abce3098723f7ea784e071b47597c2ecd1356ec7a570a7b1756c061ab8a39be0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe
Size 7.5MB
Sample260729-ssvcaaae88
SHA256 abce3098723f7ea784e071b47597c2ecd1356ec7a570a7b1756c061ab8a39be0
MD5 b71e3b9e2168fefa5d4d35ea63be5e9b
SHA1 22e3b974a904886ab0fc08246267db16dd5c330f
SHA512 9a8a57fe1b4b48df464f2a6c64e0849e3d8a74b3e8f34bb30348ca8008a3b1fcb6aa3212f938199eb1d35d6e16bd2c67eacc3df0935dde07acdfc18a49c747cd
SSDEEP 49152:PbE2kZAW2ROQcverO04TcbE2kZAW2ROQcverO04TcbE2kZAW2ROQcverO04TcbEm:b4Tk4Tk4Tk4Tk4Tk4Tk4Ti
TLSH
T11F862A1263EC115CF1F71B72EE39A552A97AFCEE7E12E51E0455340E20B2B14CA6A337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral1/files/0x000300000001e6ee-11.dat	INDICATOR_EXE_Packed_Fody

Creates a file in the Startup directory 1 TTPs 3 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 27 IoCs

pid	Process
5036	svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe
440	svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe
2500	svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe
4920	svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe
4540	svchost_AABAACBCACCBBBBAABABCCACBCCBACCCBBCAAABABABCCACAAAACBCB.exe
3412	svchost_BCCAACBBCCBCCBBBACCAABCCCBBCAAACBCCBCCBAACBCCACAABBCCAC.exe
4240	svchost_CBAAABCBCCABAAABABCCCCBABBBBBABBCAACACCBACCBBCAACBCCAAC.exe
1740	svchost_AABAAABCBCACABBCBCABBAACCCBACCACBBAABBABBAACAABCBBAACBC.exe
3504	svchost_BCBACABBBBCCCCAACAAACBBBCBBCBABAACCBABCBCABAACABACBBBAA.exe
2208	svchost_AAAACBBBCABBAABBBACACACCBACBBAAAAABABABABBAAACCBBBBACAC.exe
4056	svchost_ABCCACCBBAAABAAABBCCCBBAABCCCCACBBCCCCCBCBBCABBCCCBCBBB.exe
4368	svchost_CAABABBABACCCCCCCCABBCABCCBCBABCCBBBCBBBBCBCAACABCCBABC.exe
2484	svchost_BCCBCACCBCBCBACAAAABCCAAAAAACACAACBBCCBACBACCBBBAAAABBA.exe
2904	svchost_BAACBBBCCBBBBAACBCCBBBCCACABCCAAAACCBCBBCAACABACCCCCCCB.exe
1260	svchost_BCABBBBABCACABCCCCCACCCACCACACCACBCBACBACCABCCBBBCACAAB.exe
176	svchost_BABAABBBBACBCCBBABCBAABBCCBCABBACCBCBBCCCABBBBACABCCCCB.exe
1320	svchost_CCABCACCCAACAAACCCACBBAAACBBCBBCAACBABCACAAABABCBACAAAA.exe
4372	svchost_AAACBBCCCBAAABCABBCBBBACBAAAABACBABABCBBACBACBCBCCBBCBB.exe
4172	svchost_CBABCCBBCBCCCCCBBBAACAABCABCCABBBBBBAACACCAAABACBBCBBAC.exe
4948	svchost_ACCAABCACCBBCCBCBBCBBCBCCCBACCBBBABBBBABBBABAABAABBAABB.exe
4804	svchost_ABCAABCAAABBBCAACBCCAAAABABCABCCBABBBAAACAABBBACBBCBACC.exe
3552	svchost_BBCAACCABAAABBBACBBCCABCCCAACCBCCBBACAABBCCBBBABCBBBCBC.exe
4596	svchost_AABABBAAAAAACCBACBABBABACACBBCBABBCAACBCBCBABBBCAABBAAC.exe
1312	svchost_ABABAABBAAAABBACBACBCACACBACCABACAACBCAACCCAAACBCBCBCCC.exe
3464	svchost_ABABAABBAAAABBACBACBCACACBACCABACAACBCAACCCAAACBCBCBCCC.exe
3908	svchost_ABAACCCCBABBBCCCBCBAACBACCACBCBCCABBAACBCAABBBACCABABCB.exe
3976	svchost_ACACCCBAABAAAAACACABCBCABCAACBACACCCBCABCBAACACCCBBCACC.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCAAACCAACCCBBABAABAABCCCCCBACBAABBBCCCBAAABAAABCCABCCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe"	2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe"	svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBBBAAABAABBACABBCACBBABABCBBBACAACACABACCCBACBACBAACAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAAABCBCCABAAABABCCCCBABBBBBABBCAACACCBACCBBCAACBCCAAC.exe"	svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe

Launches sc.exe 48 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2000	sc.exe
1800	sc.exe
4640	sc.exe
2968	sc.exe
1412	sc.exe
5012	sc.exe
1100	sc.exe
700	sc.exe
5052	sc.exe
4856	sc.exe
1244	sc.exe
3476	sc.exe
4156	sc.exe
1252	sc.exe
4236	sc.exe
4304	sc.exe
2492	sc.exe
2580	sc.exe
2132	sc.exe
3000	sc.exe
2376	sc.exe
460	sc.exe
1516	sc.exe
1392	sc.exe
4928	sc.exe
3368	sc.exe
1420	sc.exe
4792	sc.exe
5004	sc.exe
1412	sc.exe
2272	sc.exe
3296	sc.exe
1860	sc.exe
4144	sc.exe
1320	sc.exe
1916	sc.exe
1796	sc.exe
4280	sc.exe
3652	sc.exe
4836	sc.exe
2676	sc.exe
1560	sc.exe
2052	sc.exe
4656	sc.exe
1420	sc.exe
1220	sc.exe
1220	sc.exe
4140	sc.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1300	cmd.exe
1448	cmd.exe
1424	cmd.exe
3964	cmd.exe
4684	cmd.exe
744	cmd.exe
3940	cmd.exe
3884	cmd.exe
4024	cmd.exe
4128	cmd.exe
4980	cmd.exe
312	cmd.exe
1752	cmd.exe
1720	cmd.exe
4720	cmd.exe
116	cmd.exe
4484	cmd.exe
2328	cmd.exe
3324	cmd.exe
4112	cmd.exe
4644	cmd.exe
460	cmd.exe
3912	cmd.exe
3276	cmd.exe
3596	cmd.exe
2104	cmd.exe
3952	cmd.exe
1396	cmd.exe
3760	cmd.exe
4716	cmd.exe
4896	cmd.exe
4756	cmd.exe
5068	cmd.exe
2608	cmd.exe
1668	cmd.exe
4632	cmd.exe
2652	cmd.exe
2228	cmd.exe
640	cmd.exe
1704	cmd.exe
4420	cmd.exe
3720	cmd.exe
416	cmd.exe
4668	cmd.exe
536	cmd.exe
3296	cmd.exe
2516	cmd.exe
4708	cmd.exe
2216	cmd.exe
4624	cmd.exe
3020	cmd.exe
3688	cmd.exe
820	cmd.exe
4816	cmd.exe
2536	cmd.exe
3536	cmd.exe
2212	cmd.exe
596	cmd.exe
3680	cmd.exe
3292	cmd.exe
3240	cmd.exe
4884	cmd.exe
656	cmd.exe
4888	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABAACBCACCBBBBAABABCCACBCCBACCCBBCAAABABABCCACAAAACBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABBBBABCACABCCCCCACCCACCACACCACBCBACBACCABCCBBBCACAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACBBBCCBBBBAACBCCBBBCCACABCCAAAACCBCBBCAACABACCCCCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACBBCCCBAAABCABBCBBBACBAAAABACBABABCBBACBACBCBCCBBCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBCACCBCBCBACAAAABCCAAAAAACACAACBBCCBACBACCBBBAAAABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCAACCABAAABBBACBBCCABCCCAACCBCCBBACAABBCCBBBABCBBBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAAABCBCCABAAABABCCCCBABBBBBABBCAACACCBACCBBCAACBCCAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBACABBBBCCCCAACAAACBBBCBBCBABAACCBABCBCABAACABACBBBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABCACCCAACAAACCCACBBAAACBBCBBCAACBABCACAAABABCBACAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3548	schtasks.exe
1144	schtasks.exe
2392	schtasks.exe
2208	schtasks.exe
2420	schtasks.exe
5004	schtasks.exe
4236	schtasks.exe
2528	schtasks.exe
4800	schtasks.exe
3976	schtasks.exe
1224	schtasks.exe
2212	schtasks.exe
3500	schtasks.exe
4500	schtasks.exe
3444	schtasks.exe
3800	schtasks.exe
4484	schtasks.exe
2464	schtasks.exe
3004	schtasks.exe
4904	schtasks.exe
2376	schtasks.exe
4768	schtasks.exe
3444	schtasks.exe
1712	schtasks.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
388	2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe
388	2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe
5036	svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe
5036	svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe
440	svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe
440	svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe
2500	svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe
2500	svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe
4920	svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe
4920	svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe
388	2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe
388	2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe
4540	svchost_AABAACBCACCBBBBAABABCCACBCCBACCCBBCAAABABABCCACAAAACBCB.exe
4540	svchost_AABAACBCACCBBBBAABABCCACBCCBACCCBBCAAABABABCCACAAAACBCB.exe
3412	svchost_BCCAACBBCCBCCBBBACCAABCCCBBCAAACBCCBCCBAACBCCACAABBCCAC.exe
3412	svchost_BCCAACBBCCBCCBBBACCAABCCCBBCAAACBCCBCCBAACBCCACAABBCCAC.exe
5036	svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe
5036	svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe
4240	svchost_CBAAABCBCCABAAABABCCCCBABBBBBABBCAACACCBACCBBCAACBCCAAC.exe
4240	svchost_CBAAABCBCCABAAABABCCCCBABBBBBABBCAACACCBACCBBCAACBCCAAC.exe
2500	svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe
2500	svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe
1740	svchost_AABAAABCBCACABBCBCABBAACCCBACCACBBAABBABBAACAABCBBAACBC.exe
1740	svchost_AABAAABCBCACABBCBCABBAACCCBACCACBBAABBABBAACAABCBBAACBC.exe
2208	svchost_AAAACBBBCABBAABBBACACACCBACBBAAAAABABABABBAAACCBBBBACAC.exe
2208	svchost_AAAACBBBCABBAABBBACACACCBACBBAAAAABABABABBAAACCBBBBACAC.exe
3504	svchost_BCBACABBBBCCCCAACAAACBBBCBBCBABAACCBABCBCABAACABACBBBAA.exe
3504	svchost_BCBACABBBBCCCCAACAAACBBBCBBCBABAACCBABCBCABAACABACBBBAA.exe
4056	svchost_ABCCACCBBAAABAAABBCCCBBAABCCCCACBBCCCCCBCBBCABBCCCBCBBB.exe
4056	svchost_ABCCACCBBAAABAAABBCCCBBAABCCCCACBBCCCCCBCBBCABBCCCBCBBB.exe
4368	svchost_CAABABBABACCCCCCCCABBCABCCBCBABCCBBBCBBBBCBCAACABCCBABC.exe
4368	svchost_CAABABBABACCCCCCCCABBCABCCBCBABCCBBBCBBBBCBCAACABCCBABC.exe
2484	svchost_BCCBCACCBCBCBACAAAABCCAAAAAACACAACBBCCBACBACCBBBAAAABBA.exe
2484	svchost_BCCBCACCBCBCBACAAAABCCAAAAAACACAACBBCCBACBACCBBBAAAABBA.exe
1260	svchost_BCABBBBABCACABCCCCCACCCACCACACCACBCBACBACCABCCBBBCACAAB.exe
1260	svchost_BCABBBBABCACABCCCCCACCCACCACACCACBCBACBACCABCCBBBCACAAB.exe
2904	svchost_BAACBBBCCBBBBAACBCCBBBCCACABCCAAAACCBCBBCAACABACCCCCCCB.exe
2904	svchost_BAACBBBCCBBBBAACBCCBBBCCACABCCAAAACCBCBBCAACABACCCCCCCB.exe
1320	svchost_CCABCACCCAACAAACCCACBBAAACBBCBBCAACBABCACAAABABCBACAAAA.exe
1320	svchost_CCABCACCCAACAAACCCACBBAAACBBCBBCAACBABCACAAABABCBACAAAA.exe
176	svchost_BABAABBBBACBCCBBABCBAABBCCBCABBACCBCBBCCCABBBBACABCCCCB.exe
176	svchost_BABAABBBBACBCCBBABCBAABBCCBCABBACCBCBBCCCABBBBACABCCCCB.exe
4172	svchost_CBABCCBBCBCCCCCBBBAACAABCABCCABBBBBBAACACCAAABACBBCBBAC.exe
4172	svchost_CBABCCBBCBCCCCCBBBAACAABCABCCABBBBBBAACACCAAABACBBCBBAC.exe
4948	svchost_ACCAABCACCBBCCBCBBCBBCBCCCBACCBBBABBBBABBBABAABAABBAABB.exe
4948	svchost_ACCAABCACCBBCCBCBBCBBCBCCCBACCBBBABBBBABBBABAABAABBAABB.exe
3552	svchost_BBCAACCABAAABBBACBBCCABCCCAACCBCCBBACAABBCCBBBABCBBBCBC.exe
3552	svchost_BBCAACCABAAABBBACBBCCABCCCAACCBCCBBACAABBCCBBBABCBBBCBC.exe
4372	svchost_AAACBBCCCBAAABCABBCBBBACBAAAABACBABABCBBACBACBCBCCBBCBB.exe
4372	svchost_AAACBBCCCBAAABCABBCBBBACBAAAABACBABABCBBACBACBCBCCBBCBB.exe
4596	svchost_AABABBAAAAAACCBACBABBABACACBBCBABBCAACBCBCBABBBCAABBAAC.exe
4596	svchost_AABABBAAAAAACCBACBABBABACACBBCBABBCAACBCBCBABBBCAABBAAC.exe
4804	svchost_ABCAABCAAABBBCAACBCCAAAABABCABCCBABBBAAACAABBBACBBCBACC.exe
4804	svchost_ABCAABCAAABBBCAACBCCAAAABABCABCCBABBBAAACAABBBACBBCBACC.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	388	2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe
Token: SeDebugPrivilege	5036	svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe
Token: SeDebugPrivilege	440	svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe
Token: SeDebugPrivilege	2500	svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe
Token: SeDebugPrivilege	4920	svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe
Token: SeDebugPrivilege	4540	svchost_AABAACBCACCBBBBAABABCCACBCCBACCCBBCAAABABABCCACAAAACBCB.exe
Token: SeDebugPrivilege	3412	svchost_BCCAACBBCCBCCBBBACCAABCCCBBCAAACBCCBCCBAACBCCACAABBCCAC.exe
Token: SeDebugPrivilege	4240	svchost_CBAAABCBCCABAAABABCCCCBABBBBBABBCAACACCBACCBBCAACBCCAAC.exe
Token: SeDebugPrivilege	1740	svchost_AABAAABCBCACABBCBCABBAACCCBACCACBBAABBABBAACAABCBBAACBC.exe
Token: SeDebugPrivilege	2208	svchost_AAAACBBBCABBAABBBACACACCBACBBAAAAABABABABBAAACCBBBBACAC.exe
Token: SeDebugPrivilege	3504	svchost_BCBACABBBBCCCCAACAAACBBBCBBCBABAACCBABCBCABAACABACBBBAA.exe
Token: SeDebugPrivilege	4056	svchost_ABCCACCBBAAABAAABBCCCBBAABCCCCACBBCCCCCBCBBCABBCCCBCBBB.exe
Token: SeDebugPrivilege	4368	svchost_CAABABBABACCCCCCCCABBCABCCBCBABCCBBBCBBBBCBCAACABCCBABC.exe
Token: SeDebugPrivilege	2484	svchost_BCCBCACCBCBCBACAAAABCCAAAAAACACAACBBCCBACBACCBBBAAAABBA.exe
Token: SeDebugPrivilege	1260	svchost_BCABBBBABCACABCCCCCACCCACCACACCACBCBACBACCABCCBBBCACAAB.exe
Token: SeDebugPrivilege	2904	svchost_BAACBBBCCBBBBAACBCCBBBCCACABCCAAAACCBCBBCAACABACCCCCCCB.exe
Token: SeDebugPrivilege	1320	svchost_CCABCACCCAACAAACCCACBBAAACBBCBBCAACBABCACAAABABCBACAAAA.exe
Token: SeDebugPrivilege	176	svchost_BABAABBBBACBCCBBABCBAABBCCBCABBACCBCBBCCCABBBBACABCCCCB.exe
Token: SeDebugPrivilege	4172	svchost_CBABCCBBCBCCCCCBBBAACAABCABCCABBBBBBAACACCAAABACBBCBBAC.exe
Token: SeDebugPrivilege	4948	svchost_ACCAABCACCBBCCBCBBCBBCBCCCBACCBBBABBBBABBBABAABAABBAABB.exe
Token: SeDebugPrivilege	3552	svchost_BBCAACCABAAABBBACBBCCABCCCAACCBCCBBACAABBCCBBBABCBBBCBC.exe
Token: SeDebugPrivilege	4372	svchost_AAACBBCCCBAAABCABBCBBBACBAAAABACBABABCBBACBACBCBCCBBCBB.exe
Token: SeDebugPrivilege	4596	svchost_AABABBAAAAAACCBACBABBABACACBBCBABBCAACBCBCBABBBCAABBAAC.exe
Token: SeDebugPrivilege	4804	svchost_ABCAABCAAABBBCAACBCCAAAABABCABCCBABBBAAACAABBBACBBCBACC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 744	388	2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe	88
PID 744 wrote to memory of 2208	744	cmd.exe	90
PID 388 wrote to memory of 624	388	2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe	92
PID 624 wrote to memory of 4280	624	cmd.exe	95
PID 388 wrote to memory of 4888	388	2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe	96
PID 4888 wrote to memory of 2376	4888	cmd.exe	98
PID 5036 wrote to memory of 984	5036	svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe	100
PID 984 wrote to memory of 3800	984	cmd.exe	102
PID 5036 wrote to memory of 596	5036	svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe	103
PID 596 wrote to memory of 3652	596	cmd.exe	105
PID 5036 wrote to memory of 3276	5036	svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe	107
PID 3276 wrote to memory of 1860	3276	cmd.exe	110
PID 440 wrote to memory of 4420	440	svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe	112
PID 4420 wrote to memory of 4484	4420	cmd.exe	114
PID 2500 wrote to memory of 3688	2500	svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe	115
PID 440 wrote to memory of 2516	440	svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe	117
PID 4920 wrote to memory of 1424	4920	svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe	119
PID 3688 wrote to memory of 2464	3688	cmd.exe	121
PID 2516 wrote to memory of 4836	2516	cmd.exe	122
PID 1424 wrote to memory of 3004	1424	cmd.exe	123
PID 440 wrote to memory of 3292	440	svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe	124
PID 2500 wrote to memory of 820	2500	svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe	126
PID 4920 wrote to memory of 4716	4920	svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe	128
PID 3292 wrote to memory of 3368	3292	cmd.exe	130
PID 4716 wrote to memory of 1420	4716	cmd.exe	132
PID 820 wrote to memory of 1220	820	cmd.exe	133
PID 2500 wrote to memory of 3240	2500	svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe	134
PID 4920 wrote to memory of 4632	4920	svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe	136
PID 4632 wrote to memory of 1244	4632	cmd.exe	140
PID 3240 wrote to memory of 4792	3240	cmd.exe	142
PID 4540 wrote to memory of 3964	4540	svchost_AABAACBCACCBBBBAABABCCACBCCBACCCBBCAAABABABCCACAAAACBCB.exe	147
PID 3964 wrote to memory of 4904	3964	cmd.exe	149
PID 4540 wrote to memory of 4884	4540	svchost_AABAACBCACCBBBBAABABCCACBCCBACCCBBCAAABABABCCACAAAACBCB.exe	150
PID 4884 wrote to memory of 2676	4884	cmd.exe	152
PID 4540 wrote to memory of 4720	4540	svchost_AABAACBCACCBBBBAABABCCACBCCBACCCBBCAAABABABCCACAAAACBCB.exe	153
PID 4720 wrote to memory of 4304	4720	cmd.exe	155
PID 3412 wrote to memory of 4484	3412	svchost_BCCAACBBCCBCCBBBACCAABCCCBBCAAACBCCBCCBAACBCCACAABBCCAC.exe	157
PID 4484 wrote to memory of 2420	4484	cmd.exe	159
PID 3412 wrote to memory of 2328	3412	svchost_BCCAACBBCCBCCBBBACCAABCCCBBCAAACBCCBCCBAACBCCACAABBCCAC.exe	160
PID 2328 wrote to memory of 4928	2328	cmd.exe	162
PID 3412 wrote to memory of 3596	3412	svchost_BCCAACBBCCBCCBBBACCAABCCCBBCAAACBCCBCCBAACBCCACAABBCCAC.exe	163
PID 3596 wrote to memory of 3476	3596	cmd.exe	165
PID 4240 wrote to memory of 4408	4240	svchost_CBAAABCBCCABAAABABCCCCBABBBBBABBCAACACCBACCBBCAACBCCAAC.exe	167
PID 4408 wrote to memory of 5004	4408	cmd.exe	169
PID 4240 wrote to memory of 4816	4240	svchost_CBAAABCBCCABAAABABCCCCBABBBBBABBCAACACCBACCBBCAACBCCAAC.exe	171
PID 4816 wrote to memory of 4144	4816	cmd.exe	173
PID 4240 wrote to memory of 4896	4240	svchost_CBAAABCBCCABAAABABCCCCBABBBBBABBCAACACCBACCBBCAACBCCAAC.exe	174
PID 4896 wrote to memory of 1320	4896	cmd.exe	176
PID 1740 wrote to memory of 116	1740	svchost_AABAAABCBCACABBCBCABBAACCCBACCACBBAABBABBAACAABCBBAACBC.exe	186
PID 116 wrote to memory of 2212	116	cmd.exe	188
PID 1740 wrote to memory of 2652	1740	svchost_AABAAABCBCACABBCBCABBAACCCBACCACBBAABBABBAACAABCBBAACBC.exe	189
PID 2652 wrote to memory of 2968	2652	cmd.exe	191
PID 1740 wrote to memory of 2104	1740	svchost_AABAAABCBCACABBCBCABBAACCCBACCACBBAABBABBAACAABCBBAACBC.exe	192
PID 2104 wrote to memory of 5004	2104	cmd.exe	194
PID 2208 wrote to memory of 1448	2208	svchost_AAAACBBBCABBAABBBACACACCBACBBAAAAABABABABBAAACCBBBBACAC.exe	196
PID 1448 wrote to memory of 3500	1448	cmd.exe	198
PID 2208 wrote to memory of 4756	2208	svchost_AAAACBBBCABBAABBBACACACCBACBBAAAAABABABABBAAACCBBBBACAC.exe	199
PID 4756 wrote to memory of 1560	4756	cmd.exe	201
PID 2208 wrote to memory of 2228	2208	svchost_AAAACBBBCABBAABBBACACACCBACBBAAAAABABABABBAAACCBBBBACAC.exe	202
PID 2228 wrote to memory of 2052	2228	cmd.exe	204
PID 3504 wrote to memory of 3720	3504	svchost_BCBACABBBBCCCCAACAAACBBBCBBCBABAACCBABCBCABAACABACBBBAA.exe	206
PID 3720 wrote to memory of 4236	3720	cmd.exe	208
PID 3504 wrote to memory of 416	3504	svchost_BCBACABBBBCCCCAACAAACBBBCBBCBABAACCBABCBCABAACABACBBBAA.exe	209
PID 416 wrote to memory of 1412	416	cmd.exe	211

C:\Users\Admin\AppData\Local\Temp\2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAAACCAACCCBBABAABAABCCCCCBACBAABBBCCCBAAABAAABCCABCCABBCCBACCBCAABAABCBCCCACAAACCAABCACBBAABCBCCABCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAAACCAACCCBBABAABAABCCCCCBACBAABBBCCCBAAABAAABCCABCCABBCCBACCBCAABAABCBCCCACAAACCAABCACBBAABCBCCABCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCBAACBBABCCCCABBBBABABBBCAABBBBACCCCBCCCCACBAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe" start= auto displayName= "UserDataSvc_CBCCBAACBBABCCCCABBBBABABBBCAABBBBACCCCBCCCCACBAACA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCBAACBBABCCCCABBBBABABBBCAABBBBACCCCBCCCCACBAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe" start= auto displayName= "UserDataSvc_CBCCBAACBBABCCCCABBBBABABBBCAABBBBACCCCBCCCCACBAACA"
    3⤵
    - Launches sc.exe
    PID:4280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCBAACBBABCCCCABBBBABABBBCAABBBBACCCCBCCCCACBAACA"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCCBAACBBABCCCCABBBBABABBBCAABBBBACCCCBCCCCACBAACA"
    3⤵
    - Launches sc.exe
    PID:2376

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCBACCAABABBBCAACBCBCBBCBBBBBCABBCCBCCBACCCACABCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCBACCAABABBBCAACBCBCBBCBBBBBCABBCCBCCBACCCACABCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBBCCBACABBAABACABAACACABABBBCBCCBCABCCAABABBAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe" start= auto displayName= "UserDataSvc_CCBBBCCBACABBAABACABAACACABABBBCBCCBCABCCAABABBAAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:596
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBBCCBACABBAABACABAACACABABBBCBCCBCABCCAABABBAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe" start= auto displayName= "UserDataSvc_CCBBBCCBACABBAABACABAACACABABBBCBCCBCABCCAABABBAAAB"
    3⤵
    - Launches sc.exe
    PID:3652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBBCCBACABBAABACABAACACABABBBCBCCBCABCCAABABBAAAB"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBBCCBACABBAABACABAACACABABBBCBCCBCABCCAABABBAAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1860

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCABBBAABAABCAAABBACBBACBBBABBBBABCCABBBAAABACAABBACBCAABAACCCCBBBBBABBACCBAAABBCCBAABCCAACBBBCCABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBCACCBBBBAABABCCACBCCBACCCBBCAAABABABCCACAAAACBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCABBBAABAABCAAABBACBBACBBBABBBBABCCABBBAAABACAABBACBCAABAACCCCBBBBBABBACCBAAABBCCBAABCCAACBBBCCABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBCACCBBBBAABABCCACBCCBACCCBBCAAABABABCCACAAAACBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACBCCAAAACBCABBCBCBCACABBCCBBCAACBCBBBACBCABBAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBCACCBBBBAABABCCACBCCBACCCBBCAAABABABCCACAAAACBCB.exe" start= auto displayName= "UserDataSvc_CCACBCCAAAACBCABBCBCBCACABBCCBBCAACBCBBBACBCABBAABA"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCACBCCAAAACBCABBCBCBCACABBCCBBCAACBCBBBACBCABBAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBCACCBBBBAABABCCACBCCBACCCBBCAAABABABCCACAAAACBCB.exe" start= auto displayName= "UserDataSvc_CCACBCCAAAACBCABBCBCBCACABBCCBBCAACBCBBBACBCABBAABA"
    3⤵
    - Launches sc.exe
    PID:4836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACBCCAAAACBCABBCBCBCACABBCCBBCAACBCBBBACBCABBAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCACBCCAAAACBCABBCBCBCACABBCCBBCAACBCBBBACBCABBAABA"
    3⤵
    - Launches sc.exe
    PID:3368

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBAAABAABBACABBCACBBABABCBBBACAACACABACCCBACBACBAACAABBACAAABCAABBBBABBBCABBBCBCBACBBACACBBBACBACACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABCBCCABAAABABCCCCBABBBBBABBCAACACCBACCBBCAACBCCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBAAABAABBACABBCACBBABABCBBBACAACACABACCCBACBACBAACAABBACAAABCAABBBBABBBCABBBCBCBACBBACACBBBACBACACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABCBCCABAAABABCCCCBABBBBBABBCAACACCBACCBBCAACBCCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABACACABABBCABCBABCAABCCAACACBACBBCAABABCBBBBBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABCBCCABAAABABCCCCBABBBBBABBCAACACCBACCBBCAACBCCAAC.exe" start= auto displayName= "UserDataSvc_AAABACACABABBCABCBABCAABCCAACACBACBBCAABABCBBBBBACA"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABACACABABBCABCBABCAABCCAACACBACBBCAABABCBBBBBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABCBCCABAAABABCCCCBABBBBBABBCAACACCBACCBBCAACBCCAAC.exe" start= auto displayName= "UserDataSvc_AAABACACABABBCABCBABCAABCCAACACBACBBCAABABCBBBBBACA"
    3⤵
    - Launches sc.exe
    PID:1220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABACACABABBCABCBABCAABCCAACACBACBBCAABABCBBBBBACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABACACABABBCABCBABCAABCCAACACBACBBCAABABCBBBBBACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4792

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAACAAAABABBCACBCACAAAACBCCABABCACCCCAACBBCCBAAAABCB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCCABABBCCACABAABAABAAACAABCAABACBABBAABBBAAACCAABAABBACBAABCABBACBBAAABCBCCCBCCCBCBCCABCCAABBABBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAACBBCCBCCBBBACCAABCCCBBCAAACBCCBCCBAACBCCACAABBCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCCABABBCCACABAABAABAAACAABCAABACBABBAABBBAAACCAABAABBACBAABCABBACBBAAABCBCCCBCCCBCBCCABCCAABBABBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAACBBCCBCCBBBACCAABCCCBBCAAACBCCBCCBAACBCCACAABBCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCACBCBAABBCBCBCAABABCAACBBBACCCCAABACBBBAAAAABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAACBBCCBCCBBBACCAABCCCBBCAAACBCCBCCBAACBCCACAABBCCAC.exe" start= auto displayName= "UserDataSvc_AACCACBCBAABBCBCBCAABABCAACBBBACCCCAABACBBBAAAAABCA"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCACBCBAABBCBCBCAABABCAACBBBACCCCAABACBBBAAAAABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAACBBCCBCCBBBACCAABCCCBBCAAACBCCBCCBAACBCCACAABBCCAC.exe" start= auto displayName= "UserDataSvc_AACCACBCBAABBCBCBCAABABCAACBBBACCCCAABACBBBAAAAABCA"
    3⤵
    - Launches sc.exe
    PID:1420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCACBCBAABBCBCBCAABABCAACBBBACCCCAABACBBBAAAAABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCACBCBAABBCBCBCAABABCAACBBBACCCCAABACBBBAAAAABCA"
    3⤵
    - Launches sc.exe
    PID:1244

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBCACCBBBBAABABCCACBCCBACCCBBCAAABABABCCACAAAACBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBCACCBBBBAABABCCACBCCBACCCBBCAAABABABCCACAAAACBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBCBCABCCCACACCCCCCCBAABAAABCCCBCACACBCABCACCBBBCBBBCBBAAACCBBBCBCACACABBBACAAACCACBCAAAACCCBABBBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABCBCACABBCBCABBAACCCBACCACBBAABBABBAACAABCBBAACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBCBCABCCCACACCCCCCCBAABAAABCCCBCACACBCABCACCBBBCBBBCBBAAACCBBBCBCACACABBBACAAACCACBCAAAACCCBABBBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABCBCACABBCBCABBAACCCBACCACBBAABBABBAACAABCBBAACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABCBAACABBBBACCAAAACCCABABBCCBCCBCBBBCACBCACBBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABCBCACABBCBCABBAACCCBACCACBBAABBABBAACAABCBBAACBC.exe" start= auto displayName= "UserDataSvc_CAABCBAACABBBBACCAAAACCCABABBCCBCCBCBBBCACBCACBBCBB"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABCBAACABBBBACCAAAACCCABABBCCBCCBCBBBCACBCACBBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABCBCACABBCBCABBAACCCBACCACBBAABBABBAACAABCBBAACBC.exe" start= auto displayName= "UserDataSvc_CAABCBAACABBBBACCAAAACCCABABBCCBCCBCBBBCACBCACBBCBB"
    3⤵
    - Launches sc.exe
    PID:2676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABCBAACABBBBACCAAAACCCABABBCCBCCBCBBBCACBCACBBCBB"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABCBAACABBBBACCAAAACCCABABBCCBCCBCBBBCACBCACBBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4304

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAACBBCCBCCBBBACCAABCCCBBCAAACBCCBCCBAACBCCACAABBCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAACBBCCBCCBBBACCAABCCCBBCAAACBCCBCCBAACBCCACAABBCCAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABBBCACCCBCBCCACBABCBBAACACAACBBAABCCBAAABCACBABCBCBBACBBBBCCCAACBABBCCABCCAAABCAACABBCCCCCBABCAABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACABBBBCCCCAACAAACBBBCBBCBABAACCBABCBCABAACABACBBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABBBCACCCBCBCCACBABCBBAACACAACBBAABCCBAAABCACBABCBCBBACBBBBCCCAACBABBCCABCCAAABCAACABBCCCCCBABCAABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACABBBBCCCCAACAAACBBBCBBCBABAACCBABCBCABAACABACBBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACCABBAAACBCCCCBACBCCACBABAABCAAAAACCBAACBCBCAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACABBBBCCCCAACAAACBBBCBBCBABAACCBABCBCABAACABACBBBAA.exe" start= auto displayName= "UserDataSvc_BBACCABBAAACBCCCCBACBCCACBABAABCAAAAACCBAACBCBCAAAA"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACCABBAAACBCCCCBACBCCACBABAABCAAAAACCBAACBCBCAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACABBBBCCCCAACAAACBBBCBBCBABAACCBABCBCABAACABACBBBAA.exe" start= auto displayName= "UserDataSvc_BBACCABBAAACBCCCCBACBCCACBABAABCAAAAACCBAACBCBCAAAA"
    3⤵
    - Launches sc.exe
    PID:4928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACCABBAAACBCCCCBACBCCACBABAABCAAAAACCBAACBCBCAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBACCABBAAACBCCCCBACBCCACBABAABCAAAAACCBAACBCBCAAAA"
    3⤵
    - Launches sc.exe
    PID:3476

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABCBCCABAAABABCCCCBABBBBBABBCAACACCBACCBBCAACBCCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABCBCCABAAABABCCCCBABBBBBABBCAACACCBACCBBCAACBCCAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAACBBBCABBAABBBACACACCBACBBAAAAABABABABBAAACCBBBBACACACABAAAABBABCCBBABCCBABCABABABBBABAABBBCCBCBCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACBBBCABBAABBBACACACCBACBBAAAAABABABABBAAACCBBBBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAACBBBCABBAABBBACACACCBACBBAAAAABABABABBAAACCBBBBACACACABAAAABBABCCBBABCCBABCABABABBBABAABBBCCBCBCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACBBBCABBAABBBACACACCBACBBAAAAABABABABBAAACCBBBBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBCABBACACCCCABABCCBBAACCACCAABCCAAAAAABAABCCBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACBBBCABBAABBBACACACCBACBBAAAAABABABABBAAACCBBBBACAC.exe" start= auto displayName= "UserDataSvc_CBCBCABBACACCCCABABCCBBAACCACCAABCCAAAAAABAABCCBABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBCABBACACCCCABABCCBBAACCACCAABCCAAAAAABAABCCBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACBBBCABBAABBBACACACCBACBBAAAAABABABABBAAACCBBBBACAC.exe" start= auto displayName= "UserDataSvc_CBCBCABBACACCCCABABCCBBAACCACCAABCCAAAAAABAABCCBABA"
    3⤵
    - Launches sc.exe
    PID:4144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBCABBACACCCCABABCCBBAACCACCAABCCAAAAAABAABCCBABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBCABBACACCCCABABCCBBAACCACCAABCCAAAAAABAABCCBABA"
    3⤵
    - Launches sc.exe
    PID:1320

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABCBCACABBCBCABBAACCCBACCACBBAABBABBAACAABCBBAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABCBCACABBCBCABBAACCCBACCACBBAABBABBAACAABCBBAACBC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAACBCCCAACABACBBAACCCABABBACAABCBBBCCCCBACCAACBBBABBBBCACBCAACBACBCCCAABBCAABBBBCBAABCACBBCACBBABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACCBBAAABAAABBCCCBBAABCCCCACBBCCCCCBCBBCABBCCCBCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAACBCCCAACABACBBAACCCABABBACAABCBBBCCCCBACCAACBBBABBBBCACBCAACBACBCCCAABBCAABBBBCBAABCACBBCACBBABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACCBBAAABAAABBCCCBBAABCCCCACBBCCCCCBCBBCABBCCCBCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBBCCBBCBAABABBCACBCBCBACBCBACBBABAAACBCBAACBABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACCBBAAABAAABBCCCBBAABCCCCACBBCCCCCBCBBCABBCCCBCBBB.exe" start= auto displayName= "UserDataSvc_BACBBCCBBCBAABABBCACBCBCBACBCBACBBABAAACBCBAACBABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBBCCBBCBAABABBCACBCBCBACBCBACBBABAAACBCBAACBABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACCBBAAABAAABBCCCBBAABCCCCACBBCCCCCBCBBCABBCCCBCBBB.exe" start= auto displayName= "UserDataSvc_BACBBCCBBCBAABABBCACBCBCBACBCBACBBABAAACBCBAACBABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBBCCBBCBAABABBCACBCBCBACBCBACBBABAAACBCBAACBABAC"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBBCCBBCBAABABBCACBCBCBACBCBACBBABAAACBCBAACBABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACABBBBCCCCAACAAACBBBCBBCBABAACCBABCBCABAACABACBBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACABBBBCCCCAACAAACBBBCBBCBABAACCBABCBCABAACABACBBBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAACBBCCAACABCAABBCCBABACCABCBBACCABAAABBBABCCABCAABCCBACACACBCBCACACCBBACBABAABBCCBACABCACBBBCBBBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCBCBCBACAAAABCCAAAAAACACAACBBCCBACBACCBBBAAAABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAACBBCCAACABCAABBCCBABACCABCBBACCABAAABBBABCCABCAABCCBACACACBCBCACACCBBACBABAABBCCBACABCACBBBCBBBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCBCBCBACAAAABCCAAAAAACACAACBBCCBACBACCBBBAAAABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAACABCABBAAACACBBBBABBBBBAACCBACAAABBBBACACABAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCBCBCBACAAAABCCAAAAAACACAACBBCCBACBACCBBBAAAABBA.exe" start= auto displayName= "UserDataSvc_AAAACABCABBAAACACBBBBABBBBBAACCBACAAABBBBACACABAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:416
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAACABCABBAAACACBBBBABBBBBAACCBACAAABBBBACACABAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCBCBCBACAAAABCCAAAAAACACAACBBCCBACBACCBBBAAAABBA.exe" start= auto displayName= "UserDataSvc_AAAACABCABBAAACACBBBBABBBBBAACCBACAAABBBBACACABAACB"
    3⤵
    - Launches sc.exe
    PID:1412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAACABCABBAAACACBBBBABBBBBAACCBACAAABBBBACACABAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4708
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAAACABCABBAAACACBBBBABBBBBAACCBACAAABBBBACACABAACB"
    3⤵
    - Launches sc.exe
    PID:4656

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACBBBCABBAABBBACACACCBACBBAAAAABABABABBAAACCBBBBACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACBBBCABBAABBBACACACCBACBBAAAAABABABABBAAACCBBBBACAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABABBABACCCCCCCCABBCABCCBCBABCCBBBCBBBBCBCAACABCCBABCAABCBBCBBACAAABCAACACCCBCACCBCABBACABBBBABBCACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABBABACCCCCCCCABBCABCCBCBABCCBBBCBBBBCBCAACABCCBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABABBABACCCCCCCCABBCABCCBCBABCCBBBCBBBBCBCAACABCCBABCAABCBBCBBACAAABCAACACCCBCACCBCABBACABBBBABBCACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABBABACCCCCCCCABBCABCCBCBABCCBBBCBBBBCBCAACABCCBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABCBCBBACBCAACAACBCABBCCBABBCCAAABAACAACBCCAACABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABBABACCCCCCCCABBCABCCBCBABCCBBBCBBBBCBCAACABCCBABC.exe" start= auto displayName= "UserDataSvc_CCABCBCBBACBCAACAACBCABBCCBABBCCAAABAACAACBCCAACABC"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABCBCBBACBCAACAACBCABBCCBABBCCAAABAACAACBCCAACABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABBABACCCCCCCCABBCABCCBCBABCCBBBCBBBBCBCAACABCCBABC.exe" start= auto displayName= "UserDataSvc_CCABCBCBBACBCAACAACBCABBCCBABBCCAAABAACAACBCCAACABC"
    3⤵
    - Launches sc.exe
    PID:1560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABCBCBBACBCAACAACBCABBCCBABBCCAAABAACAACBCCAACABC"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABCBCBBACBCAACAACBCABBCCBABBCCAAABAACAACBCCAACABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2052

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACCBBAAABAAABBCCCBBAABCCCCACBBCCCCCBCBBCABBCCCBCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACCBBAAABAAABBCCCBBAABCCCCACBBCCCCCBCBBCABBCCCBCBBB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCCABBBACBABBCCCCCCCABACABBABBABCBAABCACABCBBCABCABCACABCABBAABCCACCCBBBACACCCCBCCACCABABBCBBACCCBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBBCCBBBBAACBCCBBBCCACABCCAAAACCBCBBCAACABACCCCCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCCABBBACBABBCCCCCCCABACABBABBABCBAABCACABCBBCABCABCACABCABBAABCCACCCBBBACACCCCBCCACCABABBCBBACCCBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBBCCBBBBAACBCCBBBCCACABCCAAAACCBCBBCAACABACCCCCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCAAACAAABBACABBACAABCCCACCBAAABCCBCCCCCBCCBABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBBCCBBBBAACBCCBBBCCACABCCAAAACCBCBBCAACABACCCCCCCB.exe" start= auto displayName= "UserDataSvc_ACCCAAACAAABBACABBACAABCCCACCBAAABCCBCCCCCBCCBABABB"
  2⤵
  - Executes a command shell one-liner
  PID:4668
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCAAACAAABBACABBACAABCCCACCBAAABCCBCCCCCBCCBABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBBCCBBBBAACBCCBBBCCACABCCAAAACCBCBBCAACABACCCCCCCB.exe" start= auto displayName= "UserDataSvc_ACCCAAACAAABBACABBACAABCCCACCBAAABCCBCCCCCBCCBABABB"
    3⤵
    - Launches sc.exe
    PID:460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCAAACAAABBACABBACAABCCCACCBAAABCCBCCCCCBCCBABABB"
  2⤵
  - Executes a command shell one-liner
  PID:2216
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCAAACAAABBACABBACAABCCCACCBAAABCCBCCCCCBCCBABABB"
    3⤵
    - Launches sc.exe
    PID:4156

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABBABACCCCCCCCABBCABCCBCBABCCBBBCBBBBCBCAACABCCBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABBABACCCCCCCCABBCABCCBCBABCCBBBCBBBBCBCAACABCCBABC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABBBBABCACABCCCCCACCCACCACACCACBCBACBACCABCCBBBCACAABACCBCBCBBCABBBCAABCCABBCABCCCACBBBBBACACBBCABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBBBABCACABCCCCCACCCACCACACCACBCBACBACCABCCBBBCACAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABBBBABCACABCCCCCACCCACCACACCACBCBACBACCABCCBBBCACAABACCBCBCBBCABBBCAABCCABBCABCCCACBBBBBACACBBCABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBBBABCACABCCCCCACCCACCACACCACBCBACBACCABCCBBBCACAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABCAABCBACCBBBBCACABBBBBCBBAAACBAAABBCABBABABCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBBBABCACABCCCCCACCCACCACACCACBCBACBACCABCCBBBCACAAB.exe" start= auto displayName= "UserDataSvc_ACABCAABCBACCBBBBCACABBBBBCBBAAACBAAABBCABBABABCCAA"
  2⤵
  - Executes a command shell one-liner
  PID:3324
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABCAABCBACCBBBBCACABBBBBCBBAAACBAAABBCABBABABCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBBBABCACABCCCCCACCCACCACACCACBCBACBACCABCCBBBCACAAB.exe" start= auto displayName= "UserDataSvc_ACABCAABCBACCBBBBCACABBBBBCBBAAACBAAABBCABBABABCCAA"
    3⤵
    - Launches sc.exe
    PID:1252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABCAABCBACCBBBBCACABBBBBCBBAAACBAAABBCABBABABCCAA"
  2⤵
  PID:1264
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABCAABCBACCBBBBCACABBBBBCBBAAACBAAABBCABBABABCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCBCBCBACAAAABCCAAAAAACACAACBBCCBACBACCBBBAAAABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCBCBCBACAAAABCCAAAAAACACAACBBCCBACBACCBBBAAAABBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABAABBBBACBCCBBABCBAABBCCBCABBACCBCBBCCCABBBBACABCCCCBABBABBCACBBBBBBCBCABABCACBCACCCCABCBACACAABBACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBBBACBCCBBABCBAABBCCBCABBACCBCBBCCCABBBBACABCCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABAABBBBACBCCBBABCBAABBCCBCABBACCBCBBCCCABBBBACABCCCCBABBABBCACBBBBBBCBCABABCACBCACCCCABCBACACAABBACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBBBACBCCBBABCBAABBCCBCABBACCBCBBCCCABBBBACABCCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBAAACCBAACACCBAABABBCCAACBACAAAACABCBAABCBABBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBBBACBCCBBABCBAABBCCBCABBACCBCBBCCCABBBBACABCCCCB.exe" start= auto displayName= "UserDataSvc_CCBBAAACCBAACACCBAABABBCCAACBACAAAACABCBAABCBABBAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3952
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBAAACCBAACACCBAABABBCCAACBACAAAACABCBAABCBABBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBBBACBCCBBABCBAABBCCBCABBACCBCBBCCCABBBBACABCCCCB.exe" start= auto displayName= "UserDataSvc_CCBBAAACCBAACACCBAABABBCCAACBACAAAACABCBAABCBABBAAB"
    3⤵
    - Launches sc.exe
    PID:1420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBAAACCBAACACCBAABABBCCAACBACAAAACABCBAABCBABBAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:640
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBAAACCBAACACCBAABABBCCAACBACAAAACABCBAABCBABBAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1220

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBBCCBBBBAACBCCBBBCCACABCCAAAACCBCBBCAACABACCCCCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBBCCBBBBAACBCCBBBCCACABCCAAAACCBCBBCAACABACCCCCCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBBCCCBAAABCABBCBBBACBAAAABACBABABCBBACBACBCBCCBBCBBAACACBBBCABCABBAABABACBABABAAAACAABBACBCCCBBABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBCCCBAAABCABBCBBBACBAAAABACBABABCBBACBACBCBCCBBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBBCCCBAAABCABBCBBBACBAAAABACBABABCBBACBACBCBCCBBCBBAACACBBBCABCABBAABABACBABABAAAACAABBACBCCCBBABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBCCCBAAABCABBCBBBACBAAAABACBABABCBBACBACBCBCCBBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAAABCACCBBBAABABCACCAABBACACABACCACAAABCAAAAABABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBCCCBAAABCABBCBBBACBAAAABACBABABCBBACBACBCBCCBBCBB.exe" start= auto displayName= "UserDataSvc_AAAAABCACCBBBAABABCACCAABBACACABACCACAAABCAAAAABABA"
  2⤵
  PID:4044
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAAABCACCBBBAABABCACCAABBACACABACCACAAABCAAAAABABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBCCCBAAABCABBCBBBACBAAAABACBABABCBBACBACBCBCCBBCBB.exe" start= auto displayName= "UserDataSvc_AAAAABCACCBBBAABABCACCAABBACACABACCACAAABCAAAAABABA"
    3⤵
    - Launches sc.exe
    PID:2272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAAABCACCBBBAABABCACCAABBACACABACCACAAABCAAAAABABA"
  2⤵
  - Executes a command shell one-liner
  PID:2536
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAAAABCACCBBBAABABCACCAABBACACABACCACAAABCAAAAABABA"
    3⤵
    - Launches sc.exe
    PID:2580

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBBBABCACABCCCCCACCCACCACACCACBCBACBACCABCCBBBCACAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBBBABCACABCCCCCACCCACCACACCACBCBACBACCABCCBBBCACAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABCACCCAACAAACCCACBBAAACBBCBBCAACBABCACAAABABCBACAAAAACBBCBBACACCAABCAACBACCCBCCCCAAACBBBBABCABCBCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCACCCAACAAACCCACBBAAACBBCBBCAACBABCACAAABABCBACAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABCACCCAACAAACCCACBBAAACBBCBBCAACBABCACAAABABCBACAAAAACBBCBBACACCAABCAACBACCCBCCCCAAACBBBBABCABCBCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCACCCAACAAACCCACBBAAACBBCBBCAACBABCACAAABABCBACAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABCCBCAAABACBBBBCCAACCCCCABCACCABAAACACCBCCAAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCACCCAACAAACCCACBBAAACBBCBBCAACBABCACAAABABCBACAAAA.exe" start= auto displayName= "UserDataSvc_CCABCCBCAAABACBBBBCCAACCCCCABCACCABAAACACCBCCAAAABB"
  2⤵
  - Executes a command shell one-liner
  PID:312
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABCCBCAAABACBBBBCCAACCCCCABCACCABAAACACCBCCAAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCACCCAACAAACCCACBBAAACBBCBBCAACBABCACAAABABCBACAAAA.exe" start= auto displayName= "UserDataSvc_CCABCCBCAAABACBBBBCCAACCCCCABCACCABAAACACCBCCAAAABB"
    3⤵
    - Launches sc.exe
    PID:2492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABCCBCAAABACBBBBCCAACCCCCABCACCABAAACACCBCCAAAABB"
  2⤵
  - Executes a command shell one-liner
  PID:4624
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABCCBCAAABACBBBBCCAACCCCCABCACCABAAACACCBCCAAAABB"
    3⤵
    - Launches sc.exe
    PID:4140

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBBBACBCCBBABCBAABBCCBCABBACCBCBBCCCABBBBACABCCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBBBACBCCBBABCBAABBCCBCABBACCBCBBCCCABBBBACABCCCCB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAABCACCBBCCBCBBCBBCBCCCBACCBBBABBBBABBBABAABAABBAABBABBABACABABABCABCCACBCBCACAACBCBBBCCABCBBCCCBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAABCACCBBCCBCBBCBBCBCCCBACCBBBABBBBABBBABAABAABBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAABCACCBBCCBCBBCBBCBCCCBACCBBBABBBBABBBABAABAABBAABBABBABACABABABCABCCACBCBCACAACBCBBBCCABCBBCCCBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAABCACCBBCCBCBBCBBCBCCCBACCBBBABBBBABBBABAABAABBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCCAAAACAAABCCACCACABBCBAACCCBBAACAAABABCCBBCBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAABCACCBBCCBCBBCBBCBCCCBACCBBBABBBBABBBABAABAABBAABB.exe" start= auto displayName= "UserDataSvc_ABBCCAAAACAAABCCACCACABBCBAACCCBBAACAAABABCCBBCBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3680
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBCCAAAACAAABCCACCACABBCBAACCCBBAACAAABABCCBBCBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAABCACCBBCCBCBBCBBCBCCCBACCBBBABBBBABBBABAABAABBAABB.exe" start= auto displayName= "UserDataSvc_ABBCCAAAACAAABCCACCACABBCBAACCCBBAACAAABABCCBBCBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBCCAAAACAAABCCACCACABBCBAACCCBBAACAAABABCCBBCBBAA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2880
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBCCAAAACAAABCCACCACABBCBAACCCBBAACAAABABCCBBCBBAA"
    3⤵
    - Launches sc.exe
    PID:1100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCACCCAACAAACCCACBBAAACBBCBBCAACBABCACAAABABCBACAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCACCCAACAAACCCACBBAAACBBCBBCAACBABCACAAABABCBACAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCCBBCBCCCCCBBBAACAABCABCCABBBBBBAACACCAAABACBBCBBACBCCCBABCCCBCACABBBBAACCBABABCCAAAACCAAACBBBACCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCBBCBCCCCCBBBAACAABCABCCABBBBBBAACACCAAABACBBCBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:3884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCCBBCBCCCCCBBBAACAABCABCCABBBBBBAACACCAAABACBBCBBACBCCCBABCCCBCACABBBBAACCBABABCCAAAACCAAACBBBACCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCBBCBCCCCCBBBAACAABCABCCABBBBBBAACACCAAABACBBCBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCBBCBBBBABBBBABBAABAAABCBBBCAAACCBAACCBBCAAABABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCBBCBCCCCCBBBAACAABCABCCABBBBBBAACACCAAABACBBCBBAC.exe" start= auto displayName= "UserDataSvc_BBCCBBCBBBBABBBBABBAABAAABCBBBCAAACCBAACCBBCAAABABC"
  2⤵
  - Executes a command shell one-liner
  PID:5068
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCBBCBBBBABBBBABBAABAAABCBBBCAAACCBAACCBBCAAABABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCBBCBCCCCCBBBAACAABCABCCABBBBBBAACACCAAABACBBCBBAC.exe" start= auto displayName= "UserDataSvc_BBCCBBCBBBBABBBBABBAABAAABCBBBCAAACCBAACCBBCAAABABC"
    3⤵
    - Launches sc.exe
    PID:5012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCBBCBBBBABBBBABBAABAAABCBBBCAAACCBAACCBBCAAABABC"
  2⤵
  - Executes a command shell one-liner
  PID:3536
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCBBCBBBBABBBBABBAABAAABCBBBCAAACCBAACCBBCAAABABC"
    3⤵
    - Launches sc.exe
    PID:1916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBCCCBAAABCABBCBBBACBAAAABACBABABCBBACBACBCBCCBBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBCCCBAAABCABBCBBBACBAAAABACBABABCBBACBACBCBCCBBCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABAABBAAAABBACBACBCACACBACCABACAACBCAACCCAAACBCBCBCCCACCBABCABACABCBCBABCCACCABACCCABCAAABCBCABBCBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAABBAAAABBACBACBCACACBACCABACAACBCAACCCAAACBCBCBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:3912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABAABBAAAABBACBACBCACACBACCABACAACBCAACCCAAACBCBCBCCCACCBABCABACABCBCBABCCACCABACCCABCAAABCBCABBCBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAABBAAAABBACBACBCACACBACCABACAACBCAACCCAAACBCBCBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAABCBBABCCBABAAACCBAACAABCACAABABABBBCAABCCAAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAABBAAAABBACBACBCACACBACCABACAACBCAACCCAAACBCBCBCCC.exe" start= auto displayName= "UserDataSvc_ABAABCBBABCCBABAAACCBAACAABCACAABABABBBCAABCCAAABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4980
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAABCBBABCCBABAAACCBAACAABCACAABABABBBCAABCCAAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAABBAAAABBACBACBCACACBACCABACAACBCAACCCAAACBCBCBCCC.exe" start= auto displayName= "UserDataSvc_ABAABCBBABCCBABAAACCBAACAABCACAABABABBBCAABCCAAABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAABCBBABCCBABAAACCBAACAABCACAABABABBBCAABCCAAABBA"
  2⤵
  - Executes a command shell one-liner
  PID:2212
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAABCBBABCCBABAAACCBAACAABCACAABABABBBCAABCCAAABBA"
    3⤵
    - Launches sc.exe
    PID:1392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCBBCBCCCCCBBBAACAABCABCCABBBBBBAACACCAAABACBBCBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCBBCBCCCCCBBBAACAABCABCCABBBBBBAACACCAAABACBBCBBAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCAABCAAABBBCAACBCCAAAABABCABCCBABBBAAACAABBBACBBCBACCBACBCACABCBCCBCCAABCCBABBABCBBBBABAAACBCBCABCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABCAAABBBCAACBCCAAAABABCABCCBABBBAAACAABBBACBBCBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:4112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCAABCAAABBBCAACBCCAAAABABCABCCBABBBAAACAABBBACBBCBACCBACBCACABCBCCBCCAABCCBABBABCBBBBABAAACBCBCABCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABCAAABBBCAACBCCAAAABABCABCCBABBBAAACAABBBACBBCBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBCABABABCCCCBCCCBBABCBBBBBABABACACBBCABCCBAACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABCAAABBBCAACBCCAAAABABCABCCBABBBAAACAABBBACBBCBACC.exe" start= auto displayName= "UserDataSvc_CACBCABABABCCCCBCCCBBABCBBBBBABABACACBBCABCCBAACBAA"
  2⤵
  - Executes a command shell one-liner
  PID:1704
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBCABABABCCCCBCCCBBABCBBBBBABABACACBBCABCCBAACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABCAAABBBCAACBCCAAAABABCABCCBABBBAAACAABBBACBBCBACC.exe" start= auto displayName= "UserDataSvc_CACBCABABABCCCCBCCCBBABCBBBBBABABACACBBCABCCBAACBAA"
    3⤵
    - Launches sc.exe
    PID:1516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBCABABABCCCCBCCCBBABCBBBBBABABACACBBCABCCBAACBAA"
  2⤵
  - Executes a command shell one-liner
  PID:4024
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBCABABABCCCCBCCCBBABCBBBBBABABACACBBCABCCBAACBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAABCACCBBCCBCBBCBBCBCCCBACCBBBABBBBABBBABAABAABBAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAABCACCBBCCBCBBCBBCBCCCBACCBBBABBBBABBBABAABAABBAABB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAACCABAAABBBACBBCCABCCCAACCBCCBBACAABBCCBBBABCBBBCBCACCBACACAAABABBCCBBCABCBCBABCBACCAACAAAAACCAACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACCABAAABBBACBBCCABCCCAACCBCCBBACAABBCCBBBABCBBBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAACCABAAABBBACBBCCABCCCAACCBCCBBACAABBCCBBBABCBBBCBCACCBACACAAABABBCCBBCABCBCBABCBACCAACAAAAACCAACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACCABAAABBBACBBCCABCCCAACCBCCBBACAABBCCBBBABCBBBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABBBBCCCAACCCACAAAACBBBAABABAABACCACBABACCACCBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACCABAAABBBACBBCCABCCCAACCBCCBBACAABBCCBBBABCBBBCBC.exe" start= auto displayName= "UserDataSvc_BAABBBBCCCAACCCACAAAACBBBAABABAABACCACBABACCACCBBCB"
  2⤵
  - Executes a command shell one-liner
  PID:460
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABBBBCCCAACCCACAAAACBBBAABABAABACCACBABACCACCBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACCABAAABBBACBBCCABCCCAACCBCCBBACAABBCCBBBABCBBBCBC.exe" start= auto displayName= "UserDataSvc_BAABBBBCCCAACCCACAAAACBBBAABABAABACCACBABACCACCBBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABBBBCCCAACCCACAAAACBBBAABABAABACCACBABACCACCBBCB"
  2⤵
  - Executes a command shell one-liner
  PID:4128
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABBBBCCCAACCCACAAAACBBBAABABAABACCACBABACCACCBBCB"
    3⤵
    - Launches sc.exe
    PID:2000

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABCAAABBBCAACBCCAAAABABCABCCBABBBAAACAABBBACBBCBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABCAAABBBCAACBCCAAAABABCABCCBABBBAAACAABBBACBBCBACC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCCBAABAAAAACACABCBCABCAACBACACCCBCABCBAACACCCBBCACCBCAABBACACBCBCACCBCCBBBCBCACABACBBABCAACCACBAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCCBAABAAAAACACABCBCABCAACBACACCCBCABCBAACACCCBBCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:1720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCCBAABAAAAACACABCBCABCAACBACACCCBCABCBAACACCCBBCACCBCAABBACACBCBCACCBCCBBBCBCACABACBBABCAACCACBAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCCBAABAAAAACACABCBCABCAACBACACCCBCABCBAACACCCBBCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAABBBCBACABABCCBCCBCABABCABCBACCBCCBBBBAACBABCACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCCBAABAAAAACACABCBCABCAACBACACCCBCABCBAACACCCBBCACC.exe" start= auto displayName= "UserDataSvc_CAAABBBCBACABABCCBCCBCABABCABCBACCBCCBBBBAACBABCACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1300
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAABBBCBACABABCCBCCBCABABCABCBACCBCCBBBBAACBABCACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCCBAABAAAAACACABCBCABCAACBACACCCBCABCBAACACCCBBCACC.exe" start= auto displayName= "UserDataSvc_CAAABBBCBACABABCCBCCBCABABCABCBACCBCCBBBBAACBABCACC"
    3⤵
    - Launches sc.exe
    PID:2132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAABBBCBACABABCCBCCBCABABCABCBACCBCCBBBBAACBABCACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1668
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAABBBCBACABABCCBCCBCABABCABCBACCBCCBBBBAACBABCACC"
    3⤵
    - Launches sc.exe
    PID:3000

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACCABAAABBBACBBCCABCCCAACCBCCBBACAABBCCBBBABCBBBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACCABAAABBBACBBCCABCCCAACCBCCBBACAABBCCBBBABCBBBCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABBAAAAAACCBACBABBABACACBBCBABBCAACBCBCBABBBCAABBAACBBCABCCABBCCBBBACCCBACCCBACBBACACBCBCCBCBCACAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBAAAAAACCBACBABBABACACBBCBABBCAACBCBCBABBBCAABBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABBAAAAAACCBACBABBABACACBBCBABBCAACBCBCBABBBCAABBAACBBCABCCABBCCBBBACCCBACCCBACBBACACBCBCCBCBCACAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBAAAAAACCBACBABBABACACBBCBABBCAACBCBCBABBBCAABBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCBCABACCBBBBAAAABACCCABACCCCCCCCCCCBAAABCBBACABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBAAAAAACCBACBABBABACACBBCBABBCAACBCBCBABBBCAABBAAC.exe" start= auto displayName= "UserDataSvc_BBCCBCABACCBBBBAAAABACCCABACCCCCCCCCCCBAAABCBBACABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2608
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCBCABACCBBBBAAAABACCCABACCCCCCCCCCCBAAABCBBACABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBAAAAAACCBACBABBABACACBBCBABBCAACBCBCBABBBCAABBAAC.exe" start= auto displayName= "UserDataSvc_BBCCBCABACCBBBBAAAABACCCABACCCCCCCCCCCBAAABCBBACABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCBCABACCBBBBAAAABACCCABACCCCCCCCCCCBAAABCBBACABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4684
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCBCABACCBBBBAAAABACCCABACCCCCCCCCCCBAAABCBBACABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBAAAAAACCBACBABBABACACBBCBABBCAACBCBCBABBBCAABBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBAAAAAACCBACBABBABACACBBCBABBCAACBCBCBABBBCAABBAAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAACCCCBABBBCCCBCBAACBACCACBCBCCABBAACBCAABBBACCABABCBBAACBCCCCCAABBBAACACBBCCCBABCBCCAAACBCBCBCBABAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCCBABBBCCCBCBAACBACCACBCBCCABBAACBCAABBBACCABABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAACCCCBABBBCCCBCBAACBACCACBCBCCABBAACBCAABBBACCABABCBBAACBCCCCCAABBBAACACBBCCCBABCBCCAAACBCBCBCBABAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCCBABBBCCCBCBAACBACCACBCBCCABBAACBCAABBBACCABABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABBCBCACCBACBAAABACBBAABCCBBACACAABBAAACBAACAAABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCCBABBBCCCBCBAACBACCACBCBCCABBAACBCAABBBACCABABCB.exe" start= auto displayName= "UserDataSvc_BABBCBCACCBACBAAABACBBAABCCBBACACAABBAAACBAACAAABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3760
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABBCBCACCBACBAAABACBBAABCCBBACACAABBAAACBAACAAABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCCBABBBCCCBCBAACBACCACBCBCCABBAACBCAABBBACCABABCB.exe" start= auto displayName= "UserDataSvc_BABBCBCACCBACBAAABACBBAABCCBBACACAABBAAACBAACAAABAA"
    3⤵
    - Launches sc.exe
    PID:4236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABBCBCACCBACBAAABACBBAABCCBBACACAABBAAACBAACAAABAA"
  2⤵
  PID:3640
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABBCBCACCBACBAAABACBBAABCCBBACACAABBAAACBAACAAABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAABBAAAABBACBACBCACACBACCABACAACBCAACCCAAACBCBCBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAABBAAAABBACBACBCACACBACCABACAACBCAACCCAAACBCBCBCCC.exe
1⤵
- Executes dropped EXE
PID:3464

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAABBAAAABBACBACBCACACBACCABACAACBCAACCCAAACBCBCBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAABBAAAABBACBACBCACACBACCABACAACBCAACCCAAACBCBCBCCC.exe
1⤵
- Executes dropped EXE
PID:1312

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCCBABBBCCCBCBAACBACCACBCBCCABBAACBCAABBBACCABABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCCBABBBCCCBCBAACBACCACBCBCCABBAACBCAABBBACCABABCB.exe
1⤵
- Executes dropped EXE
PID:3908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCCBAABAAAAACACABCBCABCAACBACACCCBCABCBAACACCCBBCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCCBAABAAAAACACABCBCABCAACBACACCCBCABCBAACACCCBBCACC.exe
1⤵
- Executes dropped EXE
PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

virus_log.txt

Path C:\Users\Admin\AppData\Local\Temp\virus_log.txt
Size 1KB
SHA256 4f83657a48c49a35c60215077fe5d6de5f0c2c290af7f6645406f3a78ead3094
MD5 cf741a885fe219a2eee08c5c72e1d484
SHA1 108e8090c220f0940b64de391fde498498e24da2
SHA512 d8134c9308d40eb908297c445413ad4fbe14c65258bc7dd2f2d3aee93b3bfe8ed010e20f7827c1b57d139e0f567ddf8c582da254c323dd676a86f5caba01bbbb
TLSH
T16741B152C0FBDC37712259C6DB3D998889D4B76E18CC1AA0A3054715B7E48378DEB4D1
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1900fdaa46886b4f6489e3ab77c29bd6d5b0244d11bc130289693b47c7b512c9
MD5 3dec1f57733db0289b0d2e5f715eabe9
SHA1 70c0c747179735dbeb6321f5658a8a9253d2c567
SHA512 f35c72382ff3352e89b11dce171788de88ac22f99a2206351937625519db22f00d075ab66473d05c0087502d74561011803b4871f47126d9f1d60fde7a3adaca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3f96f4feadd22db79a55b84c65e00aebfb60c8dba10c7dc95cb82f9fbbc6ad77
MD5 83c4863d7169a85e02d5a8b2ba7fa1fe
SHA1 7eaeecbbef136b72ce9f08d0233cdff12cfcb071
SHA512 6d95e1cd1392ef47ea4e8fb037dea08308840bd7883d5c6f40c7c2456e9840d2871f7eed30cf2ed50b3d80bdd71da2ff5e00385bdc2c7f084f212def52ff8eaa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 789ad0494f13312914b098f72e89f6db8c50e8462b839a7fe1f97cd13767b97e
MD5 c6fd1d240c04beb15d8eead6a212df9f
SHA1 37ae0de823a7a04c5f8bb2a0890796b2d69d0b4f
SHA512 31b47e76213bf3f7fc948d74d5cf238cccaac3b28bacaa8778d101f780b6a5922fdce7b15e9ff849d53f570a1b7e873ea6e87d4f7b1ff7d0b049e58302e357f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0c05a56d409f77bfb5169ad6a76134f64c3c4b0d43f0ac6108d33bb3a3dc6bb8
MD5 ed3ace412ea6e5565527fa816be89d43
SHA1 4ef4668f61e78829e33f6f97d36d8854c16c8db3
SHA512 48ecaece8c753d4a04a840fdb6e8baf00cf336b26d843dc8543ec23352309ff960475942a97b58a3cd823c7dcee0f05d37440c51d31690a7d560ea1b6d26dea5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9ba7ba891af5b19ac72e7657fb6ebc92d829dfc05aa69eaed1dd5c8a49db1215
MD5 7b4c1d7fab1f7ecade28cda4d9e5f6df
SHA1 cc76ef3071f4ea444b412e724a1217e77badc0f1
SHA512 b02ab1c3e1ff5538bb83fba3a30bd68143472d4234000e59b8f93df5caa60a07ad5828d4573474b262ac56da7691a7fd87886a0b2c50a877111a68f28ed48d38
MD5 SHA1 SHA512

Submit Download

svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABABBAAACAAAABAACBCCBBBCABACCBAACBABABCCBBCCBABBBB.exe
Size 7.5MB
SHA256 abce3098723f7ea784e071b47597c2ecd1356ec7a570a7b1756c061ab8a39be0
MD5 b71e3b9e2168fefa5d4d35ea63be5e9b
SHA1 22e3b974a904886ab0fc08246267db16dd5c330f
SHA512 9a8a57fe1b4b48df464f2a6c64e0849e3d8a74b3e8f34bb30348ca8008a3b1fcb6aa3212f938199eb1d35d6e16bd2c67eacc3df0935dde07acdfc18a49c747cd
SSDEEP 49152:PbE2kZAW2ROQcverO04TcbE2kZAW2ROQcverO04TcbE2kZAW2ROQcverO04TcbEm:b4Tk4Tk4Tk4Tk4Tk4Tk4Ti
TLSH
T11F862A1263EC115CF1F71B72EE39A552A97AFCEE7E12E51E0455340E20B2B14CA6A337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 d4a59a1d20e22fb51b8f550c91572ad78dd1a6e7635d8053e9f3aac22b5c4ab9
MD5 b5a630bdfd23c074bcae469333169c01
SHA1 1016870fa067502ecb692ecde6b9509616802a3e
SHA512 06d7b5dd53cfbfeb056a09d5a53ab5193863486f16324a4e52b0da2741c24671d50b77f62eec962042dfbc3be23ad1ead56a28f119e33dd5aecc58b2efff5759
SSDEEP 96:o771HN+Xo4N+Xxt+XB+w7+X/HN1Qp64pprxMN+X31DFC4FP5+uqN+X31Dc74cOu0:MGMWBC/tk3Fd3b0aJdac9
TLSH
T144A184A1E0B6DC63F12258D7DB38A9D54E94739F98CC595473098318ABD4D33CCEA8E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 a4ad3024e19f241c01dd8107cb0de7fc397ed9efbedbf08a7bd1bf2ec091a42a
MD5 d7991a3044cc08c03b5aa3f86a3fbce9
SHA1 cebc27c6781591b8780bf8f732d857da0b0c0e32
SHA512 f29b89989a7fea116d39dab5af4158dcca83d2c08b37a9f8fc0f7a73940b554a129250ccb98c4f37e4578e4cc4a9e34107c618dd176294435d870db49aac27c5
SSDEEP 96:o771HN+Xo4N+Xxt+XB+w7+X/HN1Qp64pprxMN+X31DFC4FP5+uqN+X31Dc74cOu7:MGMWBC/tk3Fd3b0aJdacs0NXQ
TLSH
T116C1B861E0B6DC63F12258D7DB3899D14ED4739F58CC5A94B3098318AB94D33CCEA8E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 c190af75051eb5593fc3003aa9bdb8cbf379c475c89f3874a5048b0737f8de3c
MD5 c7891d0c04daaba411d169d817ec531e
SHA1 521847329c4c0a849ce20a6370f04718b8b0780b
SHA512 5166a1e1446f691a475151f7eec522140a6aff952e59233d37acb1751f1914b4ad5aa3315603a760a0ce8c7ad5dacfed6db3014d3a9657cb44d5b41ec5b99e75
SSDEEP 96:o771HN+Xo4N+Xxt+XB+w7+X/HN1Qp64pprxMN+X31DFC4FP5+uqN+X31Dc74cOuc:MGMWBC/tk3Fd3b0aJdacs0NXALrmFRj
TLSH
T108F1E661E0B6DC63F12258C7DB3999D54AD4739F68CC5A94B3098318B7A4C33CDEA4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 08f0998df4e45477acc0b0bdf9f4f95fd1eac9729ae3f078c46ba32fc060e2fc
MD5 5db3df7e0329ab5f9f21c527e61f48df
SHA1 9b5c55507e8fcd3abfdc9f8b3de56f284c0d271b
SHA512 67d85ba515653601c6649bbbc88b1735a86e9fd4d69a3628385319fc697b77e3861fb13a3176bddfdf5e9aa6184cecd5c6a363f5722ddbc99bc232dbce8a9d03
SSDEEP 96:o771HN+Xo4N+Xxt+XB+w7+X/HN1Qp64pprxMN+X31DFC4FP5+uqN+X31Dc74cOu3:MGMWBC/tk3Fd3b0aJdacs0NXALrmFRi
TLSH
T147F1E661E0B6DC63F12258C7DB3999D54AD4739FA8CC5A94B3098318A7A4C33CDEA4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 b30bbc7a893e951899c843d37ba8056020b6b7a3aa369f1266ae0f42987baf25
MD5 37d87f3b71adb119f690a767c7fbbe4f
SHA1 7bb5c211d90bc69689625362b85086a25a73315f
SHA512 b911d07153a815067ef8404d380113d8701ed423cb245c2432ed3b9b02527e3dfc6a9683dd48528bb6f7b94867b490d5167ebb253a8852e7791da62698b2fabb
SSDEEP 192:MGMWBC/tk3Fd3b0aJdacs0NXALrmFR4FTlBnYtJ:tMWBC/iVdr0aJdacRNwLrmFRYTlBnYtJ
TLSH
T18622C362A0FADC63B12258C7DB399AC54AD4739F6CCC5A94B3098318B794C33CDEA4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 4376fd744892fa48c0acafd04e2e751e991c5c162396760bbe94b1ed6fce00c7
MD5 7ce30edc5fecf8cc461f1039eaa4140d
SHA1 4f8db8df0102346562ba1304841b8974fab54c56
SHA512 43adabca057bdfc1170a74db91b91f4d686b990227a02bbc5ca4e24937a5a857ce81c278d400266761f2595dc0f22b387c0f92ba9fc63324ba9f66673575c365
SSDEEP 192:MGMWBC/tk3Fd3b0aJdacs0NXALrmFR4FTlBnYto:tMWBC/iVdr0aJdacRNwLrmFRYTlBnYto
TLSH
T18D22C262A0FADC63B12258C7DB399AC54AD4779F6CCC5A94B3098318B794C33CDEA4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 11KB
SHA256 7d85405e792c4b6e66709091fecb4e80a52c035a61bdb26fb622803b0f46cd7a
MD5 1b0f147d2dfbacd15679c9adf1d3e8f9
SHA1 381fe248ddcc9fa67856e082d66932102960f762
SHA512 303e477f117a5dd21f3db33cc82e2508f93c9f98d7a5bc4c25b0d7f4cdf5e848dcfe67715fda66f4b03e2446d7a49ad91b3f2c43737ab1c39c9f653a5991ace6
SSDEEP 192:MGMWBC/tk3Fd3b0aJdacs0NXALrmFR4FTlBnYtBiN90rY:tMWBC/iVdr0aJdacRNwLrmFRYTlBnYt6
TLSH
T11232B162E0B6DC63B12269C7DB399AD54AD4739F6CCC5A94B3098318B794C33CCEA4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 bebb1c520413087b87de09283d6ad14b4da0f0992f3a9ddf3fea21d0a91f8f8a
MD5 ca171063f22a714448debdf2c2dbcfeb
SHA1 3524390ed50a262f52e39e10a74eb56c86ed6ea0
SHA512 312d629ca0edee62b432a4eadfd1881c5f84b6848d2794b104fcc35799556984ac46c1b47bd43ab7924bec25f1a6e9684eb01a1cc2b26aca139c49babf817fd7
SSDEEP 384:tMWBC/iVdr0aJdacRNwLrmFRYTlBnYt0NmrX5U:tMWBCKVdwaJ1iLSFCTlBYyNsXS
TLSH
T10042A062A0B6DC63B12269C7DB399AD54AE4739F6CCC5A94B3094318B794C33CCEB4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 13KB
SHA256 59b6b7869f56fd00d89e1b084f9a6d24842ab73ca36a8c9ca6edec8e2acbd97e
MD5 4ae07d27d630b5c24598447347775ee7
SHA1 28b00b2b83f6faa70ea152c4955bffb0be0984ea
SHA512 2631327f4a2b73ed0b05524d9e33093881173dbfeab5f3e0f45bd55ddfd1207eb8e06769d159dc1011b5c0b8e0f73ec739519bf29be367cd7a9c7cb11fc01809
SSDEEP 384:tMWBC/iVdr0aJdacRNwLrmFRYTlBnYt0NmrX58Ex/6:tMWBCKVdwaJ1iLSFCTlBYyNsXiEh6
TLSH
T1EA52A162E0B6DC63B12269C79B399AD64AD4739F68CC5A94B3094318B794C33CCEB4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 4e3b5938a44155a73f6ac743db37558e10f3e7de86812171659a1c4fd25e7c5f
MD5 4ab8c2c43b06dced167258d531c82361
SHA1 109e3ccf43249c30ce76c05cc642e68dcde8fcd4
SHA512 2c24ac5ad7cdc743cee0e14e24f2da7c50222b4314ec6f6d647b9a7c17d2c204d4a6dc2a0d7d0c74950f947c25dcc77c61cba84ffdb06c13f648ea0d638383f9
SSDEEP 384:tMWBC/iVdr0aJdacRNwLrmFRYTlBnYt0NmrX58Ex/eG9:tMWBCKVdwaJ1iLSFCTlBYyNsXiEheq
TLSH
T1AC62B361E0B6DC63B12259C79B39AAC64AD4739F6CCC5A94B3095318B794C33CCEB4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 15KB
SHA256 c1eb2e2e46e2a0cf457ecdd5d23a7dba7445a5384e98ae96869263d069f12406
MD5 3f03d1fc79e5e1dbbac2cf5c618456df
SHA1 0fff5f146a14ceaebafb30db6bf77c06fb1ff43d
SHA512 6cd918a9b617a5cd461738adddd5bef44b70b78ffde515d8b51e8915d01021cae93242c721b1b99cf67048e2077521347c0738050d9f1a68d1268e71026a1de2
SSDEEP 384:tMWBC/iVdr0aJdacRNwLrmFRYTlBnYt0NmrX58Ex/eGb:tMWBCKVdwaJ1iLSFCTlBYyNsXiEhei
TLSH
T1CB62B361E0B6DC63B12269C79B399AC649D4739FACCC5A94B3095318B794C33CCEB4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 2f1010af637acb7ae70a78d40419d6dc0814eba6a46359ea6b339e129a19d2b3
MD5 93dfd99e335dbe8fc7cf118bc24981e4
SHA1 8e3e11dd4713097047e03406c45d2798df829d84
SHA512 95617a80b569eeea6f35e683195e74a4dc4da2704a08f6226d943647fccde4644934b4a85d9eff2bf18da53c9892e6a70f9c6544ecbfa51c5fa9a6b82d2b41af
TLSH
T1F521B6B2A0B6CC63F22258C6CB3CBA965D98739F5CDC5554630A831867D4833CC9A8E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 15KB
SHA256 d88f44bcb36642e878ad823ce15069377431b2f0adb28f63f8f7089e5e88b895
MD5 bbf1cc17707667300c5ce0b918d7c4a6
SHA1 bb9cac4499d2c9efc0b062191fd48765b9abaa82
SHA512 2edfcb4dc220a17af958c88f7d405ad83c385ac39db7ae71c8efd4d877cd73105b1befa336d9e266d81f07209b37d9f3a9256691544a7bd95f3a1d8701856e2c
SSDEEP 384:tMWBC/iVdr0aJdacRNwLrmFRYTlBnYt0NmrX58Ex/eGcDv:tMWBCKVdwaJ1iLSFCTlBYyNsXiEheRD
TLSH
T14272C361E0B6DC63B12269C79B39AAC649D4739FACCC5A94B3095318B794C33CCEB4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 15KB
SHA256 7ab33800bf07ffe8c88650d6cddd05f68cfc657e95f8620c5c38286d2af2a016
MD5 401057a8e5bd8a550320d264617dd44b
SHA1 5c42a69d42daabf1697449f186e74264a243f230
SHA512 7baec284bf824ee87fd5cc247348914ff35d76c1fc8af29e51efbb5034fdfa55a9f240e322ac4bd300fd794210f3c6b6840af5cd6209119199901ea4cfcdcaae
SSDEEP 384:tMWBC/iVdr0aJdacRNwLrmFRYTlBnYt0NmrX58Ex/eGcDA:tMWBCKVdwaJ1iLSFCTlBYyNsXiEheRU
TLSH
T16872C261E0B6DC63B12269C79B39AAC649D4739FACCC5A94B3095318B794C33CCEB4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 16KB
SHA256 1172ba1e1dbb2a8314d9eec5e1123203eb19abab038c2af8f4cea7adb6383b18
MD5 2ad2431a6a205991b739f19cf1e5a5e5
SHA1 ebfcd41a9e07ad08f0813b49138f7467a16aa1da
SHA512 0e8a94f4113b8e3aebb655755bb84b973741850f03dcb8fd031f4dca76b06adbaec168a5d2d3b9cb5be9a682e01936b2204087d71898a8c355d0b79ed5893a19
SSDEEP 384:tMWBC/iVdr0aJdacRNwLrmFRYTlBnYt0NmrX58Ex/eGcD6CnQ7:tMWBCKVdwaJ1iLSFCTlBYyNsXiEheR2n
TLSH
T1CF72C161E0B6DC63B12269C79B39AAC649D4739FACCC5A94B3095318B794C33CCEB4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a28d88a83d813f5537be4fde13d0f7befbef3a752a7bce2ed61663c2218a48c0
MD5 3407dd962975cf981c7471d5d84c2922
SHA1 e1ab2333c87d149b81d8cb57db437ed40bdcd5a7
SHA512 7c9a8be9aa9cdce0c8a2d771598e21a6765f76d4c886954d975ee91c05cd9686f43a0933cfc5c373850284c8ab82e7f81d42d80509fa8d2f3c41c7d9b57c75ac
TLSH
T18441B8B1A0B6DC53F22254C7CA39A9D24ED4738F9CCC5A5473098318A794933CCEA8E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 f2b546add467a943a83d2151bf5fb055c0c450637003eb58ec2740be62bfd6ef
MD5 998f71ecdd4384e2e57578213e9eb560
SHA1 79358f1cc4c8c23f1a8a63ab8bdfeb19899cbeb7
SHA512 508e67d8ef64aa0d75765b11900d294a47b5da89db2e82bb3bbe6a40c262a60cb48ec753ad05d464f4af09bd2d2b0da04a060519f5572556e99584c776d498a0
TLSH
T16F51B9A1A0B6DC63F12264C7C739A9D64DD4738F9CDC5A5473098318ABD4933CCEA8E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 9ad3be565bf9b0a745ee4c4b335fe5c74c761b27c8ee80eb3dd6166749f727a4
MD5 7cfe4ab6b4ab8ad5307f0966e17072ae
SHA1 02449e2d83bcb31fe6318d94dc23f4edbf3ebe05
SHA512 5f74aaf38ef48a9ca8f7af770a340729b14afcb709a957834db848baca123189c20d5e8d1a9f10da4b14c13c9dc42eab2604da90fbf9bf529c345525cb6c4c56
TLSH
T10751A6A1A0B6DC63F12264C7CB38A9D64DD4739F9CDC5A5473098318ABD4933CCEA8E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 45f3a504909316bde48369d90878ed5fa56447a8c0026396a39e5106a706028d
MD5 c97b0724452a8fc466381ba6aec09d85
SHA1 a0e05500fd0508f074501d54a3b69f989ab6a04d
SHA512 936169e5f1414be75318b8f0aef69cebe8fed476e081d6e4509d8d7ab08a632ed961237ca48f96f8a9eb4e23487a4b5ce5aeaceae042a46746eac31529ea377f
TLSH
T1F581C9A1A0B6DC63F12264D7CB39A9C64DD4739F6CDC5A5473098318AB94D33CCEA8E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 4421c87eff5353dc3493971db4fd48b728e3ffad6c408e8c08a023196652aa1f
MD5 2df16191dce01e1822ed4672cd1ff5d9
SHA1 8ba1a8d260d21848ba98ac82e940f13515710f40
SHA512 3b5d603e7281e8d489d293af5a6ed3b445e65d5c5c57874e5b4ea45dbe8c880466a46953c463cb9c743f811d6c03e01fe4e39bde5b52ad412ca7951970f5dd06
TLSH
T1FF81C9A1A0B6DC63F12264D7CB38A9D64DD4739F6CCC5A5473098318AB94D33CCEA8E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 edd0aef10a4ef5efeb80bfc77d42c4890f2c20704747c3ddebe9116ba663f6f7
MD5 e31703623360fdcaf8d064d30a5b2d98
SHA1 cd452f4ba2c2ba8fbe379c1a6c45a811c23dbd1f
SHA512 516276ef23edf8cb7aa784da4b1b0b7e66952f27ebe4fd7c89b2aad2f18ee597d2bc436ddf7dd831133d1ee00ec17c7ab5aed3eb972c27abce28da0418342b6c
SSDEEP 96:o771HN+Xo4N+Xxt+XB+w7+X/HN1Qp64pprxMN+X31DFC4FP5+uqN+X31Dc74cOuR:MGMWBC/tk3Fd3b0n
TLSH
T1F981B861A0B6DC63F12254D7DB38A9D54DD4739F68CC5A5473098318ABD4D33CCEA8E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 256adc656e5fc5a8ff39640502db93a4a3314776f1ca71742635822bfe4bbd53
MD5 8a4c06e76e435ed0e600f4031a60eb42
SHA1 780113ee172a03640c0289107e2a49eddb209e98
SHA512 17e366444c1252b91cb6020c284cdaae38afbb7162748e5597dc2dbbe4e1369c4f026b4e7d5d3a1015ef205368174db9a1f9215e0e1d5976292b71aaf5ffb879
SSDEEP 96:o771HN+Xo4N+Xxt+XB+w7+X/HN1Qp64pprxMN+X31DFC4FP5+uqN+X31Dc74cOuT:MGMWBC/tk3Fd3b0aJm
TLSH
T10C919561E0B6DC63F12258D7DB38A9D54E94739FA8CC5A5473098318ABD4D33CCEA8E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 1a236b30792b3d922bf01815050690f8362856461873235ef0df211db9560b8d
MD5 be73e4a64978b3f74591ad1330c1c15d
SHA1 baad4e3d89ba52bc59c925ecd56d3cb0b9d517ff
SHA512 957e260a8835e3e8fe84da5eac5ad53bda117b2fe1eb43178275dc11e99e07f48afd37a773f0bcfbd7014a09baea71cd94499732ed242989d60db163ddb7233c
SSDEEP 96:o771HN+Xo4N+Xxt+XB+w7+X/HN1Qp64pprxMN+X31DFC4FP5+uqN+X31Dc74cOuh:MGMWBC/tk3Fd3b0aJdaZ
TLSH
T128916361E0B6DC63F12258D7DB38A9D54E94739FA8CC5A5473098318ABD4D33CCEA8E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/176-432-0x0000000000B70000-0x0000000000B92000-memory.dmp

Download

memory/176-381-0x0000000000B70000-0x0000000000B92000-memory.dmp

Download

memory/388-12-0x0000000000470000-0x0000000000492000-memory.dmp

Download

memory/440-88-0x0000000000F50000-0x0000000000F72000-memory.dmp

Download

memory/440-31-0x0000000000F50000-0x0000000000F72000-memory.dmp

Download

memory/1260-353-0x0000000000070000-0x0000000000092000-memory.dmp

Download

memory/1260-380-0x0000000000070000-0x0000000000092000-memory.dmp

Download

memory/1312-550-0x0000000000CF0000-0x0000000000D12000-memory.dmp

Download

memory/1320-430-0x00000000009D0000-0x00000000009F2000-memory.dmp

Download

memory/1740-276-0x0000000000C20000-0x0000000000C42000-memory.dmp

Download

memory/1740-190-0x0000000000C20000-0x0000000000C42000-memory.dmp

Download

memory/2208-275-0x00000000003D0000-0x00000000003F2000-memory.dmp

Download

memory/2208-215-0x00000000003D0000-0x00000000003F2000-memory.dmp

Download

memory/2484-323-0x0000000000320000-0x0000000000342000-memory.dmp

Download

memory/2484-354-0x0000000000320000-0x0000000000342000-memory.dmp

Download

memory/2500-84-0x0000000000630000-0x0000000000652000-memory.dmp

Download

memory/2904-396-0x0000000000870000-0x0000000000892000-memory.dmp

Download

memory/2904-331-0x0000000000870000-0x0000000000892000-memory.dmp

Download

memory/3412-90-0x0000000000950000-0x0000000000972000-memory.dmp

Download

memory/3412-189-0x0000000000950000-0x0000000000972000-memory.dmp

Download

memory/3464-549-0x0000000000CF0000-0x0000000000D12000-memory.dmp

Download

memory/3504-277-0x0000000000BB0000-0x0000000000BD2000-memory.dmp

Download

memory/3504-211-0x0000000000BB0000-0x0000000000BD2000-memory.dmp

Download

memory/3552-488-0x00000000002C0000-0x00000000002E2000-memory.dmp

Download

memory/3908-557-0x00000000000A0000-0x00000000000C2000-memory.dmp

Download

memory/4056-302-0x0000000000FC0000-0x0000000000FE2000-memory.dmp

Download

memory/4172-465-0x0000000000D50000-0x0000000000D72000-memory.dmp

Download

memory/4240-191-0x0000000000A00000-0x0000000000A22000-memory.dmp

Download

memory/4240-91-0x0000000000A00000-0x0000000000A22000-memory.dmp

Download

memory/4368-305-0x00000000007B0000-0x00000000007D2000-memory.dmp

Download

memory/4368-336-0x00000000007B0000-0x00000000007D2000-memory.dmp

Download

memory/4372-450-0x00000000009F0000-0x0000000000A12000-memory.dmp

Download

memory/4372-510-0x00000000009F0000-0x0000000000A12000-memory.dmp

Download

memory/4540-89-0x0000000000C70000-0x0000000000C92000-memory.dmp

Download

memory/4540-188-0x0000000000C70000-0x0000000000C92000-memory.dmp

Download

memory/4596-532-0x0000000000E10000-0x0000000000E32000-memory.dmp

Download

memory/4804-472-0x0000000000FA0000-0x0000000000FC2000-memory.dmp

Download

memory/4804-555-0x0000000000FA0000-0x0000000000FC2000-memory.dmp

Download

memory/4920-85-0x0000000000630000-0x0000000000652000-memory.dmp

Download

memory/4948-469-0x0000000000F10000-0x0000000000F32000-memory.dmp

Download

memory/5036-29-0x0000000000F50000-0x0000000000F72000-memory.dmp

Download