7c1e46323c34d6ff6ad346d019ada9f99d429f838826ed8a5742b6adbf17e166

Analysis

max time kernel
151s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_91194dcf6b6ce639d55f83eab79f5e54_elex_wannacry.exe
Size 64.1MB
Sample260720-dcdbhac15r
SHA256 7c1e46323c34d6ff6ad346d019ada9f99d429f838826ed8a5742b6adbf17e166
MD5 91194dcf6b6ce639d55f83eab79f5e54
SHA1 13e66503f256ce8713ce29dbe65b11bc660c6883
SHA512 63434fe4355da73ef6bdd3e47a02ef38a893812d1b03304ce10c2414caf6b6544151082775b9c7eb4a1f1c7bcf5b598ce3a2cde46b07ccbe277a4479c7731388
SSDEEP 196608:brrrrrrr5xrrrrrrr5xrrrrrrr5xrrrrrrr5xrrrrrrr5xrrrrrrr5Y:u
TLSH
T11CE73A1266EC116DF1F71B71EE39A266A97AFCFE7E02E51E0455740E20B2B10C929337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	2026-07-20_91194dcf6b6ce639d55f83eab79f5e54_elex_wannacry.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe

Executes dropped EXE 43 IoCs

pid	Process
4152	svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe
5360	svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe
2588	svchost_ACAACBCABBBCCCAAABCCCCACAAABCCAAACBCACABBAAAAABACACCCAB.exe
5916	svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe
876	svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe
4168	svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe
4876	svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe
4192	svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe
912	svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe
5780	svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe
2000	svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe
3424	svchost_BAACACBBBBCCAABBBBBCBACCCAAAAACCCCCCBCABBBCBBBBBCABBCCB.exe
2884	svchost_BAACACBBBBCCAABBBBBCBACCCAAAAACCCCCCBCABBBCBBBBBCABBCCB.exe
4688	svchost_ABBBBBCAACACBAAACBBCAAACABACCCCCBABAACACAABAACBCABBACAA.exe
4816	svchost_ABBBBBCAACACBAAACBBCAAACABACCCCCBABAACACAABAACBCABBACAA.exe
4452	svchost_CACBCBCACBAAACCBACBBCAACBCBBCCBAACCCBAACABACAABBAACBBAC.exe
1216	svchost_CACBCBCACBAAACCBACBBCAACBCBBCCBAACCCBAACABACAABBAACBBAC.exe
4316	svchost_ACCBCCCBACBACABCCABABBCBBBABBBACBACABCBCCACACCACCBBCBBC.exe
4640	svchost_ACCBCCCBACBACABCCABABBCBBBABBBACBACABCBCCACACCACCBBCBBC.exe
6100	svchost_ACCABCCBACCBCAABCACCCACCAAABCCCACCBCACBCAAACCACCCABBCAA.exe
3732	svchost_ACCABCCBACCBCAABCACCCACCAAABCCCACCBCACBCAAACCACCCABBCAA.exe
1932	svchost_AABCCCAABBACACACABBBCCCBBBBCBBBCBACBCCBABBCCCACBBCBCBCA.exe
3132	svchost_AABCCCAABBACACACABBBCCCBBBBCBBBCBACBCCBABBCCCACBBCBCBCA.exe
2708	svchost_ACABCCBABACBBCBBCBCBACCCBCACBBABACBBCBABACCAAAAABBAACAB.exe
5440	svchost_ACABCCBABACBBCBBCBCBACCCBCACBBABACBBCBABACCAAAAABBAACAB.exe
1184	svchost_CBCABABABBCBBBAAAACAABAAAAACABCABBAAAAABCBBBACBBCACCBAB.exe
5456	svchost_CBCABABABBCBBBAAAACAABAAAAACABCABBAAAAABCBBBACBBCACCBAB.exe
1020	svchost_AABAABCBACBABCCBBAACACCBAACAABCBCCBACBACAAACAACCBACCCBA.exe
2908	svchost_AABAABCBACBABCCBBAACACCBAACAABCBCCBACBACAAACAACCBACCCBA.exe
4948	svchost_BBCCBABBAACCBAABCABAACBCCBBACABCABBCCABABBCAAACCCCAAABA.exe
2624	svchost_BBCCBABBAACCBAABCABAACBCCBBACABCABBCCABABBCAAACCCCAAABA.exe
2984	svchost_CAABCCBACAACCCCCACABBBABBBABBCBBCBCACBBCBCCBCCAACACABAA.exe
3180	svchost_CAABCCBACAACCCCCACABBBABBBABBCBBCBCACBBCBCCBCCAACACABAA.exe
5648	svchost_CBACCBABCBBCBCBCCABBCABCABBABABCBABACBCACAACCBCCACCCCAB.exe
5404	svchost_CBACCBABCBBCBCBCCABBCABCABBABABCBABACBCACAACCBCCACCCCAB.exe
6328	svchost_AAABCBCCCBBABCACACBCBBBBAABBCAACBBAACCCBBBCACBBBBBACABC.exe
6332	svchost_AAABCBCCCBBABCACACBCBBBBAABBCAACBBAACCCBBBCACBBBBBACABC.exe
6588	svchost_AAAACAACCAABAACBCBBBBCCBBACBBCBCABBABABCBBAAAACACCCABBC.exe
6580	svchost_AAAACAACCAABAACBCBBBBCCBBACBBCBCABBABABCBBAAAACACCCABBC.exe
6988	svchost_AACABBAACBAAAACBAACCAAAABBCACBABBCCAAAAABCBCBABAACCBABC.exe
7020	svchost_AACABBAACBAAAACBAACCAAAABBCACBABBCCAAAAABCBCBABAACCBABC.exe
7080	svchost_BCACCCAACCABBABBACCCABAABACCACABCBAAABACCBCACABCCBBACBB.exe
7072	svchost_BCACCCAACCABBABBACCCABAABACCACABCBAAABACCBCACABCCBBACBB.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABACCCBCABCCBCBBBCBCCABAACAACCBBCBAABBCCCBCAABCCCCBBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBACCCBCABCABBACBAACACBBBBCCAACACAABCACCBCACAABCCBACBA.exe"	svchost_CBCABABABBCBBBAAAACAABAAAAACABCABBAAAAABCBBBACBBCACCBAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCACABAAABBACCABCCCACBCACACCABACBCAAAAACACCCBCCBABBBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAAACABACCBBBACBCBAAACCBCBCBCCBBCCCAABCCCCAABAAAAACBBB.exe"	svchost_BBCCBABBAACCBAABCABAACBCCBBACABCABBCCABABBCAAACCCCAAABA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABABBCCCCAACABACCCBABBAABBCBCCAACBBACCBBCCCAABBBABBABACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe"	2026-07-20_91194dcf6b6ce639d55f83eab79f5e54_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBBCCACCCCCABABBBCBAABCBCBAACACBCAAABBABABBCACCAAABABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe"	svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAABACBBCCCACBBBCCACABCBAABAABBBCABCBBCBBCBACCBCCBABCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBCCCBACBACABCCABABBCBBBABBBACBACABCBCCACACCACCBBCBBC.exe"	svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABBAAAAABBABCAAABBACACCBCBCACABCAABACBBBCBBAACCBCBABACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCABCCBACCBCAABCACCCACCAAABCCCACCBCACBCAAACCACCCABBCAA.exe"	svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABBACABCCCCACBCBBBCCACAAABCABCCBBAAABBCACCCCACCBBBBBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCABABABBCBBBAAAACAABAAAAACABCABBAAAAABCBBBACBBCACCBAB.exe"	svchost_BAACACBBBBCCAABBBBBCBACCCAAAAACCCCCCBCABBBCBBBBBCABBCCB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBBABCBCCBCCBCCBAAAACACCCAABCCBABCCBBBCCCBBBACCCABACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACCBABCBBCBCBCCABBCABCABBABABCBABACBCACAACCBCCACCCCAB.exe"	svchost_CACBCBCACBAAACCBACBBCAACBCBBCCBAACCCBAACABACAABBAACBBAC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAAABCABAACABABAAAAAABAACACCCABAAAABABABCBABBBCAACCCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCAABCABBBACAAACACBBCBBBBCACBACABAABBCCCAABBCBACCBBBBA.exe"	svchost_AABAABCBACBABCCBBAACACCBAACAABCBCCBACBACAAACAACCBACCCBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACABACCCBCACABCAAABABCCAAACCCAAACACBACACAACABACAAAACBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe"	svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBCCBAAAABCCCBCACBBABBCBACBACACBABCABACBAABBCCBABABAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACACBBBBCCAABBBBBCBACCCAAAAACCCCCCBCABBBCBBBBBCABBCCB.exe"	svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABBACCBCCCCBCBCCBCCBBABBCCAABBCCCBACBCBACACCAACAACCBBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABAABCBACBABCCBBAACACCBAACAABCBCCBACBACAAACAACCBACCCBA.exe"	svchost_ABBBBBCAACACBAAACBBCAAACABACCCCCBABAACACAABAACBCABBACAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCACABBAAACAACCABBCACAABBBBBBCBACCBACABACCBBACCAABAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABCBCCCBBABCACACBCBBBBAABBCAACBBAACCCBBBCACBBBBBACABC.exe"	svchost_ACABCCBABACBBCBBCBCBACCCBCACBBABACBBCBABACCAAAAABBAACAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAACCACABCABCBCCBCAABACCAABCCCAABBBBAAABABACCBBBCCCCCBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACABBAACBAAAACBAACCAAAABBCACBABBCCAAAAABCBCBABAACCBABC.exe"	svchost_ACCBCCCBACBACABCCABABBCBBBABBBACBACABCBCCACACCACCBBCBBC.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2384	sc.exe
5300	sc.exe
5848	sc.exe
4136	sc.exe
3540	sc.exe
3480	sc.exe
5032	sc.exe
2320	sc.exe
5296	sc.exe
6260	sc.exe
6844	sc.exe
8868	sc.exe
7016	sc.exe
3340	sc.exe
5856	sc.exe
8040	sc.exe
8640	sc.exe
7384	sc.exe
8760	sc.exe
3656	sc.exe
2608	sc.exe
7036	sc.exe
8392	sc.exe
4908	sc.exe
1428	sc.exe
4444	sc.exe
3100	sc.exe
5164	sc.exe
6616	sc.exe
1552	sc.exe
6804	sc.exe
6788	sc.exe
5020	sc.exe
7396	sc.exe
8728	sc.exe
7884	sc.exe
7812	sc.exe
1708	sc.exe
1428	sc.exe
8252	sc.exe
8184	sc.exe
5416	sc.exe
9396	sc.exe
2176	sc.exe
6276	sc.exe
7176	sc.exe
8972	sc.exe
3572	sc.exe
4076	sc.exe
2776	sc.exe
1948	sc.exe
8812	sc.exe
2504	sc.exe
1628	sc.exe
3560	sc.exe
6784	sc.exe
3452	sc.exe
1920	sc.exe
1688	sc.exe
4104	sc.exe
6996	sc.exe
3424	sc.exe
3560	sc.exe
5848	sc.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1200	cmd.exe
7316	cmd.exe
8500	cmd.exe
8668	cmd.exe
7472	cmd.exe
2420	cmd.exe
1656	cmd.exe
716	cmd.exe
9324	cmd.exe
2388	cmd.exe
4888	cmd.exe
2040	cmd.exe
6216	cmd.exe
1368	cmd.exe
6892	cmd.exe
3556	cmd.exe
6944	cmd.exe
5524	cmd.exe
9112	cmd.exe
9352	cmd.exe
5584	cmd.exe
4608	cmd.exe
4320	cmd.exe
7732	cmd.exe
8164	cmd.exe
3260	cmd.exe
6172	cmd.exe
9452	cmd.exe
6080	cmd.exe
5544	cmd.exe
6888	cmd.exe
8680	cmd.exe
4464	cmd.exe
6776	cmd.exe
7528	cmd.exe
1796	cmd.exe
7312	cmd.exe
7948	cmd.exe
6044	cmd.exe
2840	cmd.exe
1128	cmd.exe
3384	cmd.exe
4404	cmd.exe
4604	cmd.exe
2560	cmd.exe
5708	cmd.exe
7416	cmd.exe
8896	cmd.exe
1152	cmd.exe
4172	cmd.exe
4104	cmd.exe
6652	cmd.exe
6424	cmd.exe
8188	cmd.exe
4220	cmd.exe
2796	cmd.exe
6500	cmd.exe
1164	cmd.exe
7764	cmd.exe
2628	cmd.exe
6200	cmd.exe
4904	cmd.exe
5748	cmd.exe
7516	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACABBAACBAAAACBAACCAAAABBCACBABBCCAAAAABCBCBABAACCBABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCABABABBCBBBAAAACAABAAAAACABCABBAAAAABCBBBACBBCACCBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCBABBAACCBAABCABAACBCCBBACABCABBCCABABBCAAACCCCAAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACAACBCABBBCCCAAABCCCCACAAABCCAAACBCACABBAAAAABACACCCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 50 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
7716	schtasks.exe
4820	schtasks.exe
3876	schtasks.exe
5828	schtasks.exe
8576	schtasks.exe
7928	schtasks.exe
3408	schtasks.exe
6532	schtasks.exe
8924	schtasks.exe
5388	schtasks.exe
6092	schtasks.exe
6492	schtasks.exe
7160	schtasks.exe
8928	schtasks.exe
8964	schtasks.exe
6348	schtasks.exe
4576	schtasks.exe
976	schtasks.exe
6648	schtasks.exe
8820	schtasks.exe
9076	schtasks.exe
6060	schtasks.exe
2980	schtasks.exe
1580	schtasks.exe
6660	schtasks.exe
6680	schtasks.exe
6524	schtasks.exe
7472	schtasks.exe
7568	schtasks.exe
8120	schtasks.exe
7232	schtasks.exe
7744	schtasks.exe
8180	schtasks.exe
9192	schtasks.exe
5096	schtasks.exe
4992	schtasks.exe
1452	schtasks.exe
4112	schtasks.exe
8176	schtasks.exe
3552	schtasks.exe
700	schtasks.exe
3540	schtasks.exe
6312	schtasks.exe
4308	schtasks.exe
3732	schtasks.exe
1552	schtasks.exe
4728	schtasks.exe
628	schtasks.exe
6640	schtasks.exe
6420	schtasks.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
4120	2026-07-20_91194dcf6b6ce639d55f83eab79f5e54_elex_wannacry.exe
4120	2026-07-20_91194dcf6b6ce639d55f83eab79f5e54_elex_wannacry.exe
5360	svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe
4152	svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe
5360	svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe
4152	svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe
4120	2026-07-20_91194dcf6b6ce639d55f83eab79f5e54_elex_wannacry.exe
4120	2026-07-20_91194dcf6b6ce639d55f83eab79f5e54_elex_wannacry.exe
2588	svchost_ACAACBCABBBCCCAAABCCCCACAAABCCAAACBCACABBAAAAABACACCCAB.exe
2588	svchost_ACAACBCABBBCCCAAABCCCCACAAABCCAAACBCACABBAAAAABACACCCAB.exe
5916	svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe
5916	svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe
876	svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe
876	svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe
4152	svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe
4152	svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe
4168	svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe
4876	svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe
4876	svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe
4168	svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe
4192	svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe
4192	svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe
912	svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe
912	svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe
5780	svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe
5780	svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe
2000	svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe
2000	svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe
876	svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe
876	svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe
3424	svchost_BAACACBBBBCCAABBBBBCBACCCAAAAACCCCCCBCABBBCBBBBBCABBCCB.exe
3424	svchost_BAACACBBBBCCAABBBBBCBACCCAAAAACCCCCCBCABBBCBBBBBCABBCCB.exe
2884	svchost_BAACACBBBBCCAABBBBBCBACCCAAAAACCCCCCBCABBBCBBBBBCABBCCB.exe
2884	svchost_BAACACBBBBCCAABBBBBCBACCCAAAAACCCCCCBCABBBCBBBBBCABBCCB.exe
4688	svchost_ABBBBBCAACACBAAACBBCAAACABACCCCCBABAACACAABAACBCABBACAA.exe
4688	svchost_ABBBBBCAACACBAAACBBCAAACABACCCCCBABAACACAABAACBCABBACAA.exe
4816	svchost_ABBBBBCAACACBAAACBBCAAACABACCCCCBABAACACAABAACBCABBACAA.exe
4816	svchost_ABBBBBCAACACBAAACBBCAAACABACCCCCBABAACACAABAACBCABBACAA.exe
4452	svchost_CACBCBCACBAAACCBACBBCAACBCBBCCBAACCCBAACABACAABBAACBBAC.exe
4452	svchost_CACBCBCACBAAACCBACBBCAACBCBBCCBAACCCBAACABACAABBAACBBAC.exe
1216	svchost_CACBCBCACBAAACCBACBBCAACBCBBCCBAACCCBAACABACAABBAACBBAC.exe
1216	svchost_CACBCBCACBAAACCBACBBCAACBCBBCCBAACCCBAACABACAABBAACBBAC.exe
5440	svchost_ACABCCBABACBBCBBCBCBACCCBCACBBABACBBCBABACCAAAAABBAACAB.exe
5440	svchost_ACABCCBABACBBCBBCBCBACCCBCACBBABACBBCBABACCAAAAABBAACAB.exe
2708	svchost_ACABCCBABACBBCBBCBCBACCCBCACBBABACBBCBABACCAAAAABBAACAB.exe
2708	svchost_ACABCCBABACBBCBBCBCBACCCBCACBBABACBBCBABACCAAAAABBAACAB.exe
4316	svchost_ACCBCCCBACBACABCCABABBCBBBABBBACBACABCBCCACACCACCBBCBBC.exe
4316	svchost_ACCBCCCBACBACABCCABABBCBBBABBBACBACABCBCCACACCACCBBCBBC.exe
4640	svchost_ACCBCCCBACBACABCCABABBCBBBABBBACBACABCBCCACACCACCBBCBBC.exe
4640	svchost_ACCBCCCBACBACABCCABABBCBBBABBBACBACABCBCCACACCACCBBCBBC.exe
5456	svchost_CBCABABABBCBBBAAAACAABAAAAACABCABBAAAAABCBBBACBBCACCBAB.exe
1184	svchost_CBCABABABBCBBBAAAACAABAAAAACABCABBAAAAABCBBBACBBCACCBAB.exe
1184	svchost_CBCABABABBCBBBAAAACAABAAAAACABCABBAAAAABCBBBACBBCACCBAB.exe
5456	svchost_CBCABABABBCBBBAAAACAABAAAAACABCABBAAAAABCBBBACBBCACCBAB.exe
2908	svchost_AABAABCBACBABCCBBAACACCBAACAABCBCCBACBACAAACAACCBACCCBA.exe
2908	svchost_AABAABCBACBABCCBBAACACCBAACAABCBCCBACBACAAACAACCBACCCBA.exe
1020	svchost_AABAABCBACBABCCBBAACACCBAACAABCBCCBACBACAAACAACCBACCCBA.exe
1020	svchost_AABAABCBACBABCCBBAACACCBAACAABCBCCBACBACAAACAACCBACCCBA.exe
2624	svchost_BBCCBABBAACCBAABCABAACBCCBBACABCABBCCABABBCAAACCCCAAABA.exe
2624	svchost_BBCCBABBAACCBAABCABAACBCCBBACABCABBCCABABBCAAACCCCAAABA.exe
4948	svchost_BBCCBABBAACCBAABCABAACBCCBBACABCABBCCABABBCAAACCCCAAABA.exe
4948	svchost_BBCCBABBAACCBAABCABAACBCCBBACABCABBCCABABBCAAACCCCAAABA.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	4120	2026-07-20_91194dcf6b6ce639d55f83eab79f5e54_elex_wannacry.exe
Token: SeDebugPrivilege	5360	svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe
Token: SeDebugPrivilege	4152	svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe
Token: SeDebugPrivilege	2588	svchost_ACAACBCABBBCCCAAABCCCCACAAABCCAAACBCACABBAAAAABACACCCAB.exe
Token: SeDebugPrivilege	5916	svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe
Token: SeDebugPrivilege	876	svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe
Token: SeDebugPrivilege	4876	svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe
Token: SeDebugPrivilege	4168	svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe
Token: SeDebugPrivilege	4192	svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe
Token: SeDebugPrivilege	912	svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe
Token: SeDebugPrivilege	2000	svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe
Token: SeDebugPrivilege	5780	svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe
Token: SeDebugPrivilege	3424	svchost_BAACACBBBBCCAABBBBBCBACCCAAAAACCCCCCBCABBBCBBBBBCABBCCB.exe
Token: SeDebugPrivilege	2884	svchost_BAACACBBBBCCAABBBBBCBACCCAAAAACCCCCCBCABBBCBBBBBCABBCCB.exe
Token: SeDebugPrivilege	4688	svchost_ABBBBBCAACACBAAACBBCAAACABACCCCCBABAACACAABAACBCABBACAA.exe
Token: SeDebugPrivilege	4816	svchost_ABBBBBCAACACBAAACBBCAAACABACCCCCBABAACACAABAACBCABBACAA.exe
Token: SeDebugPrivilege	4452	svchost_CACBCBCACBAAACCBACBBCAACBCBBCCBAACCCBAACABACAABBAACBBAC.exe
Token: SeDebugPrivilege	1216	svchost_CACBCBCACBAAACCBACBBCAACBCBBCCBAACCCBAACABACAABBAACBBAC.exe
Token: SeDebugPrivilege	5440	svchost_ACABCCBABACBBCBBCBCBACCCBCACBBABACBBCBABACCAAAAABBAACAB.exe
Token: SeDebugPrivilege	2708	svchost_ACABCCBABACBBCBBCBCBACCCBCACBBABACBBCBABACCAAAAABBAACAB.exe
Token: SeDebugPrivilege	4316	svchost_ACCBCCCBACBACABCCABABBCBBBABBBACBACABCBCCACACCACCBBCBBC.exe
Token: SeDebugPrivilege	4640	svchost_ACCBCCCBACBACABCCABABBCBBBABBBACBACABCBCCACACCACCBBCBBC.exe
Token: SeDebugPrivilege	1184	svchost_CBCABABABBCBBBAAAACAABAAAAACABCABBAAAAABCBBBACBBCACCBAB.exe
Token: SeDebugPrivilege	5456	svchost_CBCABABABBCBBBAAAACAABAAAAACABCABBAAAAABCBBBACBBCACCBAB.exe
Token: SeDebugPrivilege	2908	svchost_AABAABCBACBABCCBBAACACCBAACAABCBCCBACBACAAACAACCBACCCBA.exe
Token: SeDebugPrivilege	1020	svchost_AABAABCBACBABCCBBAACACCBAACAABCBCCBACBACAAACAACCBACCCBA.exe
Token: SeDebugPrivilege	4948	svchost_BBCCBABBAACCBAABCABAACBCCBBACABCABBCCABABBCAAACCCCAAABA.exe
Token: SeDebugPrivilege	2624	svchost_BBCCBABBAACCBAABCABAACBCCBBACABCABBCCABABBCAAACCCCAAABA.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 5420	4120	2026-07-20_91194dcf6b6ce639d55f83eab79f5e54_elex_wannacry.exe	89
PID 5420 wrote to memory of 4820	5420	cmd.exe	91
PID 4120 wrote to memory of 4956	4120	2026-07-20_91194dcf6b6ce639d55f83eab79f5e54_elex_wannacry.exe	92
PID 4956 wrote to memory of 3340	4956	cmd.exe	94
PID 4120 wrote to memory of 5584	4120	2026-07-20_91194dcf6b6ce639d55f83eab79f5e54_elex_wannacry.exe	95
PID 5584 wrote to memory of 1708	5584	cmd.exe	98
PID 4152 wrote to memory of 3372	4152	svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe	102
PID 5360 wrote to memory of 6044	5360	svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe	104
PID 6044 wrote to memory of 3876	6044	cmd.exe	106
PID 3372 wrote to memory of 700	3372	cmd.exe	107
PID 5360 wrote to memory of 3384	5360	svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe	108
PID 4152 wrote to memory of 2696	4152	svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe	110
PID 3384 wrote to memory of 5300	3384	cmd.exe	111
PID 5360 wrote to memory of 4660	5360	svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe	113
PID 2696 wrote to memory of 4444	2696	cmd.exe	115
PID 4660 wrote to memory of 2504	4660	cmd.exe	116
PID 4152 wrote to memory of 952	4152	svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe	117
PID 952 wrote to memory of 3572	952	cmd.exe	119
PID 2588 wrote to memory of 4404	2588	svchost_ACAACBCABBBCCCAAABCCCCACAAABCCAAACBCACABBAAAAABACACCCAB.exe	125
PID 4404 wrote to memory of 5096	4404	cmd.exe	127
PID 2588 wrote to memory of 4608	2588	svchost_ACAACBCABBBCCCAAABCCCCACAAABCCAAACBCACABBAAAAABACACCCAB.exe	128
PID 4608 wrote to memory of 3424	4608	cmd.exe	130
PID 2588 wrote to memory of 4604	2588	svchost_ACAACBCABBBCCCAAABCCCCACAAABCCAAACBCACABBAAAAABACACCCAB.exe	131
PID 4604 wrote to memory of 3656	4604	cmd.exe	133
PID 5916 wrote to memory of 1768	5916	svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe	137
PID 876 wrote to memory of 4532	876	svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe	139
PID 1768 wrote to memory of 4576	1768	cmd.exe	141
PID 4532 wrote to memory of 4308	4532	cmd.exe	142
PID 5916 wrote to memory of 3556	5916	svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe	143
PID 3556 wrote to memory of 3452	3556	cmd.exe	145
PID 876 wrote to memory of 4820	876	svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe	146
PID 5916 wrote to memory of 4320	5916	svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe	148
PID 4320 wrote to memory of 4376	4320	cmd.exe	150
PID 4820 wrote to memory of 5256	4820	cmd.exe	151
PID 876 wrote to memory of 1656	876	svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe	154
PID 1656 wrote to memory of 5848	1656	cmd.exe	156
PID 4168 wrote to memory of 5564	4168	svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe	161
PID 4876 wrote to memory of 2308	4876	svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe	164
PID 5564 wrote to memory of 6060	5564	cmd.exe	166
PID 2308 wrote to memory of 5388	2308	cmd.exe	167
PID 4876 wrote to memory of 2448	4876	svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe	168
PID 4168 wrote to memory of 2388	4168	svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe	169
PID 2448 wrote to memory of 3480	2448	cmd.exe	172
PID 2388 wrote to memory of 1552	2388	cmd.exe	173
PID 4168 wrote to memory of 4904	4168	svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe	174
PID 4876 wrote to memory of 5748	4876	svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe	177
PID 4904 wrote to memory of 4136	4904	cmd.exe	179
PID 5748 wrote to memory of 5856	5748	cmd.exe	180
PID 4192 wrote to memory of 2560	4192	svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe	185
PID 2560 wrote to memory of 4992	2560	cmd.exe	187
PID 4192 wrote to memory of 1152	4192	svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe	188
PID 912 wrote to memory of 4888	912	svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe	190
PID 1152 wrote to memory of 5032	1152	cmd.exe	192
PID 4192 wrote to memory of 3340	4192	svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe	193
PID 4888 wrote to memory of 3732	4888	cmd.exe	195
PID 3340 wrote to memory of 1920	3340	cmd.exe	196
PID 912 wrote to memory of 5168	912	svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe	197
PID 5168 wrote to memory of 4076	5168	cmd.exe	199
PID 912 wrote to memory of 3688	912	svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe	202
PID 3688 wrote to memory of 2776	3688	cmd.exe	205
PID 2000 wrote to memory of 6080	2000	svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe	207
PID 5780 wrote to memory of 1708	5780	svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe	209
PID 6080 wrote to memory of 3540	6080	cmd.exe	214
PID 1708 wrote to memory of 1552	1708	cmd.exe	215

C:\Users\Admin\AppData\Local\Temp\2026-07-20_91194dcf6b6ce639d55f83eab79f5e54_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_91194dcf6b6ce639d55f83eab79f5e54_elex_wannacry.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABBCCCCAACABACCCBABBAABBCBCCAACBBACCBBCCCAABBBABBABACBBBCBBBCABABCCAACBCABCACABACAACCAACCBABCBACBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABBCCCCAACABACCCBABBAABBCBCCAACBBACCBBCCCAABBBABBABACBBBCBBBCABABCCAACBCABCACABACAACCAACCBABCBACBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCCCBCBCACBACAAAABACBBCBCACBCCBBAACCAAAABBABCBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe" start= auto displayName= "UserDataSvc_CCBCCCBCBCACBACAAAABACBBCBCACBCCBBAACCAAAABBABCBACB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBCCCBCBCACBACAAAABACBBCBCACBCCBBAACCAAAABBABCBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe" start= auto displayName= "UserDataSvc_CCBCCCBCBCACBACAAAABACBBCBCACBCCBBAACCAAAABBABCBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCCCBCBCACBACAAAABACBBCBCACBCCBBAACCAAAABBABCBACB"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5584
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBCCCBCBCACBACAAAABACBBCBCACBCCBBAACCAAAABBABCBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABCACBACCBBCCCCAACAAABAABACBCBCACCBAACBACCAACBBCABCCCCBAACBCABCCBCCBCBCAACBACBACBCBCBACABBBACAAACABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBCABBBCCCAAABCCCCACAAABCCAAACBCACABBAAAAABACACCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6044
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABCACBACCBBCCCCAACAAABAABACBCBCACCBAACBACCAACBBCABCCCCBAACBCABCCBCCBCBCAACBACBACBCBCBACABBBACAAACABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBCABBBCCCAAABCCCCACAAABCCAAACBCACABBAAAAABACACCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCAABBCBCAAAABBCBACBABBCCCACBABABCCCBCBBABBABBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBCABBBCCCAAABCCCCACAAABCCAAACBCACABBAAAAABACACCCAB.exe" start= auto displayName= "UserDataSvc_ACBCAABBCBCAAAABBCBACBABBCCCACBABABCCCBCBBABBABBBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCAABBCBCAAAABBCBACBABBCCCACBABABCCCBCBBABBABBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBCABBBCCCAAABCCCCACAAABCCAAACBCACABBAAAAABACACCCAB.exe" start= auto displayName= "UserDataSvc_ACBCAABBCBCAAAABBCBACBABBCCCACBABABCCCBCBBABBABBBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCAABBCBCAAAABBCBACBABBCCCACBABABCCCBCBBABBABBBBB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCAABBCBCAAAABBCBACBABBCCCACBABABCCCBCBBABBABBBBB"
    3⤵
    - Launches sc.exe
    PID:2504

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACBCCBAAACBBACBCAACAACACBCACBCBCACCAACBCBCABCAACCBAA.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCCACCCCCABABBBCBAABCBCBAACACBCAAABBABABBCACCAAABABAABABCBCCBCCCCBBABCCBCBBACCCBCACBAACCAABCBBAAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCCACCCCCABABBBCBAABCBCBAACACBCAAABBABABBCACCAAABABAABABCBCCBCCCCBBABCCBCBBACCCBCACBAACCAABCBBAAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCAAAACBACAAAACCCBCBCBCCABABABBABCBABBBCAACCCACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe" start= auto displayName= "UserDataSvc_CABCAAAACBACAAAACCCBCBCBCCABABABBABCBABBBCAACCCACAC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCAAAACBACAAAACCCBCBCBCCABABABBABCBABBBCAACCCACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe" start= auto displayName= "UserDataSvc_CABCAAAACBACAAAACCCBCBCBCCABABABBABCBABBBCAACCCACAC"
    3⤵
    - Launches sc.exe
    PID:4444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCAAAACBACAAAACCCBCBCBCCABABABBABCBABBBCAACCCACAC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCAAAACBACAAAACCCBCBCBCCABABABBABCBABBBCAACCCACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3572

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBCABBBCCCAAABCCCCACAAABCCAAACBCACABBAAAAABACACCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBCABBBCCCAAABCCCCACAAABCCAAACBCACABBAAAAABACACCCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCBBBBABCBCBCACBAACCAABBAABAABAACCAACCACCBBACAABBCBCBABAAABAABACACACBCBCCABCCCBBBAABCACCBBAABBBBBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCBBBBABCBCBCACBAACCAABBAABAABAACCAACCACCBBACAABBCBCBABAAABAABACACACBCBCCABCCCBBBAABCACCBBAABBBBBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCAAABACCCBBBBCCBBABACACCAABAACABCABCBACBBCBCCAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe" start= auto displayName= "UserDataSvc_ACCAAABACCCBBBBCCBBABACACCAABAACABCABCBACBBCBCCAABC"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCAAABACCCBBBBCCBBABACACCAABAACABCABCBACBBCBCCAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe" start= auto displayName= "UserDataSvc_ACCAAABACCCBBBBCCBBABACACCAABAACABCABCBACBBCBCCAABC"
    3⤵
    - Launches sc.exe
    PID:3424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCAAABACCCBBBBCCBBABACACCAABAACABCABCBACBBCBCCAABC"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCAAABACCCBBBBCCBBABACACCAABAACABCABCBACBBCBCCAABC"
    3⤵
    - Launches sc.exe
    PID:3656

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCCACBBBACBBCBBBCACAACACBAACCAAABBCCABBCAAABAAAABABBCCCACCACACABBCCAAAAACAACABCACCBBCBCABBBBCABBAABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCCACBBBACBBCBBBCACAACACBAACCAAABBCCABBCAAABAAAABABBCCCACCACACABBCCAAAAACAACABCACCBBCBCABBBBCABBAABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBBCBACCAABCBCBACABABBCCACAACCBACACCCCAABABABAACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe" start= auto displayName= "UserDataSvc_BBBBCBACCAABCBCBACABABBCCACAACCBACACCCCAABABABAACCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBBCBACCAABCBCBACABABBCCACAACCBACACCCCAABABABAACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe" start= auto displayName= "UserDataSvc_BBBBCBACCAABCBCBACABABBCCACAACCBACACCCCAABABABAACCA"
    3⤵
    - Launches sc.exe
    PID:3452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBBCBACCAABCBCBACABABBCCACAACCBACACCCCAABABABAACCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBBCBACCAABCBCBACABABBCCACAACCBACACCCCAABABABAACCA"
    3⤵
    PID:4376

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAABCCBACAACCCACCAABBACBAAAABCACBCAAACCAABCACBBABCAB.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBCBCABCBACBBCBBACACAAABACACCCBAAAABACCABCABCACCACCAACCCAABACACACBBBBCACBBABCCCAAABAACCBCCCBCBAAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBCBCABCBACBBCBBACACAAABACACCCBAAAABACCABCABCACCACCAACCCAABACACACBBBBCACBBABCCCAAABAACCBCCCBCBAAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBBCCCCCCBCCCCBCABCBAABABBBBCACACBACBCBCCAABCCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe" start= auto displayName= "UserDataSvc_CABBBCCCCCCBCCCCBCABCBAABABBBBCACACBACBCBCCAABCCBCB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABBBCCCCCCBCCCCBCABCBAABABBBBCACACBACBCBCCAABCCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe" start= auto displayName= "UserDataSvc_CABBBCCCCCCBCCCCBCABCBAABABBBBCACACBACBCBCCAABCCBCB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBBCCCCCCBCCCCBCABCBAABABBBBCACACBACBCBCCAABCCBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABBBCCCCCCBCCCCBCABCBAABABBBBCACACBACBCBCCAABCCBCB"
    3⤵
    - Launches sc.exe
    PID:5848

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAACABAABAACBAACCBCBBBBBCAABCABCBABCABBABACCCCCCAAACCCBBACABCBBBBBCBCAABACBACCCBBABCBAABABAACCABBACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCAACACBAAACBBCAAACABACCCCCBABAACACAABAACBCABBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAACABAABAACBAACCBCBBBBBCAABCABCBABCABBABACCCCCCAAACCCBBACABCBBBBBCBCAABACBACCCBBABCBAABABAACCABBACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCAACACBAAACBBCAAACABACCCCCBABAACACAABAACBCABBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBBAABACAABBCBACCBBCCCAACABACBABCBACBCBBACCBACABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCAACACBAAACBBCAAACABACCCCCBABAACACAABAACBCABBACAA.exe" start= auto displayName= "UserDataSvc_BACBBAABACAABBCBACCBBCCCAACABACBABCBACBCBBACCBACABC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBBAABACAABBCBACCBBCCCAACABACBABCBACBCBBACCBACABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCAACACBAAACBBCAAACABACCCCCBABAACACAABAACBCABBACAA.exe" start= auto displayName= "UserDataSvc_BACBBAABACAABBCBACCBBCCCAACABACBABCBACBCBBACCBACABC"
    3⤵
    - Launches sc.exe
    PID:3480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBBAABACAABBCBACCBBCCCAACABACBABCBACBCBBACCBACABC"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5748
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBBAABACAABBCBACCBBCCCAACABACBABCBACBCBBACCBACABC"
    3⤵
    - Launches sc.exe
    PID:5856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACBABCACBBCACCAAABACCCABCCCACCCCBBCABAAACCCBCBBCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBCCBAAAABCCCBCACBBABBCBACBACACBABCABACBAABBCCBABABAACAABAACCCCBACCABCBBAACBABACACCBBBCCACBCBBABBAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACACBBBBCCAABBBBBCBACCCAAAAACCCCCCBCABBBCBBBBBCABBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBCCBAAAABCCCBCACBBABBCBACBACACBABCABACBAABBCCBABABAACAABAACCCCBACCABCBBAACBABACACCBBBCCACBCBBABBAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACACBBBBCCAABBBBBCBACCCAAAAACCCCCCBCABBBCBBBBBCABBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBCBABCCCBCBCACBCBABBCBCCABACABBACBBBCBACBCACCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACACBBBBCCAABBBBBCBACCCAAAAACCCCCCBCABBBCBBBBBCABBCCB.exe" start= auto displayName= "UserDataSvc_ABCBCBABCCCBCBCACBCBABBCBCCABACABBACBBBCBACBCACCBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBCBABCCCBCBCACBCBABBCBCCABACABBACBBBCBACBCACCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACACBBBBCCAABBBBBCBACCCAAAAACCCCCCBCABBBCBBBBBCABBCCB.exe" start= auto displayName= "UserDataSvc_ABCBCBABCCCBCBCACBCBABBCBCCABACABBACBBBCBACBCACCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBCBABCCCBCBCACBCBABBCBCCABACABBACBBBCBACBCACCBBC"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBCBABCCCBCBCACBCBABBCBCCABACABBACBBBCBACBCACCBBC"
    3⤵
    - Launches sc.exe
    PID:4136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBACABBBCCCCBACBCABABBABBABBBCCACAAACAACAAACABBCBCBAABCBCCABBCAACACABCCBAAABAACAAABAACCABABCACCBCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBCACBAAACCBACBBCAACBCBBCCBAACCCBAACABACAABBAACBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBACABBBCCCCBACBCABABBABBABBBCCACAAACAACAAACABBCBCBAABCBCCABBCAACACABCCBAAABAACAAABAACCABABCACCBCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBCACBAAACCBACBBCAACBCBBCCBAACCCBAACABACAABBAACBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACABAABACABCBCABAAACCBBBCAAACCABCABACAABCBBABCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBCACBAAACCBACBBCAACBCBBCCBAACCCBAACABACAABBAACBBAC.exe" start= auto displayName= "UserDataSvc_BBACABAABACABCBCABAAACCBBBCAAACCABCABACAABCBBABCCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACABAABACABCBCABAAACCBBBCAAACCABCABACAABCBBABCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBCACBAAACCBACBBCAACBCBBCCBAACCCBAACABACAABBAACBBAC.exe" start= auto displayName= "UserDataSvc_BBACABAABACABCBCABAAACCBBBCAAACCABCABACAABCBBABCCBB"
    3⤵
    - Launches sc.exe
    PID:5032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACABAABACABCBCABAAACCBBBCAAACCABCABACAABCBBABCCBB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBACABAABACABCBCABAAACCBBBCAAACCABCABACAABCBBABCCBB"
    3⤵
    - Launches sc.exe
    PID:1920

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCCCCBBABBACCBCBCCAAACCCBBABAACACABACABBBCACACCBCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAABACBBCCCACBBBCCACABCBAABAABBBCABCBBCBBCBACCBCCBABCCAAACBACCABACBABBAABBABCAABBACACCBBCACCABABBAABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCCBACBACABCCABABBCBBBABBBACBACABCBCCACACCACCBBCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAABACBBCCCACBBBCCACABCBAABAABBBCABCBBCBBCBACCBCCBABCCAAACBACCABACBABBAABBABCAABBACACCBBCACCABABBAABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCCBACBACABCCABABBCBBBABBBACBACABCBCCACACCACCBBCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCBCBBCCCBAACCBAACCCBAABACAACCCCABCBCCBBAABBBBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCCBACBACABCCABABBCBBBABBBACBACABCBCCACACCACCBBCBBC.exe" start= auto displayName= "UserDataSvc_BBBCBCBBCCCBAACCBAACCCBAABACAACCCCABCBCCBBAABBBBCCB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5168
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCBCBBCCCBAACCBAACCCBAABACAACCCCABCBCCBBAABBBBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCCBACBACABCCABABBCBBBABBBACBACABCBCCACACCACCBBCBBC.exe" start= auto displayName= "UserDataSvc_BBBCBCBBCCCBAACCBAACCCBAABACAACCCCABCBCCBBAABBBBCCB"
    3⤵
    - Launches sc.exe
    PID:4076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCBCBBCCCBAACCBAACCCBAABACAACCCCABCBCCBBAABBBBCCB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCBCBBCCCBAACCBAACCCBAABACAACCCCABCBCCBBAABBBBCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCACBCAACACACABABAAABCBCCCACCCCCCCCCAACABAABBBAABBCABCCCBCBCBACACBBAACACCBBBBBBCAAABAABBAACBCCBBABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCAABBACACACABBBCCCBBBBCBBBCBACBCCBABBCCCACBBCBCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCACBCAACACACABABAAABCBCCCACCCCCCCCCAACABAABBBAABBCABCCCBCBCBACACBBAACACCBBBBBBCAAABAABBAACBCCBBABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCAABBACACACABBBCCCBBBBCBBBCBACBCCBABBCCCACBBCBCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBAAACBBBCCAABBABCBCABACAACCBAAACCBCCABBBCBCAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCAABBACACACABBBCCCBBBBCBBBCBACBCCBABBCCCACBBCBCBCA.exe" start= auto displayName= "UserDataSvc_AABBAAACBBBCCAABBABCBCABACAACCBAAACCBCCABBBCBCAACBB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5980
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBAAACBBBCCAABBABCBCABACAACCBAAACCBCCABBBCBCAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCAABBACACACABBBCCCBBBBCBBBCBACBCCBABBCCCACBBCBCBCA.exe" start= auto displayName= "UserDataSvc_AABBAAACBBBCCAABBABCBCABACAACCBAAACCBCCABBBCBCAACBB"
    3⤵
    - Launches sc.exe
    PID:3560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBAAACBBBCCAABBABCBCABACAACCBAAACCBCCABBBCBCAACBB"
  2⤵
  - Executes a command shell one-liner
  PID:4220
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBAAACBBBCCAABBABCBCABACAACCBAAACCBCCABBBCBCAACBB"
    3⤵
    PID:4592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABCCABAAAABABCCCAABACCBACBCCCBCBCCABAABBAAACAABCACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBAAAAABBABCAAABBACACCBCBCACABCAABACBBBCBBAACCBCBABACAACBCBCAAAAABBBCCCCCCBBAABCBACBBBBBCCBBBBAABAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCBACCBCAABCACCCACCAAABCCCACCBCACBCAAACCACCCABBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBAAAAABBABCAAABBACACCBCBCACABCAABACBBBCBBAACCBCBABACAACBCBCAAAAABBBCCCCCCBBAABCBACBBBBBCCBBBBAABAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCBACCBCAABCACCCACCAAABCCCACCBCACBCAAACCACCCABBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBCCCABCACCCCAABABACABACAACABCCCAACBBCACBACCCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCBACCBCAABCACCCACCAAABCCCACCBCACBCAAACCACCCABBCAA.exe" start= auto displayName= "UserDataSvc_ACCBCCCABCACCCCAABABACABACAACABCCCAACBBCACBACCCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4172
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBCCCABCACCCCAABABACABACAACABCCCAACBBCACBACCCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCBACCBCAABCACCCACCAAABCCCACCBCACBCAAACCACCCABBCAA.exe" start= auto displayName= "UserDataSvc_ACCBCCCABCACCCCAABABACABACAACABCCCAACBBCACBACCCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBCCCABCACCCCAABABACABACAACABCCCAACBBCACBACCCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5544
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBCCCABCACCCCAABABACABACAACABCCCAACBBCACBACCCABAC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3860

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACACBBBBCCAABBBBBCBACCCAAAAACCCCCCBCABBBCBBBBBCABBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACACBBBBCCAABBBBBCBACCCAAAAACCCCCCBCABBBCBBBBBCABBCCB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACAAAAABABABCACBACABABAACACAABABAACCCBCCBCACACBAACAABBCBBCCCCACBBBCCAABCCACCACBBCAABACCCAAAAACAACCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCBABACBBCBBCBCBACCCBCACBBABACBBCBABACCAAAAABBAACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACAAAAABABABCACBACABABAACACAABABAACCCBCCBCACACBAACAABBCBBCCCCACBBBCCAABCCACCACBBCAABACCCAAAAACAACCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCBABACBBCBBCBCBACCCBCACBBABACBBCBABACCAAAAABBAACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBBAABBCCACAAACBBBABBABCBAABABBBBBCBBCCCABBACACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCBABACBBCBBCBCBACCCBCACBBABACBBCBABACCAAAAABBAACAB.exe" start= auto displayName= "UserDataSvc_AABBBAABBCCACAAACBBBABBABCBAABABBBBBCBBCCCABBACACAB"
  2⤵
  PID:3308
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBBAABBCCACAAACBBBABBABCBAABABBBBBCBBCCCABBACACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCBABACBBCBBCBCBACCCBCACBBABACBBCBABACCAAAAABBAACAB.exe" start= auto displayName= "UserDataSvc_AABBBAABBCCACAAACBBBABBABCBAABABBBBBCBBCCCABBACACAB"
    3⤵
    - Launches sc.exe
    PID:1628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBBAABBCCACAAACBBBABBABCBAABABBBBBCBBCCCABBACACAB"
  2⤵
  PID:4964
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBBAABBCCACAAACBBBABBABCBAABABBBBBCBBCCCABBACACAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2320

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACACBBBBCCAABBBBBCBACCCAAAAACCCCCCBCABBBCBBBBBCABBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACACBBBBCCAABBBBBCBACCCAAAAACCCCCCBCABBBCBBBBBCABBCCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBACABCCCCACBCBBBCCACAAABCABCCBBAAABBCACCCCACCBBBBBABCBBCACBACCCBCAACAABBCBCACBBBBBACCBBABABBCCABABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABABABBCBBBAAAACAABAAAAACABCABBAAAAABCBBBACBBCACCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBACABCCCCACBCBBBCCACAAABCABCCBBAAABBCACCCCACCBBBBBABCBBCACBACCCBCAACAABBCBCACBBBBBACCBBABABBCCABABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABABABBCBBBAAAACAABAAAAACABCABBAAAAABCBBBACBBCACCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCACCBABACCABCBCABACAAACACBCAABABCBACBBBBBAACABAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABABABBCBBBAAAACAABAAAAACABCABBAAAAABCBBBACBBCACCBAB.exe" start= auto displayName= "UserDataSvc_BBCACCBABACCABCBCABACAAACACBCAABABCBACBBBBBAACABAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2796
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCACCBABACCABCBCABACAAACACBCAABABCBACBBBBBAACABAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABABABBCBBBAAAACAABAAAAACABCABBAAAAABCBBBACBBCACCBAB.exe" start= auto displayName= "UserDataSvc_BBCACCBABACCABCBCABACAAACACBCAABABCBACBBBBBAACABAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCACCBABACCABCBCABACAAACACBCAABABCBACBBBBBAACABAAB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3176
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCACCBABACCABCBCABACAAACACBCAABABCBACBBBBBAACABAAB"
    3⤵
    PID:5060

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCAACACBAAACBBCAAACABACCCCCBABAACACAABAACBCABBACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCAACACBAAACBBCAAACABACCCCCBABAACACAABAACBCABBACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBACCBCCCCBCBCCBCCBBABBCCAABBCCCBACBCBACACCAACAACCBBCBABBAABBACCCBBABBAAACACCBCCCCAABBBAAACCCCCCCACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCBACBABCCBBAACACCBAACAABCBCCBACBACAAACAACCBACCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBACCBCCCCBCBCCBCCBBABBCCAABBCCCBACBCBACACCAACAACCBBCBABBAABBACCCBBABBAAACACCBCCCCAABBBAAACCCCCCCACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCBACBABCCBBAACACCBAACAABCBCCBACBACAAACAACCBACCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABCBCCABBCBCBBBCAACBBACAACACCCCCBBBCBCAACCCBBBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCBACBABCCBBAACACCBAACAABCBCCBACBACAAACAACCBACCCBA.exe" start= auto displayName= "UserDataSvc_CAABCBCCABBCBCBBBCAACBBACAACACCCCCBBBCBCAACCCBBBBBC"
  2⤵
  - Executes a command shell one-liner
  PID:2040
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABCBCCABBCBCBBBCAACBBACAACACCCCCBBBCBCAACCCBBBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCBACBABCCBBAACACCBAACAABCBCCBACBACAAACAACCBACCCBA.exe" start= auto displayName= "UserDataSvc_CAABCBCCABBCBCBBBCAACBBACAACACCCCCBBBCBCAACCCBBBBBC"
    3⤵
    - Launches sc.exe
    PID:5296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABCBCCABBCBCBBBCAACBBACAACACCCCCBBBCBCAACCCBBBBBC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4748
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABCBCCABBCBCBBBCAACBBACAACACCCCCBBBCBCAACCCBBBBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3560

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCAACACBAAACBBCAAACABACCCCCBABAACACAABAACBCABBACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCAACACBAAACBBCAAACABACCCCCBABAACACAABAACBCABBACAA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCABAACBBAAACABCBAABAABAABACBCBAABBCAAACABBCABBBBBCBAABBBACBABBABBAAAABABAACCBBBBBAABACCBBCACCBBBACCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBABBAACCBAABCABAACBCCBBACABCABBCCABABBCAAACCCCAAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCABAACBBAAACABCBAABAABAABACBCBAABBCAAACABBCABBBBBCBAABBBACBABBABBAAAABABAACCBBBBBAABACCBBCACCBBBACCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBABBAACCBAABCABAACBCCBBACABCABBCCABABBCAAACCCCAAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABBBCACACAACCBCBCAABABCCABCACCCBBABAAABABABBBCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBABBAACCBAABCABAACBCCBBACABCABBCCABABBCAAACCCCAAABA.exe" start= auto displayName= "UserDataSvc_ACABBBCACACAACCBCBCAABABCCABCACCCBBABAAABABABBBCCAC"
  2⤵
  - Executes a command shell one-liner
  PID:2840
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABBBCACACAACCBCBCAABABCCABCACCCBBABAAABABABBBCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBABBAACCBAABCABAACBCCBBACABCABBCCABABBCAAACCCCAAABA.exe" start= auto displayName= "UserDataSvc_ACABBBCACACAACCBCBCAABABCCABCACCCBBABAAABABABBBCCAC"
    3⤵
    - Launches sc.exe
    PID:5020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABBBCACACAACCBCBCAABABCCABCACCCBBABAAABABABBBCCAC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5960
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABBBCACACAACCBCBCAABABCCABCACCCBBABAAABABABBBCCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBCACBAAACCBACBBCAACBCBBCCBAACCCBAACABACAABBAACBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBCACBAAACCBACBBCAACBCBBCCBAACCCBAACABACAABBAACBBAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBCAACAACABABBCBCCCCBABCBBCCBACCBCACCAAABACCAABABAACCCABCACBCCCACBBCCAABCCCABAAACBCBBABBBCAACAAACBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBACAACCCCCACABBBABBBABBCBBCBCACBBCBCCBCCAACACABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBCAACAACABABBCBCCCCBABCBBCCBACCBCACCAAABACCAABABAACCCABCACBCCCACBBCCAABCCCABAAACBCBBABBBCAACAAACBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBACAACCCCCACABBBABBBABBCBBCBCACBBCBCCBCCAACACABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCBCACBBCCAAAABCCCBBBACBCCACACABCBCACACAABACBBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBACAACCCCCACABBBABBBABBCBBCBCACBBCBCCBCCAACACABAA.exe" start= auto displayName= "UserDataSvc_CABCBCACBBCCAAAABCCCBBBACBCCACACABCBCACACAABACBBCBA"
  2⤵
  - Executes a command shell one-liner
  PID:4464
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCBCACBBCCAAAABCCCBBBACBCCACACABCBCACACAABACBBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBACAACCCCCACABBBABBBABBCBBCBCACBBCBCCBCCAACACABAA.exe" start= auto displayName= "UserDataSvc_CABCBCACBBCCAAAABCCCBBBACBCCACACABCBCACACAABACBBCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCBCACBBCCAAAABCCCBBBACBCCACACABCBCACACAABACBBCBA"
  2⤵
  - Executes a command shell one-liner
  PID:1200
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCBCACBBCCAAAABCCCBBBACBCCACACABCBCACACAABACBBCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3540

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBCACBAAACCBACBBCAACBCBBCCBAACCCBAACABACAABBAACBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBCACBAAACCBACBBCAACBCBBCCBAACCCBAACABACAABBAACBBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBBABCBCCBCCBCCBAAAACACCCAABCCBABCCBBBCCCBBBACCCABACBABCABACCAABACCAACABCBACAAAAACCAAAACACCBACCBBBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABCBBCBCBCCABBCABCABBABABCBABACBCACAACCBCCACCCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBBABCBCCBCCBCCBAAAACACCCAABCCBABCCBBBCCCBBBACCCABACBABCABACCAABACCAACABCBACAAAAACCAAAACACCBACCBBBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABCBBCBCBCCABBCABCABBABABCBABACBCACAACCBCCACCCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAAAABBAACAACBCBCCCBABAABAABBCCCBACABBAABCCBAACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABCBBCBCBCCABBCABCABBABABCBABACBCACAACCBCCACCCCAB.exe" start= auto displayName= "UserDataSvc_CCAAAABBAACAACBCBCCCBABAABAABBCCCBACABBAABCCBAACACC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5316
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAAAABBAACAACBCBCCCBABAABAABBCCCBACABBAABCCBAACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABCBBCBCBCCABBCABCABBABABCBABACBCACAACCBCCACCCCAB.exe" start= auto displayName= "UserDataSvc_CCAAAABBAACAACBCBCCCBABAABAABBCCCBACABBAABCCBAACACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAAAABBAACAACBCBCCCBABAABAABBCCCBACABBAABCCBAACACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1128
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCAAAABBAACAACBCBCCCBABAABAABBCCCBACABBAABCCBAACACC"
    3⤵
    - Launches sc.exe
    PID:3100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCCBACBACABCCABABBCBBBABBBACBACABCBCCACACCACCBBCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCCBACBACABCCABABBCBBBABBBACBACABCBCCACACCACCBBCBBC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCACABCABCBCCBCAABACCAABCCCAABBBBAAABABACCBBBCCCCCBBCCABBAACBACBBABCCAACCACBACCCACBACBACAACCBAAACCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCAACCABBABBACCCABAABACCACABCBAAABACCBCACABCCBBACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCACABCABCBCCBCAABACCAABCCCAABBBBAAABABACCBBBCCCCCBBCCABBAACBACBBABCCAACCACBACCCACBACBACAACCBAAACCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCAACCABBABBACCCABAABACCACABCBAAABACCBCACABCCBBACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBBACCACBBBACCCCCACBCBBCCBBACBAABCBACACBCAACBCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCAACCABBABBACCCABAABACCACABCBAAABACCBCACABCCBBACBB.exe" start= auto displayName= "UserDataSvc_BCCBBACCACBBBACCCCCACBCBBCCBBACBAABCBACACBCAACBCAAA"
  2⤵
  PID:6684
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBBACCACBBBACCCCCACBCBBCCBBACBAABCBACACBCAACBCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCAACCABBABBACCCABAABACCACABCBAAABACCBCACABCCBBACBB.exe" start= auto displayName= "UserDataSvc_BCCBBACCACBBBACCCCCACBCBBCCBBACBAABCBACACBCAACBCAAA"
    3⤵
    - Launches sc.exe
    PID:6804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBBACCACBBBACCCCCACBCBBCCBBACBAABCBACACBCAACBCAAA"
  2⤵
  - Executes a command shell one-liner
  PID:6944
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBBACCACBBBACCCCCACBCBBCCBBACBAABCBACACBCAACBCAAA"
    3⤵
    - Launches sc.exe
    PID:7036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCCBACBACABCCABABBCBBBABBBACBACABCBCCACACCACCBBCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCCBACBACABCCABABBCBBBABBBACBACABCBCCACACCACCBBCBBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCACABCABCBCCBCAABACCAABCCCAABBBBAAABABACCBBBCCCCCBBCCABBAACBACBBABCCAACCACBACCCACBACBACAACCBAAACCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABBAACBAAAACBAACCAAAABBCACBABBCCAAAAABCBCBABAACCBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCACABCABCBCCBCAABACCAABCCCAABBBBAAABABACCBBBCCCCCBBCCABBAACBACBBABCCAACCACBACCCACBACBACAACCBAAACCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABBAACBAAAACBAACCAAAABBCACBABBCCAAAAABCBCBABAACCBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCCCBABBABCBACCACBAAABCBABCBBCAABBAABCCCCCBCCCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABBAACBAAAACBAACCAAAABBCACBABBCCAAAAABCBCBABAACCBABC.exe" start= auto displayName= "UserDataSvc_AABCCCBABBABCBACCACBAAABCBABCBBCAABBAABCCCCCBCCCACB"
  2⤵
  PID:6704
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCCCBABBABCBACCACBAAABCBABCBBCAABBAABCCCCCBCCCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABBAACBAAAACBAACCAAAABBCACBABBCCAAAAABCBCBABAACCBABC.exe" start= auto displayName= "UserDataSvc_AABCCCBABBABCBACCACBAAABCBABCBBCAABBAABCCCCCBCCCACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCCCBABBABCBACCACBAAABCBABCBBCAABBAABCCCCCBCCCACB"
  2⤵
  - Executes a command shell one-liner
  PID:6888
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCCCBABBABCBACCACBAAABCBABCBBCAABBAABCCCCCBCCCACB"
    3⤵
    - Launches sc.exe
    PID:6996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCBACCBCAABCACCCACCAAABCCCACCBCACBCAAACCACCCABBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCBACCBCAABCACCCACCAAABCCCACCBCACBCAAACCACCCABBCAA.exe
1⤵
- Executes dropped EXE
PID:6100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCBCBAACBCCCCBBBAABBBBACCABCBBCBAACACCCBAABAACABAABACAAAABACBABACBBBCBBBBCAABABBCCCACCBACCAACBBCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCCCAABBBACCCCCCBCCBAAACCCACBCCCCCAABAAACAACBACCAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:7316
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCBCBAACBCCCCBBBAABBBBACCABCBBCBAACACCCBAABAACABAABACAAAABACBABACBBBCBBBBCAABABBCCCACCBACCAACBBCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCCCAABBBACCCCCCBCCBAAACCCACBCCCCCAABAAACAACBACCAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCACCBCBABACCBBCACBAACCBBACAAAABACBBACCACBBCBBAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCCCAABBBACCCCCCBCCBAAACCCACBCCCCCAABAAACAACBACCAABC.exe" start= auto displayName= "UserDataSvc_ABCACCBCBABACCBBCACBAACCBBACAAAABACBBACCACBBCBBAAAC"
  2⤵
  - Executes a command shell one-liner
  PID:7732
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCACCBCBABACCBBCACBAACCBBACAAAABACBBACCACBBCBBAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCCCAABBBACCCCCCBCCBAAACCCACBCCCCCAABAAACAACBACCAABC.exe" start= auto displayName= "UserDataSvc_ABCACCBCBABACCBBCACBAACCBBACAAAABACBBACCACBBCBBAAAC"
    3⤵
    PID:8772

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCBACCBCAABCACCCACCAAABCCCACCBCACBCAAACCACCCABBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCBACCBCAABCACCCACCAAABCCCACCBCACBCAAACCACCCABBCAA.exe
1⤵
- Executes dropped EXE
PID:3732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABCAABBAABBCAAACCCBCABBCCAAAACBCBBCABCBABBBBCBBBBBAACAACABBCCCBCBCCBCCBCCBCCCABCBCBCABCBAABCBBCCBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCAAAACCCCBCAACABBCCAAABBCAABCACBBCBACCBACBACBBBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABCAABBAABBCAAACCCBCABBCCAAAACBCBBCABCBABBBBCBBBBBAACAACABBCCCBCBCCBCCBCCBCCCABCBCBCABCBAABCBBCCBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCAAAACCCCBCAACABBCCAAABBCAABCACBBCBACCBACBACBBBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBBCBBBCBBABBCCCBCABAABCACCAABBACCABBBBCBCCAAACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCAAAACCCCBCAACABBCCAAABBCAABCACBBCBACCBACBACBBBAAB.exe" start= auto displayName= "UserDataSvc_ACBBCBBBCBBABBCCCBCABAABCACCAABBACCABBBBCBCCAAACCAA"
  2⤵
  - Executes a command shell one-liner
  PID:8500
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBBCBBBCBBABBCCCBCABAABCACCAABBACCABBBBCBCCAAACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCAAAACCCCBCAACABBCCAAABBCAABCACBBCBACCBACBACBBBAAB.exe" start= auto displayName= "UserDataSvc_ACBBCBBBCBBABBCCCBCABAABCACCAABBACCABBBBCBCCAAACCAA"
    3⤵
    - Launches sc.exe
    PID:8184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBBCBBBCBBABBCCCBCABAABCACCAABBACCABBBBCBCCAAACCAA"
  2⤵
  PID:8824
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBBCBBBCBBABBCCCBCABAABCACCAABBACCABBBBCBCCAAACCAA"
    3⤵
    - Launches sc.exe
    PID:8868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCAABBACACACABBBCCCBBBBCBBBCBACBCCBABBCCCACBBCBCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCAABBACACACABBBCCCBBBBCBBBCBACBCCBABBCCCACBBCBCBCA.exe
1⤵
- Executes dropped EXE
PID:3132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCBCCCABBBCABABBBBBABABBBABCCBABBBBBABBBCBBAAABCBCAABAABACBBCCBABBAACACACBCABBBAAABCAAACAABBBBACABABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAACACBCCCAACBBCCAABBABBBACABCBAABCABABABBAAACACABCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:1796
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCBCCCABBBCABABBBBBABABBBABCCBABBBBBABBBCBBAAABCBCAABAABACBBCCBABBAACACACBCABBBAAABCAAACAABBBBACABABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAACACBCCCAACBBCCAABBABBBACABCBAABCABABABBAAACACABCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACCCBBBBBCBABCBCCBBCABACBACBBBBBCACCBABABCBCABCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAACACBCCCAACBBCCAABBABBBACABCBAABCABABABBAAACACABCCB.exe" start= auto displayName= "UserDataSvc_CBACCCBBBBBCBABCBCCBBCABACBACBBBBBCACCBABABCBCABCAC"
  2⤵
  - Executes a command shell one-liner
  PID:7472
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACCCBBBBBCBABCBCCBBCABACBACBBBBBCACCBABABCBCABCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAACACBCCCAACBBCCAABBABBBACABCBAABCABABABBAAACACABCCB.exe" start= auto displayName= "UserDataSvc_CBACCCBBBBBCBABCBCCBBCABACBACBBBBBCACCBABABCBCABCAC"
    3⤵
    - Launches sc.exe
    PID:6844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACCCBBBBBCBABCBCCBBCABACBACBBBBBCACCBABABCBCABCAC"
  2⤵
  - Executes a command shell one-liner
  PID:8164
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACCCBBBBBCBABCBCCBBCABACBACBBBBBCACCBABABCBCABCAC"
    3⤵
    - Launches sc.exe
    PID:7016

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCAABBACACACABBBCCCBBBBCBBBCBACBCCBABBCCCACBBCBCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCAABBACACACABBBCCCBBBBCBBBCBACBCCBABBCCCACBBCBCBCA.exe
1⤵
- Executes dropped EXE
PID:1932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCCACCCCCACCBAAACABCBAACBBCCACCBCCBABCCCBCCBACCCACCCBCAABBACABBBBAABCCAAACABCCCCABBACACABBABBCCCBACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCBAACABBBCAACBAAACBBCAACBBCCCCBCACACBCCACCBCACCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCCACCCCCACCBAAACABCBAACBBCCACCBCCBABCCCBCCBACCCACCCBCAABBACABBBBAABCCAAACABCCCCABBACACABBABBCCCBACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCBAACABBBCAACBAAACBBCAACBBCCCCBCACACBCCACCBCACCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8820

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCBABACBBCBBCBCBACCCBCACBBABACBBCBABACCAAAAABBAACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCBABACBBCBBCBCBACCCBCACBBABACBBCBABACCAAAAABBAACAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACCABABBCCBAACBACACCABCCBBCCAABBBBBBBBBACCAABCBCCCCBBBCABCBCCACCBABABBAABABCAABCCBCBABABBABBACBAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACAACCAABAACBCBBBBCCBBACBBCBCABBABABCBBAAAACACCCABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5272
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACCABABBCCBAACBACACCABCCBBCCAABBBBBBBBBACCAABCBCCCCBBBCABCBCCACCBABABBAABABCAABCCBCBABABBABBACBAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACAACCAABAACBCBBBBCCBBACBBCBCABBABABCBBAAAACACCCABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCBBBCACCAABBBBCCACCCBBBCCBAACAACBBBCBCABCCBBBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACAACCAABAACBCBBBBCCBBACBBCBCABBABABCBBAAAACACCCABBC.exe" start= auto displayName= "UserDataSvc_CBCCBBBCACCAABBBBCCACCCBBBCCBAACAACBBBCBCABCCBBBACB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4444
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCBBBCACCAABBBBCCACCCBBBCCBAACAACBBBCBCABCCBBBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACAACCAABAACBCBBBBCCBBACBBCBCABBABABCBBAAAACACCCABBC.exe" start= auto displayName= "UserDataSvc_CBCCBBBCACCAABBBBCCACCCBBBCCBAACAACBBBCBCABCCBBBACB"
    3⤵
    - Launches sc.exe
    PID:5164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCBBBCACCAABBBBCCACCCBBBCCBAACAACBBBCBCABCCBBBACB"
  2⤵
  - Executes a command shell one-liner
  PID:6216
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCCBBBCACCAABBBBCCACCCBBBCCBAACAACBBBCBCABCCBBBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCBABACBBCBBCBCBACCCBCACBBABACBBCBABACCAAAAABBAACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCBABACBBCBBCBCBACCCBCACBBABACBBCBABACCAAAAABBAACAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCACABBAAACAACCABBCACAABBBBBBCBACCBACABACCBBACCAABAAAAACCCBBCCCBAACBCCCAACACCCCAAAABCCCAAABCCBCCABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBCCCBBABCACACBCBBBBAABBCAACBBAACCCBBBCACBBBBBACABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5308
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCACABBAAACAACCABBCACAABBBBBBCBACCBACABACCBBACCAABAAAAACCCBBCCCBAACBCCCAACACCCCAAAABCCCAAABCCBCCABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBCCCBBABCACACBCBBBBAABBCAACBBAACCCBBBCACBBBBBACABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCBCAACAACACBABCACBABABCAACACCCBBACACABACCBCBACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBCCCBBABCACACBCBBBBAABBCAACBBAACCCBBBCACBBBBBACABC.exe" start= auto displayName= "UserDataSvc_CCCCBCAACAACACBABCACBABABCAACACCCBBACACABACCBCBACBC"
  2⤵
  - Executes a command shell one-liner
  PID:5708
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCBCAACAACACBABCACBABABCAACACCCBBACACABACCBCBACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBCCCBBABCACACBCBBBBAABBCAACBBAACCCBBBCACBBBBBACABC.exe" start= auto displayName= "UserDataSvc_CCCCBCAACAACACBABCACBABABCAACACCCBBACACABACCBCBACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCBCAACAACACBABCACBABABCAACACCCBBACACABACCBCBACBC"
  2⤵
  PID:6164
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCBCAACAACACBABCACBABABCAACACCCBBACACABACCBCBACBC"
    3⤵
    - Launches sc.exe
    PID:6260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABABABBCBBBAAAACAABAAAAACABCABBAAAAABCBBBACBBCACCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABABABBCBBBAAAACAABAAAAACABCABBAAAAABCBBBACBBCACCBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACBABABCCAAABAACAACAACCAAABBAACBCAACABBAAAACBCCCAAACCBCBBCACABABAAABBCCBABABABBAAABBBCBCBBBACBBBCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCCBCABCCBCBBBCBCCABAACAACCBBCBAABBCCCBCAABCCCCBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:4104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACBABABCCAAABAACAACAACCAAABBAACBCAACABBAAAACBCCCAAACCBCBBCACABABAAABBCCBABABABBAAABBBCBCBBBACBBBCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCCBCABCCBCBBBCBCCABAACAACCBBCBAABBCCCBCAABCCCCBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBACBBBCCBAAACAABCBACCCAABBABBACCAABBBBBCBBBACCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCCBCABCCBCBBBCBCCABAACAACCBBCBAABBCCCBCAABCCCCBBAB.exe" start= auto displayName= "UserDataSvc_BACBACBBBCCBAAACAABCBACCCAABBABBACCAABBBBBCBBBACCCC"
  2⤵
  PID:6176
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBACBBBCCBAAACAABCBACCCAABBABBACCAABBBBBCBBBACCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCCBCABCCBCBBBCBCCABAACAACCBBCBAABBCCCBCAABCCCCBBAB.exe" start= auto displayName= "UserDataSvc_BACBACBBBCCBAAACAABCBACCCAABBABBACCAABBBBBCBBBACCCC"
    3⤵
    - Launches sc.exe
    PID:7176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBACBBBCCBAAACAABCBACCCAABBABBACCAABBBBBCBBBACCCC"
  2⤵
  PID:8156
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBACBBBCCBAAACAABCBACCCAABBABBACCAABBBBBCBBBACCCC"
    3⤵
    - Launches sc.exe
    PID:8392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABABABBCBBBAAAACAABAAAAACABCABBAAAAABCBBBACBBCACCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABABABBCBBBAAAACAABAAAAACABCABBAAAAABCBBBACBBCACCBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACCCBCABCCBCBBBCBCCABAACAACCBBCBAABBCCCBCAABCCCCBBABAABBCBCBABCAAACBCBCBBBCBBCACACCBCCCBABCABBBACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBCABCABBACBAACACBBBBCCAACACAABCACCBCACAABCCBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACCCBCABCCBCBBBCBCCABAACAACCBBCBAABBCCCBCAABCCCCBBABAABBCBCBABCAAACBCBCBBBCBBCACACCBCCCBABCABBBACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBCABCABBACBAACACBBBBCCAACACAABCACCBCACAABCCBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACAABCCABCCACABBBCBACACAAABACBCACBCACBCBABBABBBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBCABCABBACBAACACBBBBCCAACACAABCACCBCACAABCCBACBA.exe" start= auto displayName= "UserDataSvc_BACAABCCABCCACABBBCBACACAAABACBCACBCACBCBABBABBBBBC"
  2⤵
  PID:6660
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACAABCCABCCACABBBCBACACAAABACBCACBCACBCBABBABBBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBCABCABBACBAACACBBBBCCAACACAABCACCBCACAABCCBACBA.exe" start= auto displayName= "UserDataSvc_BACAABCCABCCACABBBCBACACAAABACBCACBCACBCBABBABBBBBC"
    3⤵
    PID:6420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACAABCCABCCACABBBCBACACAAABACBCACBCACBCBABBABBBBBC"
  2⤵
  - Executes a command shell one-liner
  PID:7416
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACAABCCABCCACABBBCBACACAAABACBCACBCACBCBABBABBBBBC"
    3⤵
    PID:7520

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCBACBABCCBBAACACCBAACAABCBCCBACBACAAACAACCBACCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCBACBABCCBBAACACCBAACAABCBCCBACBACAAACAACCBACCCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAAABCABAACABABAAAAAABAACACCCABAAAABABABCBABBBCAACCCCBCCBCAAACBCACACCACCCBACACCCBBACAABBBABCACCCCCAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABCABBBACAAACACBBCBBBBCACBACABAABBCCCAABBCBACCBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAAABCABAACABABAAAAAABAACACCCABAAAABABABCBABBBCAACCCCBCCBCAAACBCACACCACCCBACACCCBBACAABBBABCACCCCCAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABCABBBACAAACACBBCBBBBCACBACABAABBCCCAABBCBACCBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCACBCBCBBCABBCCBAABCACACCAACBBABABABBACBACCACCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABCABBBACAAACACBBCBBBBCACBACABAABBCCCAABBCBACCBBBBA.exe" start= auto displayName= "UserDataSvc_CBCACBCBCBBCABBCCBAABCACACCAACBBABABABBACBACCACCCAB"
  2⤵
  PID:6712
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCACBCBCBBCABBCCBAABCACACCAACBBABABABBACBACCACCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABCABBBACAAACACBBCBBBBCACBACABAABBCCCAABBCBACCBBBBA.exe" start= auto displayName= "UserDataSvc_CBCACBCBCBBCABBCCBAABCACACCAACBBABABABBACBACCACCCAB"
    3⤵
    - Launches sc.exe
    PID:7396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCACBCBCBBCABBCCBAABCACACCAACBBABABABBACBACCACCCAB"
  2⤵
  - Executes a command shell one-liner
  PID:7516
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCACBCBCBBCABBCCBAABCACACCAACBBABABABBACBACCACCCAB"
    3⤵
    - Launches sc.exe
    PID:8640

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCBACBABCCBBAACACCBAACAABCBCCBACBACAAACAACCBACCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCBACBABCCBBAACACCBAACAABCBCCBACBACAAACAACCBACCCBA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBABCBAACABBCBCBACBACABBABCAABBAACAACBCCCBBBCBACAABCCCAABBBABAAABABCBBBCBCABCBCABBCAABBCCABCCCAAABACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCCACBAACACCCCAAAACBBBACBBCAAAACACACBCCAAAABAAABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBABCBAACABBCBCBACBACABBABCAABBAACAACBCCCBBBCBACAABCCCAABBBABAAABABCBBBCBCABCBCABBCAABBCCABCCCAAABACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCCACBAACACCCCAAAACBBBACBBCAAAACACACBCCAAAABAAABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBACCBACBAAAAACCCCBBACAABAABCBAACCBBBBBCABCABBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCCACBAACACCCCAAAACBBBACBBCAAAACACACBCCAAAABAAABAA.exe" start= auto displayName= "UserDataSvc_ABCBACCBACBAAAAACCCCBBACAABAABCBAACCBBBBBCABCABBCBA"
  2⤵
  - Executes a command shell one-liner
  PID:6776
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBACCBACBAAAAACCCCBBACAABAABCBAACCBBBBBCABCABBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCCACBAACACCCCAAAACBBBACBBCAAAACACACBCCAAAABAAABAA.exe" start= auto displayName= "UserDataSvc_ABCBACCBACBAAAAACCCCBBACAABAABCBAACCBBBBBCABCABBCBA"
    3⤵
    - Launches sc.exe
    PID:8040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBACCBACBAAAAACCCCBBACAABAABCBAACCBBBBBCABCABBCBA"
  2⤵
  - Executes a command shell one-liner
  PID:8188
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBACCBACBAAAAACCCCBBACAABAABCBAACCBBBBBCABCABBCBA"
    3⤵
    - Launches sc.exe
    PID:8812

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBABBAACCBAABCABAACBCCBBACABCABBCCABABBCAAACCCCAAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBABBAACCBAABCABAACBCCBBACABCABBCCABABBCAAACCCCAAABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABBCABCACABCCACACAAAAABCCCCACABBACAAABABAAABCCACABCABCAAACBCBABCABCCABACACBACABBCBBCAAACBCCAABCBCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACABACCBBBACBCBAAACCBCBCBCCBBCCCAABCCCCAABAAAAACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:6424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABBCABCACABCCACACAAAAABCCCCACABBACAAABABAAABCCACABCABCAAACBCBABCABCCABACACBACABBCBBCAAACBCCAABCBCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACABACCBBBACBCBAAACCBCBCBCCBBCCCAABCCCCAABAAAAACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAAABABBBACAABBBAAACCBCAACAACACCABBBCABBCBACBCCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACABACCBBBACBCBAAACCBCBCBCCBBCCCAABCCCCAABAAAAACBBB.exe" start= auto displayName= "UserDataSvc_ABAAABABBBACAABBBAAACCBCAACAACACCABBBCABBCBACBCCCBC"
  2⤵
  - Executes a command shell one-liner
  PID:1164
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAAABABBBACAABBBAAACCBCAACAACACCABBBCABBCBACBCCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACABACCBBBACBCBAAACCBCBCBCCBBCCCAABCCCCAABAAAAACBBB.exe" start= auto displayName= "UserDataSvc_ABAAABABBBACAABBBAAACCBCAACAACACCABBBCABBCBACBCCCBC"
    3⤵
    PID:7888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAAABABBBACAABBBAAACCBCAACAACACCABBBCABBCBACBCCCBC"
  2⤵
  PID:7352
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAAABABBBACAABBBAAACCBCAACAACACCABBBCABBCBACBCCCBC"
    3⤵
    - Launches sc.exe
    PID:8972

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBABBAACCBAABCABAACBCCBBACABCABBCCABABBCAAACCCCAAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBABBAACCBAABCABAACBCCBBACABCABBCCABABBCAAACCCCAAABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACABAAABBACCABCCCACBCACACCABACBCAAAAACACCCBCCBABBBCBCACCBBCBCABACABBBABCAABCCBBAAAAABBBBABCACCABCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACABACCBBBACBCBAAACCBCBCBCCBBCCCAABCCCCAABAAAAACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:6652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACABAAABBACCABCCCACBCACACCABACBCAAAAACACCCBCCBABBBCBCACCBBCBCABACABBBABCAABCCBBAAAAABBBBABCACCABCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACABACCBBBACBCBAAACCBCBCBCCBBCCCAABCCCCAABAAAAACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBAABBBCBACCABCACCBCCAAACBCBABACCABBCBCBBBCABCACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACABACCBBBACBCBAAACCBCBCBCCBBCCCAABCCCCAABAAAAACBBB.exe" start= auto displayName= "UserDataSvc_ACBAABBBCBACCABCACCBCCAAACBCBABACCABBCBCBBBCABCACAA"
  2⤵
  PID:6780
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBAABBBCBACCABCACCBCCAAACBCBABACCABBCBCBBBCABCACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACABACCBBBACBCBAAACCBCBCBCCBBCCCAABCCCCAABAAAAACBBB.exe" start= auto displayName= "UserDataSvc_ACBAABBBCBACCABCACCBCCAAACBCBABACCABBCBCBBBCABCACAA"
    3⤵
    PID:8128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBAABBBCBACCABCACCBCCAAACBCBABACCABBCBCBBBCABCACAA"
  2⤵
  PID:8328
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBAABBBCBACCABCACCBCCAAACBCBABACCABBCBCBBBCABCACAA"
    3⤵
    PID:3256

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBACAACCCCCACABBBABBBABBCBBCBCACBBCBCCBCCAACACABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBACAACCCCCACABBBABBBABBCBBCBCACBBCBCCBCCAACACABAA.exe
1⤵
- Executes dropped EXE
PID:2984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABBCAACACACBBCCABCACACBABCBACCBBCCBBBCAACBACACBBABCABACAAACAACBBAACCCCBBACABCCAABBCBBCBBCACAABACACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBACBCACBCCAAACCBAABBAACABBAAAAAACAACCCBCBBCCACCBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABBCAACACACBBCCABCACACBABCBACCBBCCBBBCAACBACACBBABCABACAAACAACBBAACCCCBBACABCCAABBCBBCBBCACAABACACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBACBCACBCCAAACCBAABBAACABBAAAAAACAACCCBCBBCCACCBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8928

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBACAACCCCCACABBBABBBABBCBBCBCACBBCBCCBCCAACACABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBACAACCCCCACABBBABBBABBCBBCBCACBBCBCCBCCAACACABAA.exe
1⤵
- Executes dropped EXE
PID:3180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABCBBACCCABCAAACCAABCCCABAACAAABACBACBCACCBBBBBAAAACABBBBCBBACCCACCAAACCBBCCBBACCABACCCACACCCCCBCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCCBCAACCABCBCCBAABACCCACABBAABAACAAABCCABCBBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:9112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABCBBACCCABCAAACCAABCCCABAACAAABACBACBCACCBBBBBAAAACABBBBCBBACCCACCAAACCBBCCBBACCABACCCACACCCCCBCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCCBCAACCABCBCCBAABACCCACABBAABAACAAABCCABCBBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBBCABBCCCBAAABBABBCCABAABABABAAAACBCBCAACBCCACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCCBCAACCABCBCCBAABACCCACABBAABAACAAABCCABCBBABBB.exe" start= auto displayName= "UserDataSvc_BCBBBCABBCCCBAAABBABBCCABAABABABAAAACBCBCAACBCCACBA"
  2⤵
  PID:3168
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBBCABBCCCBAAABBABBCCABAABABABAAAACBCBCAACBCCACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCCBCAACCABCBCCBAABACCCACABBAABAACAAABCCABCBBABBB.exe" start= auto displayName= "UserDataSvc_BCBBBCABBCCCBAAABBABBCCABAABABABAAAACBCBCAACBCCACBA"
    3⤵
    PID:8624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBBCABBCCCBAAABBABBCCABAABABABAAAACBCBCAACBCCACBA"
  2⤵
  - Executes a command shell one-liner
  PID:7312

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABCBBCBCBCCABBCABCABBABABCBABACBCACAACCBCCACCCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABCBBCBCBCCABBCABCABBABABCBABACBCACAACCBCCACCCCAB.exe
1⤵
- Executes dropped EXE
PID:5648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCACCBCBCAACBBACBABABABACCABAACBBCCACAACAACCBBAACCCBBBBBCBAACABAACBBCCBCBBACCABBCACCCCACCBBACCCBBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABACACCCBCBAACBBBACCBBBCBABCAAABACBCABAAABCAABACAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCACCBCBCAACBBACBABABABACCABAACBBCCACAACAACCBBAACCCBBBBBCBAACABAACBBCCBCBBACCABBCACCCCACCBBACCCBBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABACACCCBCBAACBBBACCBBBCBABCAAABACBCABAAABCAABACAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8180

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABCBBCBCBCCABBCABCABBABABCBABACBCACAACCBCCACCCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBABCBBCBCBCCABBCABCABBABABCBABACBCACAACCBCCACCCCAB.exe
1⤵
- Executes dropped EXE
PID:5404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCABCCABACAACCBCBBCACBBABAAACBBCBCBCAACCABABAAABCBBABAABCBBCBBACCBAABAAABAABBBAAABBCCCBCABBAABAACACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCBAACCCABBCAABBCCBCCCCACCCBBAACCBBBCAACCCAACACBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCABCCABACAACCBCBBCACBBABAAACBBCBCBCAACCABABAAABCBBABAABCBBCBBACCBAABAAABAABBBAAABBCCCBCABBAABAACACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCBAACCCABBCAABBCCBCCCCACCCBBAACCBBBCAACCCAACACBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBACCCACCBCACABBABABCCBACBCABCCBBACCAACBCCCCCBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCBAACCCABBCAABBCCBCCCCACCCBBAACCBBBCAACCCAACACBBBC.exe" start= auto displayName= "UserDataSvc_CCBBACCCACCBCACABBABABCCBACBCABCCBBACCAACBCCCCCBBBA"
  2⤵
  - Executes a command shell one-liner
  PID:716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBCCCBBABCACACBCBBBBAABBCAACBBAACCCBBBCACBBBBBACABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBCCCBBABCACACBCBBBBAABBCAACBBAACCCBBBCACBBBBBACABC.exe
1⤵
- Executes dropped EXE
PID:6328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCBCCABCBCBABACBAABAACACAAACAAACCBAAACBBBABACCBCAABCCACBBBACBACABABAACBCACBAAABAAACBCCCABBCBAABBBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCBABABAAACBBAABABABCCCCCABBACBAABBACCAABABABBAACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCBCCABCBCBABACBAABAACACAAACAAACCBAAACBBBABACCBCAABCCACBBBACBACABABAACBCACBAAABAAACBCCCABBCBAABBBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCBABABAAACBBAABABABCCCCCABBACBAABBACCAABABABBAACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCCCBAACABBBCAACBAAACBBCAACBBCCCCBCACACBCCACCBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCBABABAAACBBAABABABCCCCCABBACBAABBACCAABABABBAACBC.exe" start= auto displayName= "UserDataSvc_CCCCCCBAACABBBCAACBAAACBBCAACBBCCCCBCACACBCCACCBCAC"
  2⤵
  PID:8152
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCCCBAACABBBCAACBAAACBBCAACBBCCCCBCACACBCCACCBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCBABABAAACBBAABABABCCCCCABBACBAABBACCAABABABBAACBC.exe" start= auto displayName= "UserDataSvc_CCCCCCBAACABBBCAACBAAACBBCAACBBCCCCBCACACBCCACCBCAC"
    3⤵
    - Launches sc.exe
    PID:8252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCCCBAACABBBCAACBAAACBBCAACBBCCCCBCACACBCCACCBCAC"
  2⤵
  PID:8616
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCCCBAACABBBCAACBAAACBBCAACBBCCCCBCACACBCCACCBCAC"
    3⤵
    - Launches sc.exe
    PID:7384

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBCCCBBABCACACBCBBBBAABBCAACBBAACCCBBBCACBBBBBACABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBCCCBBABCACACBCBBBBAABBCAACBBAACCCBBBCACBBBBBACABC.exe
1⤵
- Executes dropped EXE
PID:6332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBBBCCBBABACCACCABCCACBAABAAABCABBAABBACBBAABABACBBAACACBCCBBACBCCBBCCBBAACAABCBACCACBBCCCAAAABCBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCCABCAABBBACCABAABCAACACBAACABACBBACCCABBACBCAACAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:6500
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBBBCCBBABACCACCABCCACBAABAAABCABBAABBACBBAABABACBBAACACBCCBBACBCCBBCCBBAACAABCBACCACBBCCCAAAABCBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCCABCAABBBACCABAABCAACACBAACABACBBACCCABBACBCAACAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABACCCAAAABBAABBCAACABCACABBBAAABACAABAABAABABABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCCABCAABBBACCABAABCAACACBAACABACBBACCCABBACBCAACAAA.exe" start= auto displayName= "UserDataSvc_BAABACCCAAAABBAABBCAACABCACABBBAAABACAABAABAABABABA"
  2⤵
  - Executes a command shell one-liner
  PID:7948
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABACCCAAAABBAABBCAACABCACABBBAAABACAABAABAABABABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCCABCAABBBACCABAABCAACACBAACABACBBACCCABBACBCAACAAA.exe" start= auto displayName= "UserDataSvc_BAABACCCAAAABBAABBCAACABCACABBBAAABACAABAABAABABABA"
    3⤵
    PID:8040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABACCCAAAABBAABBCAACABCACABBBAAABACAABAABAABABABA"
  2⤵
  - Executes a command shell one-liner
  PID:8680
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABACCCAAAABBAABBCAACABCACABBBAAABACAABAABAABABABA"
    3⤵
    - Launches sc.exe
    PID:4908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACAACCAABAACBCBBBBCCBBACBBCBCABBABABCBBAAAACACCCABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACAACCAABAACBCBBBBCCBBACBBCBCABBABABCBBAAAACACCCABBC.exe
1⤵
- Executes dropped EXE
PID:6580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABACBCBCCCBABBAACAAACCCCCCBACCAABBACAAACCCBCCCACBCCBBBACCBAACAAABAAABAACCBACABBCACCCAAABBCACCCABBABACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBABBCCCBBBCABAABCBBBBBCBAACCACABCBBAAACACAABCACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABACBCBCCCBABBAACAAACCCCCCBACCAABBACAAACCCBCCCACBCCBBBACCBAACAAABAAABAACCBACABBCACCCAAABBCACCCABBABACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBABBCCCBBBCABAABCBBBBBCBAACCACABCBBAAACACAABCACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABABCCBAACACABCAABCACBBBBACCACBACBABCACCCCAAAACACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBABBCCCBBBCABAABCBBBBBCBAACCACABCBBAAACACAABCACBB.exe" start= auto displayName= "UserDataSvc_CABABCCBAACACABCAABCACBBBBACCACBACBABCACCCCAAAACACB"
  2⤵
  PID:8376
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABABCCBAACACABCAABCACBBBBACCACBACBABCACCCCAAAACACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBABBCCCBBBCABAABCBBBBBCBAACCACABCBBAAACACAABCACBB.exe" start= auto displayName= "UserDataSvc_CABABCCBAACACABCAABCACBBBBACCACBACBABCACCCCAAAACACB"
    3⤵
    - Launches sc.exe
    PID:6788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABABCCBAACACABCAABCACBBBBACCACBACBABCACCCCAAAACACB"
  2⤵
  PID:9092
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABABCCBAACACABCAABCACBBBBACCACBACBABCACCCCAAAACACB"
    3⤵
    - Launches sc.exe
    PID:8760

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACAACCAABAACBCBBBBCCBBACBBCBCABBABABCBBAAAACACCCABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACAACCAABAACBCBBBBCCBBACBBCBCABBABABCBBAAAACACCCABBC.exe
1⤵
- Executes dropped EXE
PID:6588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABBCACBAABABACACBCABCABBBBBCABAACACCACACCAAAABCCBCBCBCBCCCCCAABAACAABAAABCACCBABCACABCAABBCCACACAAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBCACABAAACCBBBCCCCCCCCAACBBBABAABBABABBCCCCAABCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7572
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABBCACBAABABACACBCABCABBBBBCABAACACCACACCAAAABCCBCBCBCBCCCCCAABAACAABAAABCACCBABCACABCAABBCCACACAAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBCACABAAACCBBBCCCCCCCCAACBBBABAABBABABBCCCCAABCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABAABCCBAABCABCBBBBBBBABAABCBACABCCCBBACACBCBACABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBCACABAAACCBBBCCCCCCCCAACBBBABAABBABABBCCCCAABCCAA.exe" start= auto displayName= "UserDataSvc_AABAABCCBAABCABCBBBBBBBABAABCBACABCCCBBACACBCBACABA"
  2⤵
  PID:8244
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABAABCCBAABCABCBBBBBBBABAABCBACABCCCBBACACBCBACABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBCACABAAACCBBBCCCCCCCCAACBBBABAABBABABBCCCCAABCCAA.exe" start= auto displayName= "UserDataSvc_AABAABCCBAABCABCBBBBBBBABAABCBACABCCCBBACACBCBACABA"
    3⤵
    - Launches sc.exe
    PID:8728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABAABCCBAABCABCBBBBBBBABAABCBACABCCCBBACACBCBACABA"
  2⤵
  PID:1356
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABAABCCBAABCABCBBBBBBBABAABCBACABCCCBBACACBCBACABA"
    3⤵
    - Launches sc.exe
    PID:7812

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABBAACBAAAACBAACCAAAABBCACBABBCCAAAAABCBCBABAACCBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABBAACBAAAACBAACCAAAABBCACBABBCCAAAAABCBCBABAACCBABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABCACCBBACCBBAABCBBBACBBABBAABCCABBBCABBACCCCCBAAACAABCCCBABAABCBBCBACBBACBCACBBCACBCCACBCCBACACABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACAAACCACBABAABACCAAAABAACCCABCCBCBABBABBACBACAAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:7528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABCACCBBACCBBAABCBBBACBBABBAABCCABBBCABBACCCCCBAAACAABCCCBABAABCBBCBACBBACBCACBBCACBCCACBCCBACACABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACAAACCACBABAABACCAAAABAACCCABCCBCBABBABBACBACAAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCAACAACCBACBABACAAABABBCABCBCCCAACBBBBABCCBCCABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACAAACCACBABAABACCAAAABAACCCABCCBCBABBABBACBACAAAAAC.exe" start= auto displayName= "UserDataSvc_ACCAACAACCBACBABACAAABABBCABCBCCCAACBBBBABCCBCCABCA"
  2⤵
  PID:8628
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCAACAACCBACBABACAAABABBCABCBCCCAACBBBBABCCBCCABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACAAACCACBABAABACCAAAABAACCCABCCBCBABBABBACBACAAAAAC.exe" start= auto displayName= "UserDataSvc_ACCAACAACCBACBABACAAABABBCABCBCCCAACBBBBABCCBCCABCA"
    3⤵
    PID:4708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCAACAACCBACBABACAAABABBCABCBCCCAACBBBBABCCBCCABCA"
  2⤵
  - Executes a command shell one-liner
  PID:5524
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCAACAACCBACBABACAAABABBCABCBCCCAACBBBBABCCBCCABCA"
    3⤵
    - Launches sc.exe
    PID:1428

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABBAACBAAAACBAACCAAAABBCACBABBCCAAAAABCBCBABAACCBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABBAACBAAAACBAACCAAAABBCACBABBCCAAAAABCBCBABAACCBABC.exe
1⤵
- Executes dropped EXE
PID:7020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCBCCCAACBAAABCBCCCBCBAABBCAABAAABBAAABACACAAAABABAAACBBCCACCCCBCCBAACACCCABABABBCAACBBCCBAAAABACBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBCACABAAACCBBBCCCCCCCCAACBBBABAABBABABBCCCCAABCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:7764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCBCCCAACBAAABCBCCCBCBAABBCAABAAABBAAABACACAAAABABAAACBBCCACCCCBCCBAACACCCABABABBCAACBBCCBAAAABACBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBCACABAAACCBBBCCCCCCCCAACBBBABAABBABABBCCCCAABCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBABBBBCCAAABCAAAACBACCBBAACBCBBCBBCBAABBCCCACACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBCACABAAACCBBBCCCCCCCCAACBBBABAABBABABBCCCCAABCCAA.exe" start= auto displayName= "UserDataSvc_ACBABBBBCCAAABCAAAACBACCBBAACBCBBCBBCBAABBCCCACACBB"
  2⤵
  - Executes a command shell one-liner
  PID:8668
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBABBBBCCAAABCAAAACBACCBBAACBCBBCBBCBAABBCCCACACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBCACABAAACCBBBCCCCCCCCAACBBBABAABBABABBCCCCAABCCAA.exe" start= auto displayName= "UserDataSvc_ACBABBBBCCAAABCAAAACBACCBBAACBCBBCBBCBAABBCCCACACBB"
    3⤵
    - Launches sc.exe
    PID:7884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBABBBBCCAAABCAAAACBACCBBAACBCBBCBBCBAABBCCCACACBB"
  2⤵
  PID:5536
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBABBBBCCAAABCAAAACBACCBBAACBCBBCBBCBAABBCCCACACBB"
    3⤵
    - Launches sc.exe
    PID:5416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCAACCABBABBACCCABAABACCACABCBAAABACCBCACABCCBBACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCAACCABBABBACCCABAABACCACABCBAAABACCBCACABCCBBACBB.exe
1⤵
- Executes dropped EXE
PID:7072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABBBCBBACABBBBBACABBCBABBBBBBCCBACCCBBCAABABCCBAAAACCAAABCCAABCACCBCACCABBABCBCCBCBBABBACBCCCBCBAAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBCCBAABBABAACCACACACAACCBBBCACABBBBCBABBBCAABBCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABBBCBBACABBBBBACABBCBABBBBBBCCBACCCBBCAABABCCBAAAACCAAABCCAABCACCBCACCABBABCBCCBCBBABBACBCCCBCBAAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBCCBAABBABAACCACACACAACCBBBCACABBBBCBABBBCAABBCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAACACCBAACBBCBBBACCCBCAACCAABAAACBBCBBACABABCCAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBCCBAABBABAACCACACACAACCBBBCACABBBBCBABBBCAABBCBCB.exe" start= auto displayName= "UserDataSvc_AAACACCBAACBBCBBBACCCBCAACCAABAAACBBCBBACABABCCAACA"
  2⤵
  PID:1420
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAACACCBAACBBCBBBACCCBCAACCAABAAACBBCBBACABABCCAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBCCBAABBABAACCACACACAACCBBBCACABBBBCBABBBCAABBCBCB.exe" start= auto displayName= "UserDataSvc_AAACACCBAACBBCBBBACCCBCAACCAABAAACBBCBBACABABCCAACA"
    3⤵
    - Launches sc.exe
    PID:1428

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCAACCABBABBACCCABAABACCACABCBAAABACCBCACABCCBBACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCAACCABBABBACCCABAABACCACABCBAAABACCBCACABCCBBACBB.exe
1⤵
- Executes dropped EXE
PID:7080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBABCCCBCCAAAAABBABBAACAABBBAACBABABCBBBCBBCAAAAAAABABAAACABABACCCACBBAABCBCABCCACBCCABACAABCCCCBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCBCBABACCBBCACBAACCBBACAAAABACBBACCACBBCBBAAACCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBABCCCBCCAAAAABBABBAACAABBBAACBABABCBBBCBBCAAAAAAABABAAACABABACCCACBBAABCBCABCCACBCCABACAABCCCCBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCBCBABACCBBCACBAACCBBACAAAABACBBACCACBBCBBAAACCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBBBAAACCCBCAAAAABCABBBBBABCBABCBBCCBBCBCABCAAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCBCBABACCBBCACBAACCBBACAAAABACBBACCACBBCBBAAACCAAA.exe" start= auto displayName= "UserDataSvc_CACBBBAAACCCBCAAAAABCABBBBBABCBABCBBCCBBCBCABCAAABA"
  2⤵
  PID:3204
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBBBAAACCCBCAAAAABCABBBBBABCBABCBBCCBBCBCABCAAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCBCBABACCBBCACBAACCBBACAAAABACBBACCACBBCBBAAACCAAA.exe" start= auto displayName= "UserDataSvc_CACBBBAAACCCBCAAAAABCABBBBBABCBABCBBCCBBCBCABCAAABA"
    3⤵
    - Launches sc.exe
    PID:2384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBBBAAACCCBCAAAAABCABBBBBABCBABCBBCCBBCBCABCAAABA"
  2⤵
  PID:3892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABCABBBACAAACACBBCBBBBCACBACABAABBCCCAABBCBACCBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABCABBBACAAACACBBCBBBBCACBACABAABBCCCAABBCBACCBBBBA.exe
1⤵
PID:7208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCBABCCCCBCACACABABCAAACCBACCABAABABBBACABBAACACABABBBBACACABBCBABBABCBABBAAABBCBBCBABBCBCAACCBACBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBCBAACCBACCACCBBCCBBCBCABBAAAABCCCBBBACCBBBCCABACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:2628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCBABCCCCBCACACABABCAAACCBACCABAABABBBACABBAACACABABBBBACACABBCBABBABCBABBAAABBCBBCBABBCBCAACCBACBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBCBAACCBACCACCBBCCBBCBCABBAAAABCCCBBBACCBBBCCABACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8924

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACABACCBBBACBCBAAACCBCBCBCCBBCCCAABCCCCAABAAAAACBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACABACCBBBACBCBAAACCBCBCBCCBBCCCAABCCCCAABAAAAACBBB.exe
1⤵
PID:7336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBABBCAACBCBBACABAACCCCBACBBCCBAABABBBABBCCBCABBABABCACBBBCCCBCCCAAACBBBCACACCCCBCBBBCBCACCBBCCCBCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAACBBABBBCBCABCBBBACBCBBCBCCCABABCBBBBABBABCBCBCACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:2420

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBCABCABBACBAACACBBBBCCAACACAABCACCBCACAABCCBACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBCABCABBACBAACACBBBBCCAACACAABCACCBCACAABCCBACBA.exe
1⤵
PID:8064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBAAACBAABABCCAACBABCBABACBACCBCAACAACACCBAABBCCABCACBBBBBBABBAACCAACABBCCBBACBBAABBCCCBABBCABABBCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABCBCCBBACBBBBABBABBCBCCBBACBBBCBAABABBACBCABBCBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:8896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBAAACBAABABCCAACBABCBABACBACCBCAACAACACCBAABBCCABCACBBBBBBABBAACCAACABBCCBBACBBAABBCCCBABBCABABBCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABCBCCBBACBBBBABBABBCBCCBBACBBBCBAABABBACBCABBCBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCAABCAABBCBBAABBBACABACAACCABAABBABCACACCCCCCCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABCBCCBBACBBBBABBABBCBCCBBACBBBCBAABABBACBCABBCBABBB.exe" start= auto displayName= "UserDataSvc_CBCAABCAABBCBBAABBBACABACAACCABAABBABCACACCCCCCCCAB"
  2⤵
  PID:8744
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCAABCAABBCBBAABBBACABACAACCABAABBABCACACCCCCCCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABCBCCBBACBBBBABBABBCBCCBBACBBBCBAABABBACBCABBCBABBB.exe" start= auto displayName= "UserDataSvc_CBCAABCAABBCBBAABBBACABACAACCABAABBABCACACCCCCCCCAB"
    3⤵
    - Launches sc.exe
    PID:6616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCAABCAABBCBBAABBBACABACAACCABAABBABCACACCCCCCCCAB"
  2⤵
  - Executes a command shell one-liner
  PID:9324

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBCABCABBACBAACACBBBBCCAACACAABCACCBCACAABCCBACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBCABCABBACBAACACBBBBCCAACACAABCACCBCACAABCCBACBA.exe
1⤵
PID:7400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACCCAABCCBCCCCABBCBBBCBABBCABBBAABCBACACCCBAACACAACAACACABAACABAABCABACCCBBBBBACACBCABAAACCBABCBBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACBBBACABACBBCAABBACAACCCCBABBACBACCBAAACABAACCABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACCCAABCCBCCCCABBCBBBCBABBCABBBAABCBACACCCBAACACAACAACACABAACABAABCABACCCBBBBBACACBCABAAACCBABCBBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACBBBACABACBBCAABBACAACCCCBABBACBACCBAAACABAACCABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACABCCBACBBABCCAAACABBCCCABBAACBAABAACBCBBBABCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACBBBACABACBBCAABBACAACCCCBABBACBACCBAAACABAACCABAA.exe" start= auto displayName= "UserDataSvc_ABACABCCBACBBABCCAAACABBCCCABBAACBAABAACBCBBBABCACB"
  2⤵
  - Executes a command shell one-liner
  PID:6200
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACABCCBACBBABCCAAACABBCCCABBAACBAABAACBCBBBABCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACBBBACABACBBCAABBACAACCCCBABBACBACCBAAACABAACCABAA.exe" start= auto displayName= "UserDataSvc_ABACABCCBACBBABCCAAACABBCCCABBAACBAABAACBCBBBABCACB"
    3⤵
    - Launches sc.exe
    PID:9396

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCCBCABCCBCBBBCBCCABAACAACCBBCBAABBCCCBCAABCCCCBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCCBCABCCBCBBBCBCCABAACAACCBBCBAABBCCCBCAABCCCCBBAB.exe
1⤵
PID:8412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCBAAACCBCBCBBACBCBBBAAACAABCBCBACACAAACACABABACBBCAACCBCCBCABACCACACBACABCCACAAACBBBBBBBBABBBABABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACABABBCCBBABCBCBABACCBACABAAAAABBBBBABCCCCBACBABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8240

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCCBCABCCBCBBBCBCCABAACAACCBBCBAABBCCCBCAABCCCCBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCCBCABCCBCBBBCBCCABAACAACCBBCBAABBCCCBCAABCCCCBBAB.exe
1⤵
PID:8568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCCCCBABCBBABAACBAABCAAABBBBBCBBCCBABCBCBABBABABAABCCACBCACBBBBACCABCABBABAACABABCCCCCBBACCACACBCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACBABCABACABBACBCCCBBBAABCCABCCCBBACCAAABAABCAAABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:6172

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABCABBBACAAACACBBCBBBBCACBACABAABBCCCAABBCBACCBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABCABBBACAAACACBBCBBBBCACBACABAABBCCCAABBCBACCBBBBA.exe
1⤵
PID:9032

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACAAACCACBABAABACCAAAABAACCCABCCBCBABBABBACBACAAAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACAAACCACBABAABACCAAAABAACCCABCCBCBABBABBACBACAAAAAC.exe
1⤵
PID:9164

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACABACCBBBACBCBAAACCBCBCBCCBBCCCAABCCCCAABAAAAACBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACABACCBBBACBCBAAACCBCBCBCCBBCCCAABCCCCAABAAAAACBBB.exe
1⤵
PID:7856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCCACBAACACCCCAAAACBBBACBBCAAAACACACBCCAAAABAAABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCCACBAACACCCCAAAACBBBACBBCAAAACACACBCCAAAABAAABAA.exe
1⤵
PID:8172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABBCCAAABBABABBAACCACCABCBBCACCACACACCBCCCCBAACBCACBACCABACBACBAABCACCBCCAAABABCBBBBBCCBACCABACBCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAACBCACACABAACBAACBBABAACCACCBCCACCBACCCBBAACCABBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:1368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABBCCAAABBABABBAACCACCABCBBCACCACACACCBCCCCBAACBCACBACCABACBACBAABCACCBCCAAABABCBBBBBCCBACCABACBCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAACBCACACABAACBAACBBABAACCACCBCCACCBACCCBBAACCABBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCBAACCBBABBACACBAAACACBAACBABBCBBBCCBCABCACACABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAACBCACACABAACBAACBBABAACCACCBCCACCBACCCBBAACCABBBB.exe" start= auto displayName= "UserDataSvc_BABCBAACCBBABBACACBAAACACBAACBABBCBBBCCBCABCACACABA"
  2⤵
  - Executes a command shell one-liner
  PID:9352

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCCACBAACACCCCAAAACBBBACBBCAAAACACACBCCAAAABAAABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCCACBAACACCCCAAAACBBBACBBCAAAACACACBCCAAAABAAABAA.exe
1⤵
PID:7708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABACBACAAAACCBCACABBAABACBBCBBBCAABBABAACCACCCCBABACCCABBCCBABABBCABAAACACBBBBBCABABCCBBBBCACCCCACAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCAACACCBCABACBBBBACAABABCBACCCCCAACCBAACAABACBBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABACBACAAAACCBCACABBAABACBBCBBBCAABBABAACCACCCCBABACCCABBCCBABABBCABAAACACBBBBBCABABCCBBBBCACCCCACAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCAACACCBCABACBBBBACAABABCBACCCCCAACCBAACAABACBBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6348

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCCABCAABBBACCABAABCAACACBAACABACBBACCCABBACBCAACAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCCABCAABBBACCABAABCAACACBAACABACBBACCCABBACBCAACAAA.exe
1⤵
PID:2580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCAABACCABBACCCBBCCBABBACBACABCACBCBCAAACCCABBACAABCABCBCCCACBABBCCBCAABCBCBAACCACBCAAABAABBCABBBACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCBCAACBACCAABCCAACAACACCCCCCBACBCBABCCBCCACCBAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:3260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCAABACCABBACCCBBCCBABBACBACABCACBCBCAAACCCABBACAABCABCBCCCACBABBCCBCAABCBCBAACCACBCAAABAABBCABBBACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCBCAACBACCAABCCAACAACACCCCCCBACBCBABCCBCCACCBAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACABACCBBBACBCBAAACCBCBCBCCBBCCCAABCCCCAABAAAAACBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACABACCBBBACBCBAAACCBCBCBCCBBCCCAABCCCCAABAAAAACBBB.exe
1⤵
PID:7844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCABBBBCAAABCCCCBBABBBBCCCCACCBBCBABBCBBBABCABCBBAABCCBCCBBCABABCBCCAABABAACBAACAABBBCAACCBAABCBABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCBBAAABBCBAACAABACCCCBBCCCCABBBCBABBABACCCBAABACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCBABABAAACBBAABABABCCCCCABBACBAABBACCAABABABBAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCBABABAAACBBAABABABCCCCCABBACBAABBACCAABABABBAACBC.exe
1⤵
PID:8548

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCBABABAAACBBAABABABCCCCCABBACBAABBACCAABABABBAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCBABABAAACBBAABABABCCCCCABBACBAABBACCAABABABBAACBC.exe
1⤵
PID:8508

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCCABCAABBBACCABAABCAACACBAACABACBBACCCABBACBCAACAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCCABCAABBBACCABAABCAACACBAACABACBBACCCABBACBCAACAAA.exe
1⤵
PID:8344

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCCCAABBBACCCCCCBCCBAAACCCACBCCCCCAABAAACAACBACCAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCCCAABBBACCCCCCBCCBAAACCCACBCCCCCAABAAACAACBACCAABC.exe
1⤵
PID:7160

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBCACABAAACCBBBCCCCCCCCAACBBBABAABBABABBCCCCAABCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBCACABAAACCBBBCCCCCCCCAACBBBABAABBABABBCCCCAABCCAA.exe
1⤵
PID:4336

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBCACABAAACCBBBCCCCCCCCAACBBBABAABBABABBCCCCAABCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBCACABAAACCBBBCCCCCCCCAACBBBABAABBABABBCCCCAABCCAA.exe
1⤵
PID:4252

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBCACABAAACCBBBCCCCCCCCAACBBBABAABBABABBCCCCAABCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBCACABAAACCBBBCCCCCCCCAACBBBABAABBABABBCCCCAABCCAA.exe
1⤵
PID:2176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABACABCBACCACACCABBBCBBAAACCABBABACACCCABBCAABBCCABACBACBCBCCCAAABBACCBABCBAAAAABAAAACACABACBCBCBACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABABBBACACCCABACBCCABABACBBCABACCBBACCBAAAAACCBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6980

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBABBCCCBBBCABAABCBBBBBCBAACCACABCBBAAACACAABCACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBABBCCCBBBCABAABCBBBBBCBAACCACABCBBAAACACAABCACBB.exe
1⤵
PID:7836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCAAAAABACBABBABCBAABAABBBCACCBBBCCBAACCCABBBCBBBAABCACBCACACBABBACCBCBABBBBBAABABCBACBBCABBACBABAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCCAAABBACCACCAAAABACBCBCBCBAAAABBBBCBBACBCACCBACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9572

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBABBCCCBBBCABAABCBBBBBCBAACCACABCBBAAACACAABCACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBABBCCCBBBCABAABCBBBBBCBAACCACABCBBAAACACAABCACBB.exe
1⤵
PID:7816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCACAACBCBCABAACBACBCBBCAACABABCAAACAACCACBBCABCCBAABCACACCCACABCCACBBABACBACABAACACBCBCAAABBACBBCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBAACAABCBAABBBBABBACBCCACBBBCAAAACACAAAABCBBCACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:6892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCAAAACCCCBCAACABBCCAAABBCAABCACBBCBACCBACBACBBBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCAAAACCCCBCAACABBCCAAABBCAABCACBBCBACCBACBACBBBAAB.exe
1⤵
PID:2980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBABABACABBAACBBBACCAACCCCBBBBBBBBCBCACABBAACCACCACBCBBACCBBCBBABABABAABACAAACCCBCABACBBCCAACACCAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCCBACBABCCBCCACBCCABAACABBBCBCCCBAACBCBCAACCACAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:9452

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCAAAACCCCBCAACABBCCAAABBCAABCACBBCBACCBACBACBBBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCAAAACCCCBCAACABBCCAAABBCAABCACBBCBACCBACBACBBBAAB.exe
1⤵
PID:8688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAABABCABCACBBAABCCCBCCAACBBBABAAAAACBBCBCBABBBACBAAAABBBBCACCBBCAACCBBBBACCACCABCAACABCACBCABAABABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAACCBBABBACACBAAACACBAACBABBCBBBCCBCABCACACABACBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9424

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCBCBABACCBBCACBAACCBBACAAAABACBBACCACBBCBBAAACCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCBCBABACCBBCACBAACCBBACAAAABACBBACCACBBCBBAAACCAAA.exe
1⤵
PID:1456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACAAACCACBABAABACCAAAABAACCCABCCBCBABBABBACBACAAAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACAAACCACBABAABACCAAAABAACCCABCCBCBABBABBACBACAAAAAC.exe
1⤵
PID:7656

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAACACBCCCAACBBCCAABBABBBACABCBAABCABABABBAAACACABCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAACACBCCCAACBBCCAABBABBBACABCBAABCABABABBAAACACABCCB.exe
1⤵
PID:6532

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAACACBCCCAACBBCCAABBABBBACABCBAABCABABABBAAACACABCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAACACBCCCAACBBCCAABBABBBACABCBAABCABABABBAAACACABCCB.exe
1⤵
PID:2516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

virus_log.txt

Path C:\Users\Admin\AppData\Local\Temp\virus_log.txt
Size 1KB
SHA256 350ceb947af8e94aa268cdfd19bbfa503a313969a991820bebe2f6433edbe67c
MD5 3191e9fd68f61f447c6b5300012d5402
SHA1 45d8ed2e190c3eef5a6e369ea8386e9efd4d5370
SHA512 9a8421e1ecaa809acf6c5f8641c295ebfcbc155b47ba9d1a1365c499452e7fbbcd4b59609299238dd90c5d3144f4fab92a738bc7130dce7127f62628a3df12a1
TLSH
T1E9416A0AE1F9DC37A81197C38666BFDCC4F4B69EBC582A045344861DB3A5933CCBA5C1
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ce67b214c644eefc62bfea673b5ca4263a7ed53ecfa576a3fa568f6aac60482b
MD5 4dbbf6b4c0e19d161138b9a08ac6e804
SHA1 c30afed8d8bd53aedf6f60bce78348803d80d4b9
SHA512 9871a9d4f80c759ceb2895faf259b82e89a934b3b1dc947ff68fc7e4fc60a1b2c621c324aabbbcde27fd93282391f76d70b0192f29a4929a3e64627ea4315252
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a69711af55d54ba772522728d1268b9ef5bf12fcfc8cbc2cc1f4662edafdc4ca
MD5 b0205a162707a10ed38d7e7ac99ba50c
SHA1 6d08a2a50cbcd45ecace38229053b91b624eae90
SHA512 89f6b484f020f11759b270d4ed5cdcfdb48670a1f17b4c33ee89df005c741fa9e0e8090fcab6a7eaef93852da25617d0b0262d5ba3115084c7f3f88fd204f825
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ee243ceecc69291f654d0250ab96657a899719fe2f6d55e0718f5708ff23ad50
MD5 dcbd93017ce7ec91e63ab8def01848c1
SHA1 857e25bd10ce245dd1c7421dde42cfe9bc14d201
SHA512 412980e852507f07d2ef4ea73283cf73f050544fb2a84c8339cf9d799d486d17c0e19811e32c95070c7a34147c5a44c648d70d519bbbc652bdca195d8381598e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6a2f6d2d67952d2dcac732006595e37cc1f3255abaa848179b6dea9d73a97a60
MD5 713ec426f9f057e273752f81b8e521c0
SHA1 103fccfe1f2317f2572d0e7a11e187d599d21891
SHA512 763b18984e3bfeea0ecdf15818f11691c1bc817202c4024fc1fa0eeca72082d04fe54eb2c39baf7b38c948c6eedad72a644705c6fb8b488d6b593041561c157a
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 4aa1535ec59f7e4d1f06b76e97a7eef8d0fcdadff88d7af998f026895d108dfb
MD5 c4d41de2a2997a2afdf6f7b59db95654
SHA1 310d9e947f987476436c06e333b6b6e4f20e558d
SHA512 22f861462ee4ce2bf3e50c929d0f11c9b4716825cacc0ac3a9d3920b27bc48708741debdcab8a0d7c53c1f26ad2d1f2231cca084416894c45b7b85cf79519af1
SSDEEP 96:o47d+1g+11bJS4bJ/tDv4awSY+0ea+WwN7X89e1I249jZr+P600CbJj1BC4xY2L:or7nEiaUN7fIa0e5N
TLSH
T146913729F2F5D833E5326CC795199AD24DF4B38FACC85A446349831CAB50D32CC6AAE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 4701dfd6a97f9b710ffe5070713be024b2c28c2eb009a74bb168a913e90c5e5d
MD5 f4de7a2a74e48209427d014bec5f25a4
SHA1 0e19b7c03139c22110f89b64967cb27f7221c9a1
SHA512 6187c58a0305024e165b417a6b2a266d3bc331d926a049886ded303748cb1d430e4da8249af306a8f41fc8d480954857ca796028c61b2e7221741fcaa7325a1c
SSDEEP 96:o47d+1g+11bJS4bJ/tDv4awSY+0ea+WwN7X89e1I249jZr+P600CbJj1BC4xY24J:or7nEiaUN7fIa0e5GCQ
TLSH
T16CA12829F2F59833E5326CC79519D9D24DF4B38FBC885A446349831DAB50D32CC6AAD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 f6e2ff396efdd51525f479d7d0b015ac64688ff089b7bf22fd7b1ea4cd6a2988
MD5 e60b427efc213e008a1161d4f929ff01
SHA1 c2347d2e12362ed0b9c3ce6d84bda21dede915f7
SHA512 651660251773633ba0f6c0b10b7a8c99fe7f41900ba8e39dbc8a53e48e6a7ac388dacef2f9dce0782833c41b127959eac722e3da2ddbe372e9f5c13c32e28db2
SSDEEP 96:o47d+1g+11bJS4bJ/tDv4awSY+0ea+WwN7X89e1I249jZr+P600CbJj1BC4xY24Q:or7nEiaUN7fIa0e5GCQ+Qi
TLSH
T15DB13729F1F5D833E622ACC79519AAD24CF4739FACCC5A445349831DAB50D32CC6A9E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 2972cb25f6586caf899d4011ddbfdb09df1e0ad9c614095ca4eff6a0ecb53bdf
MD5 1c0821704ba63363b6224463ddaa2172
SHA1 9986723fb4175d337aa837b4c22f5ce26e1537c9
SHA512 83f114d1d66d15d9fb5a2172bb3a9fa95bfeb2632d675b8c1d32f6db335d61a3389c3e6f08c8d18b968f0f0254b6a7fb75e8bdf5eed5d9e4a16114e1c43a2546
SSDEEP 96:o47d+1g+11bJS4bJ/tDv4awSY+0ea+WwN7X89e1I249jZr+P600CbJj1BC4xY24c:or7nEiaUN7fIa0e5GCQ+QwR
TLSH
T1B7B12529F1F5D833E622ACC79519AAE14CF4739FECCC5A445349831DAB50D32CC6AAE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 2c062ffd99d295cf693f2339ae98ea0ce19b81cbd38755c712b564e10a254baf
MD5 bc49e71b0b15d69b8ef6553eb5df694f
SHA1 496face26d753976ce058ad6da4f596e7e163cb1
SHA512 65af01602c8db6ea95717f49594569e039531f9c3d77a257d1c222fe2ac40d67eb51f87503ab3b301883cd92bfcc68609be36e660e68ec7c1d0a39b26cd5209a
SSDEEP 96:o47d+1g+11bJS4bJ/tDv4awSY+0ea+WwN7X89e1I249jZr+P600CbJj1BC4xY24C:or7nEiaUN7fIa0e5GCQ+Qw8C
TLSH
T1E9C13529F1F5D833E622ACC79519AAE14CF4739FECCC5A445349831DAB50C32CC6AAE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 6f2073502f6f5947ad529ba4b22bed9fd07d77f4fa6bc389a2a0124330448967
MD5 8acc3507f2523af3de40ee6ac3af6c44
SHA1 a37c0e25f814609ba26eeff249e7e73d67ac5b8d
SHA512 6e8c9acd56ae556ed5bb4130532b8995f0ff212b4e70c96dc1ac8ffe652ffa5efb67ff825c0bbf6bcd8f09fb1a47a478e00d49b50b60ad14aae1925b8f5d28c3
SSDEEP 96:o47d+1g+11bJS4bJ/tDv4awSY+0ea+WwN7X89e1I249jZr+P600CbJj1BC4xY24d:or7nEiaUN7fIa0e5GCQ+Qw8Zz
TLSH
T170C13629F1F5D873E622ACC79519AAE14CF4739FECCC5A445349831DAB50C32CC69AD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 e7146f9236293d388f0d1524ecff55d8502a8952e49da3d94afd1c94a1268c78
MD5 87dd39434ab4a9b613537bfe6cdd494e
SHA1 9351acf2f15492c7dd9b07d7b8f3e69917931675
SHA512 1e4e5e86b5b0773ee51d2bbb88127523e99e4b9f5fa2ffe64a0b3470e361f025d3b933a3caa5dd585073856fef3e28c8b112b304bf89d71ad5429a47304980cc
SSDEEP 96:o47d+1g+11bJS4bJ/tDv4awSY+0ea+WwN7X89e1I249jZr+P600CbJj1BC4xY24l:or7nEiaUN7fIa0e5GCQ+Qw8ZubE
TLSH
T1CCD13929F1F5D833E522ADC7951AEAD58CF4739FACC85A445348431DAB90C32CC6AAD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 6927f6e45c20f701abe6b905199239e37f3cc9be591849ed5859f997b8e77a7f
MD5 ae3bae01f603a772c5739fd9b3c1e6f6
SHA1 c25c1ba131e62225d343f2385e755127b4f4d2ae
SHA512 f1e1fa96bba3bc2728fb31cf1af36e3679a2f15b72773bc8e8ab6a3873725967b2e12364571974ae471cea5581314de3f0552746488d94f1fb1d421d7e05d271
SSDEEP 96:o47d+1g+11bJS4bJ/tDv4awSY+0ea+WwN7X89e1I249jZr+P600CbJj1BC4xY24H:or7nEiaUN7fIa0e5GCQ+Qw8ZubC
TLSH
T11EE13629F1F5DC33E522A9C7952AEAD588F4739FBC881A445348431DBB90C32CC6AAD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 cc461506d14f507bd7f7ee2c47d80f8264d9e20acfabc08305c780651d040ee0
MD5 1c524d667e5bc51e52a0a42f69092f6d
SHA1 e35960ba1785d458aeda07de6f135033bc7f2761
SHA512 6de68ff81557f735cc27ad25945ae86b62b8f9137abe04b36e9b4a818b695dd2e465b18af59e07ee0ddb9d9bb3fac632038f9b086a9ad595496f3585effea18f
SSDEEP 96:o47d+1g+11bJS4bJ/tDv4awSY+0ea+WwN7X89e1I249jZr+P600CbJj1BC4xY24x:or7nEiaUN7fIa0e5GCQ+Qw8Zub4CQ
TLSH
T1BEE14629F1F5DC33E522A9C7952AEAD588F4739FBC981A445348431DBB90C32CC6AAD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 adfaea70bf74b78a5b940e0f5c55d6d0aa98fc0451f024c8ee65a66e4063faca
MD5 b20dfddf5e2b6841f6f16a680cb41d50
SHA1 7a49780e307d06218bf90525ae2096be2ced18ce
SHA512 e0e3c56a21e08bb75bf72651886d7477e901f7560cf7fc451700873c87de9c5b039593f9047c6d97ef1beff4b906ee878b0f6320db776cc5e852554ca9596915
SSDEEP 96:o47d+1g+11bJS4bJ/tDv4awSY+0ea+WwN7X89e1I249jZr+P600CbJj1BC4xY24S:or7nEiaUN7fIa0e5GCQ+Qw8Zub4C4Y
TLSH
T1F7F14729F1F5DC33E532A9C7952AEAD58CF4739FAC981A445348831DBB90C32CC6A9D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 8KB
SHA256 689c0b96a669d351819efe8f8a7bb3529e577082707ab9b2cbaea919833243ff
MD5 c578d1027923436ebce01a5e93791762
SHA1 5a0cd2c5ccc6f2e54b630f8c585779fb86589156
SHA512 020d2310f4d2ebde8407a600568b0dc334b05f0308dcdf7aedcdbaa4ffc5e383346ea90d58694bacceba01e383ac4d851d34f621bb6f63a8ae1f8d1949e3c3c6
SSDEEP 96:o47d+1g+11bJS4bJ/tDv4awSY+0ea+WwN7X89e1I249jZr+P600CbJj1BC4xY24f:or7nEiaUN7fIa0e5GCQ+Qw8Zub4C4RgO
TLSH
T1E102682AF1F5DC33E532A9C7952AAAD68CF4738FBC981A445348431DBB50D32CC6A9D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 8KB
SHA256 400f8b82aa577c8a501a1e8495808450d81c365634818882925eeb82cbd77a8d
MD5 f04f3b6d0799cedfcdeea5263e349eb0
SHA1 b8e9f3da91f9dd24051a04a421ac7057601aeaa5
SHA512 58fb43e5f0277617da942550901ad25fb105165eb3ec73b22403b74ece5c1e7aad848043061d13a7c902f6152acab2e8df18231afeb95ba09cf726db9656499c
SSDEEP 192:or7nEiaUN7fIa0e5GCQ+Qw8Zub4C4RgEDEIB:mnEiaUN7Qa0eYBw8ZubEjDEIB
TLSH
T1F002682AF1F5DC33E532A9C79529EAD588F4739FAC981A445348831CBB90D32CC6E9D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 8KB
SHA256 bec884480ff431e9eab17c7ed130ed9dc852bf53c4f4d1e15ef4d180b5d1ab80
MD5 d1aa7ede31115e44646ae1aa7069acb2
SHA1 d871f8ff2e2d49f4560871f0254524ecccfeb430
SHA512 64469bba1b6e1ff2126ba0d9240b0a67a7e8992a0182799a58dc74a91574a86e22c67b4c088ca76db4ea3a525108f9e1549cd04e52f2036259e94e6736682106
SSDEEP 192:or7nEiaUN7fIa0e5GCQ+Qw8Zub4C4RgEDEIc7N:mnEiaUN7Qa0eYBw8ZubEjDEIc7N
TLSH
T16202572AF1F5DC33E532A9C79529EAD588F4739FAC9C1A445348831CBB90D32CC6A9D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 433B
SHA256 daceaa1b94feb948cf1d2c97180f4d39646eb1c90ad419706a8ca5046afd2f0c
MD5 32161ae0870eeb8f86d347299f472d12
SHA1 5ea52bc83a3b7ea06833c7370bd95d95c086f8a8
SHA512 350beef6e9f9b33b2cffb52b467304dbf62048dd632e12161e3a7418becb20b06d07c98404a06183869f0120d8eaf493c7880b8eb421509be9f37ae6a6ad793e
TLSH
T11FE0E59D61F48C53F42668C39642BAE24CF0F6CDECA42D94134C521C7341C32CE5AAF5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 8KB
SHA256 40b4c3cca8a1259d29f821b2720a298b0069f3aaadc73ca2b3f7cc15ffdddcec
MD5 ce5503f835cb755bf6fdd1a4eaee5ecb
SHA1 867a04120985cb32e31d5a9fa445e54930b4e81b
SHA512 3cc8dcb33232a0705f1ff5bd818f4f29c7810e466aa8a8216e9c1a039ae2cf318b407d3b7c7986fe0e38dff0a8b50fdb95b5091220b74fc828410a673d2dc368
SSDEEP 192:or7nEiaUN7fIa0e5GCQ+Qw8Zub4C4RgEDEIc7p:mnEiaUN7Qa0eYBw8ZubEjDEIc7p
TLSH
T17312582AF1F59C33E53299C79529EAD588F4739FAC9C1A445348831CBB90D32CC6E5D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 575B
SHA256 0e55192e0afb1af728ebfcd28e452762f6bd131726ef704ac23c16bdf535c34c
MD5 14fd01247e01404bd9842e7a61633d58
SHA1 c34bad2af9023a052099d62a66cf722963172907
SHA512 3cbb87a495c960544fbaf7bce0096115fddf5fd901e5d1fc852566f21006c4b9c22d60bfb9b0867d58f4963fe5596a946a94ead12117f84cb238e1a7c847dbf6
TLSH
T1B4F0F69D52F88C53F82569C3D645BAD248F0F68DFCA46D941348521C7311D32CD5AAE6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 10KB
SHA256 1181c72ba3533c548858c91617f8eb6ddd15a2b33193ee36814c0e22af342d20
MD5 c728e98b16557f234b58fefc97ca2a38
SHA1 adde266fb637a5776bcd3fbedd2094647c5a1067
SHA512 12f8c6967e2b6e5c3307184287301b6e08eb1b9936c84290cd48fedfd88ed302618d5c9fff020b2a3c8a7baea836e4bb9003c33abd7bc5278b0b0b1a0957180b
SSDEEP 192:or7nEiaUN7fIa0e5GCQ+Qw8Zub4C4RgEDEIc78GwodYa9:mnEiaUN7Qa0eYBw8ZubEjDEIc7/woP
TLSH
T14622582AF1F5DC33E532A9C7962AAAD548F8739FAC9C1A445348831CBB50D32CC6D5D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 10KB
SHA256 4de4e82b3046c398bc0fdc3ce11ee1e05aac4a7f601cf10a5040718ced176b70
MD5 49271b740ed588020df4b5d98d61463f
SHA1 559d28f454bfa28381a7362a067f2d4358f10483
SHA512 2a676d8874c573424bdcbfb91ec3972ef9fa6d583a55c0622432e7d7755e5d65d4c8f9311245f1ddc724646330ebc64835e1f998ba148521950f09bcef328721
SSDEEP 192:or7nEiaUN7fIa0e5GCQ+Qw8Zub4C4RgEDEIc78GwodYay3:mnEiaUN7Qa0eYBw8ZubEjDEIc7/woc3
TLSH
T18F32482AF1F5DC33E532A9C7962AAAD548F8739FAC9C1A445388821CBB50D32CC6D5D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 10KB
SHA256 a4cc7fbc1fb758c5fe4b26d5110b217c4083b2eeeab5b924c25dc25e8cf0cf81
MD5 f97b36d0c624583f5404c6e53c063a5b
SHA1 10e6a6a1cea7052240e832d83e132d0c67f79579
SHA512 3fd49ff0a94744368b6c374284698bba50f4e9c75caf83c10dd8c40e78dc34d98d3d17356c24b5b0e8baab9dbb9fa8663af59a1a4d80b86de887addfb6c028b0
SSDEEP 192:or7nEiaUN7fIa0e5GCQ+Qw8Zub4C4RgEDEIc78GwodYayz3VsK:mnEiaUN7Qa0eYBw8ZubEjDEIc7/woczl
TLSH
T11C32582AF1F5DC33E532A9C79629AAD548F8739FAC9C1A445348821CAB90D32CC6D5D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 4bb9e47cf4ffde52e1eb76699e9abb5a0b245d69734dcb3fe578720ff45bd88c
MD5 ba2166419f1cd55c3cdc4114816e2a81
SHA1 6c11da733d4cbc86891727e23ebdb649cdb3a819
SHA512 c54d858ab58616f32c54c4ad1990a9e18dd14d05b18e506411f2b3f9b0ae54755c0730d4a81a93420e7ebcb4ab8fea0ff6e099427f8c482fdc409e4152ef7d94
SSDEEP 384:mnEiaUN7Qa0eYBw8ZubEjDEIc7/woczFsaja:mnEiaWMajYBwn4jDEIYwoKFsga
TLSH
T13A42482AF1F5D833E532A9C79629FAD548F8739FBC9C1A445388821CAB90D32CC6D5D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 11KB
SHA256 9e4553dd81607bd053e13a34ca72387fcef807d8644fccc18d616dc3e3f5e7e7
MD5 3b9a2db993ea2296d382c8bc044e7080
SHA1 74dec15eb3f76242ec16b64996f880a095cf8320
SHA512 b3b92aba131d39f9a35f0d101081fb9eee429ba95a867ef526c73e7eca7419eb4e911c142dd939c519a09a6e52bc7f02cd02d9d0f8803f2aa35307b3d25d6557
SSDEEP 192:or7nEiaUN7fIa0e5GCQ+Qw8Zub4C4RgEDEIc78GwodYayz3Vsaj/Z5W:mnEiaUN7Qa0eYBw8ZubEjDEIc7/woczC
TLSH
T1BC42472AF1F5DC33E532A9C79629FAD548F8739FAC9C1A445388821CAB90D32CC6D5D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 664B
SHA256 636e7a2f562680025570036f345708778b3da9dcba3bb1f5c84c681299f0939e
MD5 d83cab43e4704ca36db1b16f25a53ebb
SHA1 0c4ecdc4e59fe18d83633a259db6cce8294cd74f
SHA512 a311d922ae4c3ebba45385556834b2c597e3ea0c26876cdc4ecc9addb17e7489a2ffcc60292f90e94594b92f741140fbf32f93ddff0b0e66481d7db4ac82e779
TLSH
T19901264941F98C13F82028C39241A9C248F0F68EFCA46E502348431C7311D32CD5A6E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 d4dfa7eccd0960c21d522729faa1d0a8ff09c7b82c4afc025bbf0f12826f3ebe
MD5 3ccb4ddafe50f7bb5f10f77fb7df656f
SHA1 5fc4e22fa9954afbc06c842f3f8359c5a6f31393
SHA512 001df12dce46d5dbe4855340bfb8eef84c7ec1d0ff84eb139c126f28dcc9999240754c5fa75fea87862179037561b8a2c609a6f60699cc2ae2a62e25e37a3673
SSDEEP 384:mnEiaUN7Qa0eYBw8ZubEjDEIc7/woczFsaj7Cl:mnEiaWMajYBwn4jDEIYwoKFsg7Cl
TLSH
T1BE52362AF1F5D833E532A9C79629FAD148F8739FBC8C5A445388821CAB94D32CC6D5D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 13KB
SHA256 8712b3b54ac25fd4c4c4606ae0dcf159d5de8357daaeeaaeefffe8f484cded52
MD5 2d214d973f284c24cf87809f4d180765
SHA1 9d6c2c2a3f6eb51fa3d4e8056eb9b8dbc94a02bb
SHA512 5ab78353c8b78957cebdbcf4aabdea21b848aadffbaf9ad757894c3deba2046f5c0e02e469ff0894d39125e3a97106a0660a6ce4567f6c3d34dc150806443497
SSDEEP 384:mnEiaUN7Qa0eYBw8ZubEjDEIc7/woczFsaj7CBpv:mnEiaWMajYBwn4jDEIYwoKFsg7CD
TLSH
T12E52372AF1F5DC73E532A9C79629FAD148F8739FAC8C1A445389821CAB90D32CC6D5D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 0d8436cb32a15857dfd2c761ffdaf861fc155a887fdb4b56acf4991f3f587b2f
MD5 421343077bcb83ad1cd6653d5ab9523d
SHA1 2192c498185cf02ffaefe669173b6fec2c422b7d
SHA512 2d6cd60867c2c68368daf201149e22eaa2934174ce53eb95fd053e211073fc6b8953c59577c52255d4ac9e3af0d5514158bbdfd13b48699cc32018eb07cebcd3
SSDEEP 384:mnEiaUN7Qa0eYBw8ZubEjDEIc7/woczFsaj7CBpQni:mnEiaWMajYBwn4jDEIYwoKFsg7Cci
TLSH
T10C52272AF1F5D833E53299C79629FAD588F8739FBC8C1A445388821CBB94D32CC695D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 872ee4714e035f7f0b80fbae3fb06dc2def12b09356d2208ce80160323d92a96
MD5 f7809cedc4e978fcecb6bbb3c900b1b3
SHA1 2147cebf1952be1be606bbd62cc9bede027b4e65
SHA512 f94c43fed4e0513c255fbcef4247d53591c3aabb7480c2d494a0933ff88d38545622368b2861a233d78823a98bd46c89fdfc8d9e095f173208dfbf84c38fe4c0
SSDEEP 384:mnEiaUN7Qa0eYBw8ZubEjDEIc7/woczFsaj7CBpQn1:mnEiaWMajYBwn4jDEIYwoKFsg7Cc1
TLSH
T10862272AF1F5D833E53299C79629FAD588F8739FBC8C1A445388821CBB94D32CC695D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d4bfe049cf947f8240b8a7520443449c54199f72118b65a3f71f952f19ba6250
MD5 921a0c4b1d2a9e2fedd0a2e69fd265fa
SHA1 fcbde14a80c70ac6f274c892f7c405567d751b88
SHA512 76c6081564e31a24e632fb09dca71b844378e7acdaa0ae954ac594194a38935e99d750b17f20795c068c2b006ce539a20b0008d6f82ca71e432eca312bb802ee
TLSH
T17C312719A1F5D823F5226CC79209AAD24CF0B3CFFC986E441348831CA710D31CC6AAE2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 409bee645181d48408fc28ea14603118b1184f7b0b3b26d838557c7f4e27289e
MD5 a0649d14d38d963aa51f90139a7952d7
SHA1 a2c979398155d8d35f345e34001107c4d23d60df
SHA512 31280df4328453aa4206b6415f3f21681a562c9b5d3d7b1953fb7fd76abfad826b66fd2505623855366ddafe1ab5a2672c39487a6c1c26baa7c2c96bbfab566b
TLSH
T1A141182AA1F5D873F52268CB9619AAD10CF0B3CFECD85E44134C831CA750D32CC6A9E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 b415dd19651471e4a1049a01996d946b313b1b1556435f010ac91a406335f020
MD5 d5bf7602c04ef7d05d8a6c54cdcd8164
SHA1 26ee99a92d7a5caefc6db9f9886a65651a703c79
SHA512 bdc3eb33b21f05cdc78f28d55126afdec05a134ff1f37e68718fc32de9b26c97054669d0ef8dbf2f67d4c81e7f58c1a8b8fff313441ae7d4b59e4eeb5055ec8d
TLSH
T13B41E72AB1F59863E522A8C79619AAE10CF4B3DFECCC5E44134D831CA754D32CC6A9E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 629c757d5bc465ae34111b0b8e8c7396dad1d8693b71adefa8b9d8831a60ff6e
MD5 00ee6f9406bdc8964f4ad2bba45970a3
SHA1 02d13e506700d3af577364c98af04c811a378f82
SHA512 9802c09668c7c19d6a1a8750547aa3739a903d99c624d38f2286bbb65c72cbacfe2b3acf5728acc4d306ade35f543505c62bcf6cefcd02255e0aa97ec591b79a
TLSH
T17841E52AB1F59873E52299C79619AAE10DF4B3DFECCC5E40134D831CA794D32CC6A9E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 1fd7a65b9aa4eb553ed86ad875d62966213626fab9197d9dede7472715b3b870
MD5 0f35005475be01f12f99e885888851d1
SHA1 eede54f62f0f746336e413e838f22709f4c87e98
SHA512 b11ca0ca7d4d862eceab3a40c99e908f812a214b4d13431e3048a1c20edc3eddc4f3df68b728a4a335d7b0fdd544c9046b9967401eee315f52e9efa122edd345
TLSH
T13C51F729B1F59863E52399C79619AAE14CF4B3DFECCC5E40134D831CA794D31CC6A9E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 cbc96b2465ec69a38b4aea4bb733ad57651d73411576b5af3fda5a92fb00e000
MD5 1d0dcdb12685213d64c2979a4e5bc654
SHA1 5e55cc0a462cc7592b63e0ec98279d427ff800be
SHA512 f3adf81d6a506b58006f1ffa4d035f4ae82572ded76d6ef660fdf0135c1b7bfcb6e951ce2de2905f01a523b19eb9f6ed3cf81660efddf5ab605be842594bbfdd
TLSH
T1B7613729F1F5D873F523A8C79219A9D24DF4B38FEC885E441349831CA790D32CC6AAE1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 fb50072e03622c2db4c24a782aa1c71d25354b502917ab7a3f2b091e0333b6f3
MD5 60f5737f4e7eb7c7e87bf497daeab5b0
SHA1 0b113fc311268cc7ab3a90c776b02c7abf22e507
SHA512 5424f15b92e50e9d35fc2cbbc925497a56ed27e54a354990978078e4c9f53579bafcc6fbaf268e8c99738778da479df95e90312b737f3de0c051fbc9795ad327
TLSH
T173712829F1F59873E523ACC79619E9E14CF4B39FEC8C5A441349831CA794D32CC6A9E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/876-150-0x00000000001C0000-0x00000000001E2000-memory.dmp

Download

memory/876-70-0x00000000001C0000-0x00000000001E2000-memory.dmp

Download

memory/912-155-0x0000000000070000-0x0000000000092000-memory.dmp

Download

memory/912-266-0x0000000000070000-0x0000000000092000-memory.dmp

Download

memory/1020-645-0x0000000000980000-0x00000000009A2000-memory.dmp

Download

memory/1184-512-0x0000000000AC0000-0x0000000000AE2000-memory.dmp

Download

memory/1216-341-0x0000000000AE0000-0x0000000000B02000-memory.dmp

Download

memory/1216-462-0x0000000000AE0000-0x0000000000B02000-memory.dmp

Download

memory/1932-372-0x0000000000840000-0x0000000000862000-memory.dmp

Download

memory/1932-644-0x0000000000840000-0x0000000000862000-memory.dmp

Download

memory/2000-316-0x0000000000AA0000-0x0000000000AC2000-memory.dmp

Download

memory/2000-159-0x0000000000AA0000-0x0000000000AC2000-memory.dmp

Download

memory/2588-120-0x0000000000010000-0x0000000000032000-memory.dmp

Download

memory/2588-68-0x0000000000010000-0x0000000000032000-memory.dmp

Download

memory/2624-686-0x0000000000780000-0x00000000007A2000-memory.dmp

Download

memory/2708-473-0x00000000002D0000-0x00000000002F2000-memory.dmp

Download

memory/2884-250-0x00000000009C0000-0x00000000009E2000-memory.dmp

Download

memory/2884-361-0x00000000009C0000-0x00000000009E2000-memory.dmp

Download

memory/2908-646-0x0000000000980000-0x00000000009A2000-memory.dmp

Download

memory/2984-700-0x0000000000180000-0x00000000001A2000-memory.dmp

Download

memory/3132-371-0x0000000000840000-0x0000000000862000-memory.dmp

Download

memory/3132-643-0x0000000000840000-0x0000000000862000-memory.dmp

Download

memory/3180-735-0x0000000000180000-0x00000000001A2000-memory.dmp

Download

memory/3424-249-0x00000000009C0000-0x00000000009E2000-memory.dmp

Download

memory/3424-360-0x00000000009C0000-0x00000000009E2000-memory.dmp

Download

memory/3732-526-0x00000000004D0000-0x00000000004F2000-memory.dmp

Download

memory/3732-370-0x00000000004D0000-0x00000000004F2000-memory.dmp

Download

memory/4120-11-0x0000000000D10000-0x0000000000D32000-memory.dmp

Download

memory/4152-66-0x0000000000FC0000-0x0000000000FE2000-memory.dmp

Download

memory/4152-13-0x0000000000FC0000-0x0000000000FE2000-memory.dmp

Download

memory/4168-195-0x00000000009A0000-0x00000000009C2000-memory.dmp

Download

memory/4168-153-0x00000000009A0000-0x00000000009C2000-memory.dmp

Download

memory/4192-265-0x0000000000070000-0x0000000000092000-memory.dmp

Download

memory/4192-154-0x0000000000070000-0x0000000000092000-memory.dmp

Download

memory/4316-364-0x0000000000E90000-0x0000000000EB2000-memory.dmp

Download

memory/4316-471-0x0000000000E90000-0x0000000000EB2000-memory.dmp

Download

memory/4452-340-0x0000000000AE0000-0x0000000000B02000-memory.dmp

Download

memory/4452-461-0x0000000000AE0000-0x0000000000B02000-memory.dmp

Download

memory/4640-365-0x0000000000E90000-0x0000000000EB2000-memory.dmp

Download

memory/4640-472-0x0000000000E90000-0x0000000000EB2000-memory.dmp

Download

memory/4688-260-0x0000000000760000-0x0000000000782000-memory.dmp

Download

memory/4688-363-0x0000000000760000-0x0000000000782000-memory.dmp

Download

memory/4816-362-0x0000000000760000-0x0000000000782000-memory.dmp

Download

memory/4816-259-0x0000000000760000-0x0000000000782000-memory.dmp

Download

memory/4876-152-0x00000000009A0000-0x00000000009C2000-memory.dmp

Download

memory/4876-194-0x00000000009A0000-0x00000000009C2000-memory.dmp

Download

memory/4948-687-0x0000000000780000-0x00000000007A2000-memory.dmp

Download

memory/5360-49-0x0000000000FC0000-0x0000000000FE2000-memory.dmp

Download

memory/5360-12-0x0000000000FC0000-0x0000000000FE2000-memory.dmp

Download

memory/5404-750-0x00000000007A0000-0x00000000007C2000-memory.dmp

Download

memory/5440-474-0x00000000002D0000-0x00000000002F2000-memory.dmp

Download

memory/5456-513-0x0000000000AC0000-0x0000000000AE2000-memory.dmp

Download

memory/5648-749-0x00000000007A0000-0x00000000007C2000-memory.dmp

Download

memory/5780-267-0x0000000000AA0000-0x0000000000AC2000-memory.dmp

Download

memory/5780-158-0x0000000000AA0000-0x0000000000AC2000-memory.dmp

Download

memory/5916-69-0x00000000001C0000-0x00000000001E2000-memory.dmp

Download

memory/5916-123-0x00000000001C0000-0x00000000001E2000-memory.dmp

Download

memory/6100-369-0x00000000004D0000-0x00000000004F2000-memory.dmp

Download

memory/6100-525-0x00000000004D0000-0x00000000004F2000-memory.dmp

Download

memory/6328-779-0x0000000000AE0000-0x0000000000B02000-memory.dmp

Download

memory/6332-780-0x0000000000AE0000-0x0000000000B02000-memory.dmp

Download

memory/6580-805-0x0000000000960000-0x0000000000982000-memory.dmp

Download

memory/6588-806-0x0000000000960000-0x0000000000982000-memory.dmp

Download

memory/6988-833-0x0000000000120000-0x0000000000142000-memory.dmp

Download