461
TLSH
T1A48149F1E5B5DC73E63268CB961A89D24CF8738FBD8C9A1462094A1CA795C33CC6D4E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 787e8e16efb9c79eeee384287d130801dbdc6b906c5a622c7aca3325174d00d5
MD5 75eb0400e78ea50164714d69c4e91274
SHA1 5f0557c67f459b793c92bc09c984a9d9770100d1
SHA512 d642ad73242020235b4a371e8bed7088eeeae6c3d2064ad2e2625bcd164df832faf001a2802de61cbb6569f2782a8e09287b6e24e29310ad4d4280f4bc3109bc
SSDEEP 96:oDR1/M4PqMa+uPT+fbLt1tMh4M2f+dqbpFT1AcP4c6bZoFT1ADm4D7ulJ+N:KSmNpUMf9z6
TLSH
T1BB8147F1A4B59C73E23268CB96198AD20CF8738FBD8C9A1462094A1CA795C33CC6D4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/476-75-0x0000000000B50000-0x0000000000B72000-memory.dmp

Download

memory/476-250-0x0000000000B50000-0x0000000000B72000-memory.dmp

Download

memory/476-14-0x0000000000B50000-0x0000000000B72000-memory.dmp

Download

memory/1300-392-0x0000000000B60000-0x0000000000B82000-memory.dmp

Download

memory/1300-279-0x0000000000B60000-0x0000000000B82000-memory.dmp

Download

memory/1408-210-0x0000000000B20000-0x0000000000B42000-memory.dmp

Download

memory/1408-138-0x0000000000B20000-0x0000000000B42000-memory.dmp

Download

memory/1852-272-0x0000000000A70000-0x0000000000A92000-memory.dmp

Download

memory/1988-276-0x0000000000A70000-0x0000000000A92000-memory.dmp

Download

memory/2736-946-0x0000000000F70000-0x0000000000F92000-memory.dmp

Download

memory/2996-280-0x00000000004C0000-0x00000000004E2000-memory.dmp

Download

memory/2996-416-0x00000000004C0000-0x00000000004E2000-memory.dmp

Download

memory/3108-384-0x0000000000770000-0x0000000000792000-memory.dmp

Download

memory/3108-267-0x0000000000770000-0x0000000000792000-memory.dmp

Download

memory/3220-521-0x0000000000900000-0x0000000000922000-memory.dmp

Download

memory/3220-133-0x0000000000900000-0x0000000000922000-memory.dmp

Download

memory/3220-944-0x0000000000900000-0x0000000000922000-memory.dmp

Download

memory/3228-29-0x0000000000B50000-0x0000000000B72000-memory.dmp

Download

memory/3228-13-0x0000000000B50000-0x0000000000B72000-memory.dmp

Download

memory/3500-195-0x0000000000150000-0x0000000000172000-memory.dmp

Download

memory/3500-913-0x0000000000150000-0x0000000000172000-memory.dmp

Download

memory/3500-99-0x0000000000150000-0x0000000000172000-memory.dmp

Download

memory/4104-578-0x0000000000B60000-0x0000000000B82000-memory.dmp

Download

memory/4104-278-0x0000000000B60000-0x0000000000B82000-memory.dmp

Download

memory/4104-391-0x0000000000B60000-0x0000000000B82000-memory.dmp

Download

memory/4232-281-0x0000000000DF0000-0x0000000000E12000-memory.dmp

Download

memory/4236-265-0x0000000000A80000-0x0000000000AA2000-memory.dmp

Download

memory/4236-211-0x0000000000A80000-0x0000000000AA2000-memory.dmp

Download

memory/4260-282-0x0000000000DF0000-0x0000000000E12000-memory.dmp

Download

memory/4260-855-0x0000000000DF0000-0x0000000000E12000-memory.dmp

Download

memory/4260-419-0x0000000000DF0000-0x0000000000E12000-memory.dmp

Download

memory/4468-388-0x00000000004C0000-0x00000000004E2000-memory.dmp

Download

memory/4488-132-0x0000000000B20000-0x0000000000B42000-memory.dmp

Download

memory/4488-1253-0x0000000000B20000-0x0000000000B42000-memory.dmp

Download

memory/4488-520-0x0000000000B20000-0x0000000000B42000-memory.dmp

Download

memory/4504-98-0x0000000000150000-0x0000000000172000-memory.dmp

Download

memory/4504-171-0x0000000000150000-0x0000000000172000-memory.dmp

Download

memory/4644-96-0x0000000000BB0000-0x0000000000BD2000-memory.dmp

Download

memory/4644-31-0x0000000000BB0000-0x0000000000BD2000-memory.dmp

Download

memory/4796-97-0x0000000000BB0000-0x0000000000BD2000-memory.dmp

Download

memory/4796-32-0x0000000000BB0000-0x0000000000BD2000-memory.dmp

Download

memory/4796-496-0x0000000000BB0000-0x0000000000BD2000-memory.dmp

Download

memory/4940-74-0x0000000000AB0000-0x0000000000AD2000-memory.dmp

Download

memory/4940-519-0x0000000000AB0000-0x0000000000AD2000-memory.dmp

Download

memory/4940-207-0x0000000000AB0000-0x0000000000AD2000-memory.dmp

Download

memory/4940-12-0x0000000000AB0000-0x0000000000AD2000-memory.dmp

Download

memory/4940-0-0x0000000000AB0000-0x0000000000AD2000-memory.dmp

Download

memory/5000-889-0x0000000000F70000-0x0000000000F92000-memory.dmp

Download

memory/5000-1211-0x0000000000F70000-0x0000000000F92000-memory.dmp

Download

memory/5676-385-0x0000000000770000-0x0000000000792000-memory.dmp

Download

memory/5676-271-0x0000000000770000-0x0000000000792000-memory.dmp

Download

memory/5700-947-0x0000000000570000-0x0000000000592000-memory.dmp

Download

memory/5932-266-0x0000000000A80000-0x0000000000AA2000-memory.dmp

Download

memory/5932-212-0x0000000000A80000-0x0000000000AA2000-memory.dmp

Download

memory/5932-945-0x0000000000A80000-0x0000000000AA2000-memory.dmp

Download

memory/6092-922-0x0000000000440000-0x0000000000462000-memory.dmp

Download

memory/6872-948-0x0000000000440000-0x0000000000462000-memory.dmp

Download

memory/6904-949-0x0000000000F70000-0x0000000000F92000-memory.dmp

Download

memory/7084-887-0x0000000000A30000-0x0000000000A52000-memory.dmp

Download

memory/7084-1209-0x0000000000A30000-0x0000000000A52000-memory.dmp

Download

memory/7124-950-0x0000000000440000-0x0000000000462000-memory.dmp

Download

memory/7124-1089-0x0000000000440000-0x0000000000462000-memory.dmp

Download

memory/7160-1210-0x0000000000440000-0x0000000000462000-memory.dmp

Download

memory/7160-888-0x0000000000440000-0x0000000000462000-memory.dmp

Download