893ccac4360b51d08b2c230fa9aa6dd44b32e69c9add35ff553e29a0ca4cd594

Analysis

max time kernel
75s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe
Size 45.6MB
Sample260705-bwacvaby6q
SHA256 893ccac4360b51d08b2c230fa9aa6dd44b32e69c9add35ff553e29a0ca4cd594
MD5 78e4e6ec4b1ad84ec6791c5810bf5438
SHA1 7b46a0b5ef46868ae902548740e418f78ab99d0b
SHA512 ed1a45613c1927afe8534f4c94a17b4ae90fa1fa77e67290d43f8c72a1204fd3648a9e65ccef9b982bf7515788caeb9c15b252375d75c68ff3dcebbc73454710
SSDEEP 786432:oymbqv8l2r2H2cSDXQLcd2BWuFBKLAyomzeXqhb/UYE6uk5jzZ1spR2qsPHeuDDc:bQ72CWcxLcdaDy7zlhDUmOR/EHzwSMwA
TLSH
T134A7331DF2B600DED123607C885AD23AE339BDC55B95C6CB9A198D073F637E0DCA6246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe

Executes dropped EXE 7 IoCs

pid	Process
1852	svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe
5772	svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe
4500	svchost_CBCABCCACCBCBCBABCCBCBBCCBCCBBBCCBAAACCCBACCBCAABABCBAB.exe
4812	svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe
1868	svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe
5264	svchost_BAACBCCCCCBABBABAAABBABBBABACACCABACAAAACCBBCCBBCBCBCCA.exe
5924	svchost_BAACBCCCCCBABBABAAABBABBBABACACCABACAAAACCBBCCBBCBCBCCA.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBCBCCBCCCBABBBACCACBACACBABACBABCBBAABCBBBABBCCBCACBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe"	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACABAACBBCCBABABCBACCABCCBBCACBACABCABCCBABBCBABABAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe"	svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABBACBBABCCBBBCABBACBACABABABBCCAACCCBBCCABACBAACAAACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBABAACABAAACCABCBBBCBCBBCCBCAAACACCBBBCCBABAACACBAABB.exe"	svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe

Launches sc.exe 63 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5660	sc.exe
2536	sc.exe
7124	sc.exe
972	sc.exe
3412	sc.exe
5792	sc.exe
7492	sc.exe
1036	sc.exe
1964	sc.exe
3632	sc.exe
5376	sc.exe
2680	sc.exe
2900	sc.exe
2816	sc.exe
804	sc.exe
5864	sc.exe
900	sc.exe
1388	sc.exe
6056	sc.exe
2108	sc.exe
2188	sc.exe
4896	sc.exe
5424	sc.exe
3488	sc.exe
6456	sc.exe
1532	sc.exe
1576	sc.exe
1536	sc.exe
1220	sc.exe
1564	sc.exe
6776	sc.exe
6032	sc.exe
6192	sc.exe
3448	sc.exe
4072	sc.exe
5860	sc.exe
3064	sc.exe
3736	sc.exe
3740	sc.exe
1792	sc.exe
3024	sc.exe
4708	sc.exe
5732	sc.exe
6284	sc.exe
6904	sc.exe
2932	sc.exe
4960	sc.exe
7016	sc.exe
5348	sc.exe
6720	sc.exe
4860	sc.exe
2820	sc.exe
1108	sc.exe
4260	sc.exe
1164	sc.exe
6512	sc.exe
6152	sc.exe
7364	sc.exe
1320	sc.exe
4940	sc.exe
7032	sc.exe
5016	sc.exe
3716	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCABCCACCBCBCBABCCBCBBCCBCCBBBCCBAAACCCBACCBCAABABCBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 40 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2188	schtasks.exe
2628	schtasks.exe
2344	schtasks.exe
6500	schtasks.exe
2996	schtasks.exe
3156	schtasks.exe
3052	schtasks.exe
2068	schtasks.exe
6824	schtasks.exe
6220	schtasks.exe
6376	schtasks.exe
7016	schtasks.exe
6812	schtasks.exe
3768	schtasks.exe
5236	schtasks.exe
2340	schtasks.exe
2012	schtasks.exe
4180	schtasks.exe
6384	schtasks.exe
2340	schtasks.exe
1516	schtasks.exe
2572	schtasks.exe
1844	schtasks.exe
5692	schtasks.exe
1280	schtasks.exe
6840	schtasks.exe
6200	schtasks.exe
7384	schtasks.exe
2600	schtasks.exe
2136	schtasks.exe
3056	schtasks.exe
4796	schtasks.exe
6760	schtasks.exe
7440	schtasks.exe
2796	schtasks.exe
1820	schtasks.exe
2384	schtasks.exe
1392	schtasks.exe
7528	schtasks.exe
7544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3400	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe
3400	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe
1852	svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe
1852	svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe
5772	svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe
5772	svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe
3400	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe
3400	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe
4500	svchost_CBCABCCACCBCBCBABCCBCBBCCBCCBBBCCBAAACCCBACCBCAABABCBAB.exe
4500	svchost_CBCABCCACCBCBCBABCCBCBBCCBCCBBBCCBAAACCCBACCBCAABABCBAB.exe
1868	svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe
4812	svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe
1868	svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe
4812	svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3400	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe
Token: SeDebugPrivilege	1852	svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe
Token: SeDebugPrivilege	5772	svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe
Token: SeDebugPrivilege	4500	svchost_CBCABCCACCBCBCBABCCBCBBCCBCCBBBCCBAAACCCBACCBCAABABCBAB.exe
Token: SeDebugPrivilege	1868	svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe
Token: SeDebugPrivilege	4812	svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 1816	3400	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe	88
PID 1816 wrote to memory of 2600	1816	cmd.exe	90
PID 3400 wrote to memory of 3460	3400	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe	91
PID 3460 wrote to memory of 972	3460	cmd.exe	93
PID 3400 wrote to memory of 1732	3400	2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe	94
PID 1732 wrote to memory of 3632	1732	cmd.exe	96
PID 1852 wrote to memory of 4900	1852	svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe	101
PID 4900 wrote to memory of 2136	4900	cmd.exe	103
PID 5772 wrote to memory of 4964	5772	svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe	104
PID 1852 wrote to memory of 3760	1852	svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe	106
PID 4964 wrote to memory of 2796	4964	cmd.exe	108
PID 3760 wrote to memory of 2820	3760	cmd.exe	109
PID 1852 wrote to memory of 3720	1852	svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe	110
PID 5772 wrote to memory of 4516	5772	svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe	112
PID 3720 wrote to memory of 5376	3720	cmd.exe	114
PID 4516 wrote to memory of 1532	4516	cmd.exe	115
PID 5772 wrote to memory of 3756	5772	svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe	116
PID 3756 wrote to memory of 3448	3756	cmd.exe	118
PID 4500 wrote to memory of 5676	4500	svchost_CBCABCCACCBCBCBABCCBCBBCCBCCBBBCCBAAACCCBACCBCAABABCBAB.exe	124
PID 5676 wrote to memory of 3768	5676	cmd.exe	126
PID 4500 wrote to memory of 3888	4500	svchost_CBCABCCACCBCBCBABCCBCBBCCBCCBBBCCBAAACCCBACCBCAABABCBAB.exe	127
PID 3888 wrote to memory of 3024	3888	cmd.exe	129
PID 4500 wrote to memory of 2516	4500	svchost_CBCABCCACCBCBCBABCCBCBBCCBCCBBBCCBAAACCCBACCBCAABABCBAB.exe	130
PID 2516 wrote to memory of 4072	2516	cmd.exe	133
PID 4812 wrote to memory of 1204	4812	svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe	136
PID 1868 wrote to memory of 5048	1868	svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe	138
PID 1204 wrote to memory of 2996	1204	cmd.exe	140
PID 5048 wrote to memory of 1844	5048	cmd.exe	141
PID 4812 wrote to memory of 4144	4812	svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe	142
PID 1868 wrote to memory of 2156	1868	svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe	144
PID 4144 wrote to memory of 5860	4144	cmd.exe	146
PID 2156 wrote to memory of 5016	2156	cmd.exe	348
PID 4812 wrote to memory of 5440	4812	svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe	148
PID 1868 wrote to memory of 2804	1868	svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe	152
PID 5440 wrote to memory of 2680	5440	cmd.exe	154
PID 2804 wrote to memory of 1388	2804	cmd.exe	155

C:\Users\Admin\AppData\Local\Temp\2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_78e4e6ec4b1ad84ec6791c5810bf5438_cobalt-strike_elex_hijackloader_icedid_vidar.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCBCCBCCCBABBBACCACBACACBABACBABCBBAABCBBBABBCCBCACBAACBACCBABCAABCABACACCABBBBAABBBCABAACBAABACAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCBCCBCCCBABBBACCACBACACBABACBABCBBAABCBBBABBCCBCACBAACBACCBABCAABCABACACCABBBBAABBBCABAACBAABACAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAAABCCBCACBCABBBCBACBABBBABBBCCCBAABABAABCBCBAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe" start= auto displayName= "UserDataSvc_CBAAABCCBCACBCABBBCBACBABBBABBBCCCBAABABAABCBCBAACB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAAABCCBCACBCABBBCBACBABBBABBBCCCBAABABAABCBCBAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe" start= auto displayName= "UserDataSvc_CBAAABCCBCACBCABBBCBACBABBBABBBCCCBAABABAABCBCBAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAAABCCBCACBCABBBCBACBABBBABBBCCCBAABABAABCBCBAACB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAAABCCBCACBCABBBCBACBABBBABBBCCCBAABABAABCBCBAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3632

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACBCABAAABBBABAAACCBACCCCABABCCCACCBCBACBCBAABAABBBAAABAAACBACCAACCCAACBBAAAABCCAAABBACCABABBABCAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCACCBCBCBABCCBCBBCCBCCBBBCCBAAACCCBACCBCAABABCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACBCABAAABBBABAAACCBACCCCABABCCCACCBCBACBCBAABAABBBAAABAAACBACCAACCCAACBBAAAABCCAAABBACCABABBABCAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCACCBCBCBABCCBCBBCCBCCBBBCCBAAACCCBACCBCAABABCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBABCBAAABACBABBBCBAAABBAACBCBCABACCCCCBACABCABACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCACCBCBCBABCCBCBBCCBCCBBBCCBAAACCCBACCBCAABABCBAB.exe" start= auto displayName= "UserDataSvc_ABBABCBAAABACBABBBCBAAABBAACBCBCABACCCCCBACABCABACC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBABCBAAABACBABBBCBAAABBAACBCBCABACCCCCBACABCABACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCACCBCBCBABCCBCBBCCBCCBBBCCBAAACCCBACCBCAABABCBAB.exe" start= auto displayName= "UserDataSvc_ABBABCBAAABACBABBBCBAAABBAACBCBCABACCCCCBACABCABACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBABCBAAABACBABBBCBAAABBAACBCBCABACCCCCBACABCABACC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBABCBAAABACBABBBCBAAABBAACBCBCABACCCCCBACABCABACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5376

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACABAACBBCCBABABCBACCABCCBBCACBACABCABCCBABBCBABABAAAABBAACBCACCBABABAABBCBAACACCCACAACABBCBBCCCBCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACABAACBBCCBABABCBACCABCCBBCACBACABCABCCBABBCBABABAAAABBAACBCACCBABABAABBCBAACACCCACAACABBCBBCCCBCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBACABBBBBCBBAACCAACBCABCACBAACCAAAAACBBBAABABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe" start= auto displayName= "UserDataSvc_ABBBACABBBBBCBBAACCAACBCABCACBAACCAAAAACBBBAABABBAC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBBACABBBBBCBBAACCAACBCABCACBAACCAAAAACBBBAABABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe" start= auto displayName= "UserDataSvc_ABBBACABBBBBCBBAACCAACBCABCACBAACCAAAAACBBBAABABBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBACABBBBBCBBAACCAACBCABCACBAACCAAAAACBBBAABABBAC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBBACABBBBBCBBAACCAACBCABCACBAACCAAAAACBBBAABABBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCACCBCBCBABCCBCBBCCBCCBBBCCBAAACCCBACCBCAABABCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCACCBCBCBABCCBCBBCCBCCBBBCCBAAACCCBACCBCAABABCBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBABCABBAAAABCABABBCABBABACACCBBACCCCCCCAAABBAABBBBBAABBCACCAAABACBCCCBBACBCCBCCBBCBCACACBCACBABBABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCCCCCBABBABAAABBABBBABACACCABACAAAACCBBCCBBCBCBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBABCABBAAAABCABABBCABBABACACCBBACCCCCCCAAABBAABBBBBAABBCACCAAABACBCCCBBACBCCBCCBBCBCACACBCACBABBABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCCCCCBABBABAAABBABBBABACACCABACAAAACCBBCCBBCBCBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBBCCBAAAABCABACACBCBCBBBAACCABBBBBACBBBCBBABBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCCCCCBABBABAAABBABBBABACACCABACAAAACCBBCCBBCBCBCCA.exe" start= auto displayName= "UserDataSvc_CABBBCCBAAAABCABACACBCBCBBBAACCABBBBBACBBBCBBABBABA"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABBBCCBAAAABCABACACBCBCBBBAACCABBBBBACBBBCBBABBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCCCCCBABBABAAABBABBBABACACCABACAAAACCBBCCBBCBCBCCA.exe" start= auto displayName= "UserDataSvc_CABBBCCBAAAABCABACACBCBCBBBAACCABBBBBACBBBCBBABBABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBBCCBAAAABCABACACBCBCBBBAACCABBBBBACBBBCBBABBABA"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABBBCCBAAAABCABACACBCBCBBBAACCABBBBBACBBBCBBABBABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4072

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCCBACBCCBCCBBACAABCBCBCBCCCAAAABBAAAACCBABCAAABCBAACCAACACCCABABACBCBBAACBAABABABBCBCAACACBABBAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACCABABACCBCACABACBBAAABBCCACBCCBAACABBABCCBABACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCCBACBCCBCCBBACAABCBCBCBCCCAAAABBAAAACCBABCAAABCBAACCAACACCCABABACBCBBAACBAABABABBCBCAACACBABBAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACCABABACCBCACABACBBAAABBCCACBCCBAACABBABCCBABACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAABCBCACCABACCBBCBCABBBBCACABACCACBBACCBABBACCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACCABABACCBCACABACBBAAABBCCACBCCBAACABBABCCBABACCAB.exe" start= auto displayName= "UserDataSvc_CAAABCBCACCABACCBBCBCABBBBCACABACCACBBACCBABBACCAAA"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAABCBCACCABACCBBCBCABBBBCACABACCACBBACCBABBACCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACCABABACCBCACABACBBAAABBCCACBCCBAACABBABCCBABACCAB.exe" start= auto displayName= "UserDataSvc_CAAABCBCACCABACCBBCBCABBBBCACABACCACBBACCBABBACCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAABCBCACCABACCBBCBCABBBBCACABACCACBBACCBABBACCAAA"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAABCBCACCABACCBBCBCABBBBCACABACCACBBACCBABBACCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1388

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBAACACBCCBBBCBABAABACBCCAABCBBBBBACCACACCBBCCBBABCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBACBBABCCBBBCABBACBACABABABBCCAACCCBBCCABACBAACAAACBCACCBABACCCBBCBABACAABCBBABBBCAABBBAACCBBABCBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABAACABAAACCABCBBBCBCBBCCBCAAACACCBBBCCBABAACACBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBACBBABCCBBBCABBACBACABABABBCCAACCCBBCCABACBAACAAACBCACCBABACCCBBCBABACAABCBBABBBCAABBBAACCBBABCBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABAACABAAACCABCBBBCBCBBCCBCAAACACCBBBCCBABAACACBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCBBBBAACAAABCABCCCCBBBBCCACACBBCBCACABBABCBACCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABAACABAAACCABCBBBCBCBBCCBCAAACACCBBBCCBABAACACBAABB.exe" start= auto displayName= "UserDataSvc_CCCBBBBAACAAABCABCCCCBBBBCCACACBBCBCACABBABCBACCAAA"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCBBBBAACAAABCABCCCCBBBBCCACACBBCBCACABBABCBACCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABAACABAAACCABCBBBCBCBBCCBCAAACACCBBBCCBABAACACBAABB.exe" start= auto displayName= "UserDataSvc_CCCBBBBAACAAABCABCCCCBBBBCCACACBBCBCACABBABCBACCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCBBBBAACAAABCABCCCCBBBBCCACACBBCBCACABBABCBACCAAA"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5440
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCBBBBAACAAABCABCCCCBBBBCCACACBBCBCACABBABCBACCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2680

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCCCCCBABBABAAABBABBBABACACCABACAAAACCBBCCBBCBCBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCCCCCBABBABAAABBABBBABACACCABACAAAACCBBCCBBCBCBCCA.exe
1⤵
- Executes dropped EXE
PID:5924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBACCABAACBABBCACACACCABBCCBCCABBCACCCBCBBBABBCCCACAABBCBBCAAABBCAAAABACBACCCBCBBABBCACACCABABBCAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCACABCBBBABBCBBABCCACCBCCBAABCACCBBBABBAABCAACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBACCABAACBABBCACACACCABBCCBCCABBCACCCBCBBBABBCCCACAABBCBBCAAABBCAAAABACBACCCBCBBABBCACACCABABBCAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCACABCBBBABBCBBABCCACCBCCBAABCACCBBBABBAABCAACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACABCBBAAAAACCBBACABABACACBBBCCACCCABABCBBAAAAABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCACABCBBBABBCBBABCCACCBCCBAABCACCBBBABBAABCAACBAC.exe" start= auto displayName= "UserDataSvc_AACABCBBAAAAACCBBACABABACACBBBCCACCCABABCBBAAAAABAB"
  2⤵
  PID:5720
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACABCBBAAAAACCBBACABABACACBBBCCACCCABABCBBAAAAABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCACABCBBBABBCBBABCCACCBCCBAABCACCBBBABBAABCAACBAC.exe" start= auto displayName= "UserDataSvc_AACABCBBAAAAACCBBACABABACACBBBCCACCCABABCBBAAAAABAB"
    3⤵
    - Launches sc.exe
    PID:3716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACABCBBAAAAACCBBACABABACACBBBCCACCCABABCBBAAAAABAB"
  2⤵
  PID:4480
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACABCBBAAAAACCBBACABABACACBBBCCACCCABABCBBAAAAABAB"
    3⤵
    - Launches sc.exe
    PID:4960

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCCCCCBABBABAAABBABBBABACACCABACAAAACCBBCCBBCBCBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCCCCCBABBABAAABBABBBABACACCABACAAAACCBBCCBBCBCBCCA.exe
1⤵
- Executes dropped EXE
PID:5264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBBBBBBACABBACBAABCACBACACACAACABCCAABCABBBAACAAAAAABCABABCBACCBBBBABBBAAACACCCBBACABCCCCAAAACBCBACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCCBCABCCABBBAACBBCAACBCCBACBACABCCCBBCCCCCCBBCBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBBBBBBACABBACBAABCACBACACACAACABCCAABCABBBAACAAAAAABCABABCBACCBBBBABBBAAACACCCBBACABCCCCAAAACBCBACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCCBCABCCABBBAACBBCAACBCCBACBACABCCCBBCCCCCCBBCBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBCBBCBABCAABCCCAAACCBCBCCCCCABBACBBBBACACAAAACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCCBCABCCABBBAACBBCAACBCCBACBACABCCCBBCCCCCCBBCBBBC.exe" start= auto displayName= "UserDataSvc_ACCBCBBCBABCAABCCCAAACCBCBCCCCCABBACBBBBACACAAAACAC"
  2⤵
  PID:3300
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBCBBCBABCAABCCCAAACCBCBCCCCCABBACBBBBACACAAAACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCCBCABCCABBBAACBBCAACBCCBACBACABCCCBBCCCCCCBBCBBBC.exe" start= auto displayName= "UserDataSvc_ACCBCBBCBABCAABCCCAAACCBCBCCCCCABBACBBBBACACAAAACAC"
    3⤵
    - Launches sc.exe
    PID:1108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBCBBCBABCAABCCCAAACCBCBCCCCCABBACBBBBACACAAAACAC"
  2⤵
  PID:5332
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBCBBCBABCAABCCCAAACCBCBCCCCCABBACBBBBACACAAAACAC"
    3⤵
    - Launches sc.exe
    PID:2900

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABAACABAAACCABCBBBCBCBBCCBCAAACACCBBBCCBABAACACBAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABAACABAAACCABCBBBCBCBBCCBCAAACACCBBBCCBABAACACBAABB.exe
1⤵
PID:4832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCCBCBBAAAACCBBACCCABACBAACACAAAABCAACCCBBBCCBCBCCBBCACACCCBACABCABBBCBBAABCAACBCAABABCABCCBBACCCCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCCBCAACACCAAACACABCCBBCCBBBAAABCBCCCABABBCBCABBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCCBCBBAAAACCBBACCCABACBAACACAAAABCAACCCBBBCCBCBCCBBCACACCCBACABCABBBCBBAABCAACBCAABABCABCCBBACCCCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCCBCAACACCAAACACABCCBBCCBBBAAABCBCCCABABBCBCABBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2572

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABAACABAAACCABCBBBCBCBBCCBCAAACACCBBBCCBABAACACBAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABAACABAAACCABCBBBCBCBBCCBCAAACACCBBBCCBABAACACBAABB.exe
1⤵
PID:3076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCABABCCCABCAABCABBBBACAABACCACCABAAACCACBCCCCACCCBAACCBCBBCBABBCBBBACCCBCCABBBACACBCBABAABCCAACCCBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCBAAACBCCABBCABCACACBCCBBAAAACABBBBAACBBCCABAABAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCABABCCCABCAABCABBBBACAABACCACCABAAACCACBCCCCACCCBAACCBCBBCBABBCBBBACCCBCCABBBACACBCBABAABCCAACCCBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCBAAACBCCABBCABCACACBCCBBAAAACABBBBAACBBCCABAABAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAAACABBCCCCCABBABAAACBABCCCACACAABAACAACACCCCBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCBAAACBCCABBCABCACACBCCBBAAAACABBBBAACBBCCABAABAAC.exe" start= auto displayName= "UserDataSvc_BBAAACABBCCCCCABBABAAACBABCCCACACAABAACAACACCCCBBAC"
  2⤵
  PID:3120
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAAACABBCCCCCABBABAAACBABCCCACACAABAACAACACCCCBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCBAAACBCCABBCABCACACBCCBBAAAACABBBBAACBBCCABAABAAC.exe" start= auto displayName= "UserDataSvc_BBAAACABBCCCCCABBABAAACBABCCCACACAABAACAACACCCCBBAC"
    3⤵
    - Launches sc.exe
    PID:3064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAAACABBCCCCCABBABAAACBABCCCACACAABAACAACACCCCBBAC"
  2⤵
  PID:4700
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAAACABBCCCCCABBABAAACBABCCCACACAABAACAACACCCCBBAC"
    3⤵
    - Launches sc.exe
    PID:1036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACCABABACCBCACABACBBAAABBCCACBCCBAACABBABCCBABACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACCABABACCBCACABACBBAAABBCCACBCCBAACABBABCCBABACCAB.exe
1⤵
PID:264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAAACCACCACCAAABAABBBABCCABCBACAAACCAACACBABCABAABBCCACBBCBABCABBCACAACCAACABCABAACABBCBAABBBBCBBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACCCBBCBBBACAACBAACBCBAAAABAAAABABCCBBAACBABAACCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAAACCACCACCAAABAABBBABCCABCBACAAACCAACACBABCABAABBCCACBBCBABCABBCACAACCAACABCABAACABBCBAABBBBCBBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACCCBBCBBBACAACBAACBCBAAAABAAAABABCCBBAACBABAACCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBBBBCCAAACCBAABABBACCABACBCAABBBCABBCBCCBAABBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACCCBBCBBBACAACBAACBCBAAAABAAAABABCCBBAACBABAACCCAC.exe" start= auto displayName= "UserDataSvc_ABCBBBBCCAAACCBAABABBACCABACBCAABBBCABBCBCCBAABBCAC"
  2⤵
  PID:1636
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBBBBCCAAACCBAABABBACCABACBCAABBBCABBCBCCBAABBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACCCBBCBBBACAACBAACBCBAAAABAAAABABCCBBAACBABAACCCAC.exe" start= auto displayName= "UserDataSvc_ABCBBBBCCAAACCBAABABBACCABACBCAABBBCABBCBCCBAABBCAC"
    3⤵
    - Launches sc.exe
    PID:1564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBBBBCCAAACCBAABABBACCABACBCAABBBCABBCBCCBAABBCAC"
  2⤵
  PID:4524
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBBBBCCAAACCBAABABBACCABACBCAABBBCABBCBCCBAABBCAC"
    3⤵
    - Launches sc.exe
    PID:4940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACCABABACCBCACABACBBAAABBCCACBCCBAACABBABCCBABACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACCABABACCBCACABACBBAAABBCCACBCCBAACABBABCCBABACCAB.exe
1⤵
PID:4212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBACBACBBBAAABBBABACACBBBACCBBCACABCABCCAACBABCCAAACCBBCBCACCCCBCABBBAACCCCAABABCBACAAABCCACACCACCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCAABCABABCBCAACBBCCCBCABCCABABCBBCABCCBABBBCBBAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2796
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBACBACBBBAAABBBABACACBBBACCBBCACABCABCCAACBABCCAAACCBBCBCACCCCBCABBBAACCCCAABABCBACAAABCCACACCACCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCAABCABABCBCAACBBCCCBCABCCABABCBBCABCCBABBBCBBAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABABCBAABBAABBABBBCCCBCABBCCBCCBACABACABABCBAABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCAABCABABCBCAACBBCCCBCABCCABABCBBCABCCBABBBCBBAAAA.exe" start= auto displayName= "UserDataSvc_BABABCBAABBAABBABBBCCCBCABBCCBCCBACABACABABCBAABBAC"
  2⤵
  PID:1284
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABABCBAABBAABBABBBCCCBCABBCCBCCBACABACABABCBAABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCAABCABABCBCAACBBCCCBCABCCABABCBBCABCCBABBBCBBAAAA.exe" start= auto displayName= "UserDataSvc_BABABCBAABBAABBABBBCCCBCABBCCBCCBACABACABABCBAABBAC"
    3⤵
    - Launches sc.exe
    PID:1320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABABCBAABBAABBABBBCCCBCABBCCBCCBACABACABABCBAABBAC"
  2⤵
  PID:2700
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABABCBAABBAABBABBBCCCBCABBCCBCCBACABACABABCBAABBAC"
    3⤵
    - Launches sc.exe
    PID:3412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACCCBBCBBBACAACBAACBCBAAAABAAAABABCCBBAACBABAACCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACCCBBCBBBACAACBAACBCBAAAABAAAABABCCBBAACBABAACCCAC.exe
1⤵
PID:5896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAABBCABBCCCCABACCBABCBCBABBCBABBACCBACBCBBAABCCCBCACCBABCBCBCCACCAAABCBCCCABCCCABAACCCBABBBCABCBAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBABCCCCACCCAACCCABAABBAAABACCCABABBCCCACCCABBBCBCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAABBCABBCCCCABACCBABCBCBABBCBABBACCBACBCBBAABCCCBCACCBABCBCBCCACCAAABCBCCCABCCCABAACCCBABBBCABCBAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBABCCCCACCCAACCCABAABBAAABACCCABABBCCCACCCABBBCBCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCABCBBCBACACABCCBBCBABAACCACBAACCBCBACCBCBBCAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBABCCCCACCCAACCCABAABBAAABACCCABABBCCCACCCABBBCBCCCB.exe" start= auto displayName= "UserDataSvc_BBCABCBBCBACACABCCBBCBABAACCACBAACCBCBACCBCBBCAACBB"
  2⤵
  PID:4164
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCABCBBCBACACABCCBBCBABAACCACBAACCBCBACCBCBBCAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBABCCCCACCCAACCCABAABBAAABACCCABABBCCCACCCABBBCBCCCB.exe" start= auto displayName= "UserDataSvc_BBCABCBBCBACACABCCBBCBABAACCACBAACCBCBACCBCBBCAACBB"
    3⤵
    - Launches sc.exe
    PID:6056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCABCBBCBACACABCCBBCBABAACCACBAACCBCBACCBCBBCAACBB"
  2⤵
  PID:2964
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCABCBBCBACACABCCBBCBABAACCACBAACCBCBACCBCBBCAACBB"
    3⤵
    - Launches sc.exe
    PID:5660

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCAABCABABCBCAACBBCCCBCABCCABABCBBCABCCBABBBCBBAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCAABCABABCBCAACBBCCCBCABCCABABCBBCABCCBABBBCBBAAAA.exe
1⤵
PID:1348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAACBAACBCCAAACAAABBACAABBBACACABCACABAAABBACBABCBABABBCBCCBBABABBCCBBBABCBAACACAACCABCCBAAAACBACAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABCCCAAABAABAACBCAAAABABABCBACABBACBCCACABCCBCBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2352
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAACBAACBCCAAACAAABBACAABBBACACABCACABAAABBACBABCBABABBCBCCBBABABBCCBBBABCBAACACAACCABCCBAAAACBACAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABCCCAAABAABAACBCAAAABABABCBACABBACBCCACABCCBCBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCBACCBBCCBBCCBACBBCBABACACACBCCCABACBAACCCACACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABCCCAAABAABAACBCAAAABABABCBACABBACBCCACABCCBCBCAC.exe" start= auto displayName= "UserDataSvc_ABCCBACCBBCCBBCCBACBBCBABACACACBCCCABACBAACCCACACCA"
  2⤵
  PID:2076
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCCBACCBBCCBBCCBACBBCBABACACACBCCCABACBAACCCACACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABCCCAAABAABAACBCAAAABABABCBACABBACBCCACABCCBCBCAC.exe" start= auto displayName= "UserDataSvc_ABCCBACCBBCCBBCCBACBBCBABACACACBCCCABACBAACCCACACCA"
    3⤵
    - Launches sc.exe
    PID:804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCCBACCBBCCBBCCBACBBCBABACACACBCCCABACBAACCCACACCA"
  2⤵
  PID:5296
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCCBACCBBCCBBCCBACBBCBABACACACBCCCABACBAACCCACACCA"
    3⤵
    - Launches sc.exe
    PID:2816

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCCBCABCCABBBAACBBCAACBCCBACBACABCCCBBCCCCCCBBCBBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCCBCABCCABBBAACBBCAACBCCBACBACABCCCBBCCCCCCBBCBBBC.exe
1⤵
PID:1356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBBAAACCACACACBAACABBABCCBAAAABBCBBACBABBBBBCBCCCCBCCCCCBAABCCAAABABAABBBBCACBCBBCBCBCAACAAACACCCCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCABAAACABAACBBABABCBAABBBACBBBACCBABAACBBCCCCACCCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBBAAACCACACACBAACABBABCCBAAAABBCBBACBABBBBBCBCCCCBCCCCCBAABCCAAABABAABBBBCACBCBBCBCBCAACAAACACCCCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCABAAACABAACBBABABCBAABBBACBBBACCBABAACBBCCCCACCCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACACCBBCAABABABBCBBACCBACCCCAACBACCCCCBACBACCBCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCABAAACABAACBBABABCBAABBBACBBBACCBABAACBBCCCCACCCBAB.exe" start= auto displayName= "UserDataSvc_AACACCBBCAABABABBCBBACCBACCCCAACBACCCCCBACBACCBCBBA"
  2⤵
  PID:4308
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACACCBBCAABABABBCBBACCBACCCCAACBACCCCCBACBACCBCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCABAAACABAACBBABABCBAABBBACBBBACCBABAACBBCCCCACCCBAB.exe" start= auto displayName= "UserDataSvc_AACACCBBCAABABABBCBBACCBACCCCAACBACCCCCBACBACCBCBBA"
    3⤵
    - Launches sc.exe
    PID:5864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACACCBBCAABABABBCBBACCBACCCCAACBACCCCCBACBACCBCBBA"
  2⤵
  PID:764
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACACCBBCAABABABBCBBACCBACCCCAACBACCCCCBACBACCBCBBA"
    3⤵
    - Launches sc.exe
    PID:1220

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCACABCBBBABBCBBABCCACCBCCBAABCACCBBBABBAABCAACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCACABCBBBABBCBBABCCACCBCCBAABCACCBBBABBAABCAACBAC.exe
1⤵
PID:2840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACCBCACAABBAACACBBCBAACAAABBAAABBCCBCABBCACCBAABCCBBACCAAABBACBBCBCCCBCAAACABBAACAABBBCCBCCBACACBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCBBCBAACACBACBCACACACBACBBCCCAABAACCBCAAACABBABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACCBCACAABBAACACBBCBAACAAABBAAABBCCBCABBCACCBAABCCBBACCAAABBACBBCBCCCBCAAACABBAACAABBBCCBCCBACACBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCBBCBAACACBACBCACACACBACBBCCCAABAACCBCAAACABBABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAAACCBACCBBBBAACBBABCBCACCACBBAACBABAAABAABCABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCBBCBAACACBACBCACACACBACBBCCCAABAACCBCAAACABBABCCA.exe" start= auto displayName= "UserDataSvc_CCAAACCBACCBBBBAACBBABCBCACCACBBAACBABAAABAABCABBBC"
  2⤵
  PID:2592
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAAACCBACCBBBBAACBBABCBCACCACBBAACBABAAABAABCABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCBBCBAACACBACBCACACACBACBBCCCAABAACCBCAAACABBABCCA.exe" start= auto displayName= "UserDataSvc_CCAAACCBACCBBBBAACBBABCBCACCACBBAACBABAAABAABCABBBC"
    3⤵
    - Launches sc.exe
    PID:1164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAAACCBACCBBBBAACBBABCBCACCACBBAACBABAAABAABCABBBC"
  2⤵
  PID:2404
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCAAACCBACCBBBBAACBBABCBCACCACBBAACBABAAABAABCABBBC"
    3⤵
    - Launches sc.exe
    PID:1576

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCACABCBBBABBCBBABCCACCBCCBAABCACCBBBABBAABCAACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCACABCBBBABBCBBABCCACCBCCBAABCACCBBBABBAABCAACBAC.exe
1⤵
PID:2752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCCBBBBCCCACCAABCABBACBABBCCCACCCBAACACBCABACCCCCCAACABBCABBCBCACCACABBABCBAAACCBBBACAABCCCBBAAAACABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBAABACACCBBCACCCBBCBCBCACBBBACCAACCBABBACCBCACBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCCBBBBCCCACCAABCABBACBABBCCCACCCBAACACBCABACCCCCCAACABBCABBCBCACCACABBABCBAAACCBBBACAABCCCBBAAAACABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBAABACACCBBCACCCBBCBCBCACBBBACCAACCBABBACCBCACBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAACABBCCCABBCBBBCAABBABAACCAAAAAAAABBBCABCABAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBAABACACCBBCACCCBBCBCBCACBBBACCAACCBABBACCBCACBACCC.exe" start= auto displayName= "UserDataSvc_ABAACABBCCCABBCBBBCAABBABAACCAAAAAAAABBBCABCABAAABB"
  2⤵
  PID:2388
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAACABBCCCABBCBBBCAABBABAACCAAAAAAAABBBCABCABAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBAABACACCBBCACCCBBCBCBCACBBBACCAACCBABBACCBCACBACCC.exe" start= auto displayName= "UserDataSvc_ABAACABBCCCABBCBBBCAABBABAACCAAAAAAAABBBCABCABAAABB"
    3⤵
    - Launches sc.exe
    PID:1964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAACABBCCCABBCBBBCAABBABAACCAAAAAAAABBBCABCABAAABB"
  2⤵
  PID:3020
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAACABBCCCABBCBBBCAABBABAACCAAAAAAAABBBCABCABAAABB"
    3⤵
    - Launches sc.exe
    PID:5424

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBABCCCCACCCAACCCABAABBAAABACCCABABBCCCACCCABBBCBCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBABCCCCACCCAACCCABAABBAAABACCCABABBCCCACCCABBBCBCCCB.exe
1⤵
PID:3080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBBBBBBBCBCCACBAAAAABCCACCAACBBAACBCBACCABCABABCCCAACACAABCBCBBACBCACCBCAACBBCBBBBBAACAAABBCCCBBBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCABBCCCCCCABBCBBBCCCABBAACBABCABCCBBACCAABCCBCBBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBBBBBBBCBCCACBAAAAABCCACCAACBBAACBCBACCABCABABCCCAACACAABCBCBBACBCACCBCAACBBCBBBBBAACAAABBCCCBBBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCABBCCCCCCABBCBBBCCCABBAACBABCABCCBBACCAABCCBCBBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6812

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBABCCCCACCCAACCCABAABBAAABACCCABABBCCCACCCABBBCBCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBABCCCCACCCAACCCABAABBAAABACCCABABBCCCACCCABBBCBCCCB.exe
1⤵
PID:996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACAACBACCBCCBAAABBABBCBACACCBACACCACBACCCCBBBCBAABAACCCCCACACBBCBCABABABBACCCCBCABAACCABCACABBBCACCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACAAAABCBCCBCAAACBCBAAABCCCABACBBBCAABBBBAABBCBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACAACBACCBCCBAAABBABBCBACACCBACACCACBACCCCBBBCBAABAACCCCCACACBBCBCABABABBACCCCBCABAACCABCACABBBCACCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACAAAABCBCCBCAAACBCBAAABCCCABACBBBCAABBBBAABBCBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBCAABCCABABBACBCACABABACACBCBAACBCCCACCBCBACBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACAAAABCBCCBCAAACBCBAAABCCCABACBBBCAABBBBAABBCBACB.exe" start= auto displayName= "UserDataSvc_AABBCAABCCABABBACBCACABABACACBCBAACBCCCACCBCBACBBAB"
  2⤵
  PID:6316
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBCAABCCABABBACBCACABABACACBCBAACBCCCACCBCBACBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACAAAABCBCCBCAAACBCBAAABCCCABACBBBCAABBBBAABBCBACB.exe" start= auto displayName= "UserDataSvc_AABBCAABCCABABBACBCACABABACACBCBAACBCCCACCBCBACBBAB"
    3⤵
    - Launches sc.exe
    PID:6776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBCAABCCABABBACBCACABABACACBCBAACBCCCACCBCBACBBAB"
  2⤵
  PID:6844
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBCAABCCABABBACBCACABABACACBCBAACBCCCACCBCBACBBAB"
    3⤵
    - Launches sc.exe
    PID:1792

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABCCCAAABAABAACBCAAAABABABCBACABBACBCCACABCCBCBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABCCCAAABAABAACBCAAAABABABCBACABBACBCCACABCCBCBCAC.exe
1⤵
PID:1976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABBABABACACACBBABCABBCCBCAACBABAACCCBBABAABAAABABAABACBBAABACCBBCAABCBBCAACCCAAAABBBCAAACAAACCABCACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBBAABCCABCBBBAABCCCBBABABCBBCCABBBCACAACBACCAABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABBABABACACACBBABCABBCCBCAACBABAACCCBBABAABAAABABAABACBBAABACCBBCAABCBBCAACCCAAAABBBCAAACAAACCABCACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBBAABCCABCBBBAABCCCBBABABCBBCCABBBCACAACBACCAABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCACAABACCBBCCBBABCAABCBACBBCBBCCBCAABCABBCBBBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBBAABCCABCBBBAABCCCBBABABCBBCCABBBCACAACBACCAABBCC.exe" start= auto displayName= "UserDataSvc_ACCCACAABACCBBCCBBABCAABCBACBBCBBCCBCAABCABBCBBBBBA"
  2⤵
  PID:5616
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCACAABACCBBCCBBABCAABCBACBBCBBCCBCAABCABBCBBBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBBAABCCABCBBBAABCCCBBABABCBBCCABBBCACAACBACCAABBCC.exe" start= auto displayName= "UserDataSvc_ACCCACAABACCBBCCBBABCAABCBACBBCBBCCBCAABCABBCBBBBBA"
    3⤵
    - Launches sc.exe
    PID:4708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCACAABACCBBCCBBABCAABCBACBBCBBCCBCAABCABBCBBBBBA"
  2⤵
  PID:1824
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCACAABACCBBCCBBABCAABCBACBBCBBCCBCAABCABBCBBBBBA"
    3⤵
    - Launches sc.exe
    PID:2536

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABCCCAAABAABAACBCAAAABABABCBACABBACBCCACABCCBCBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABCCCAAABAABAACBCAAAABABABCBACABBACBCCACABCCBCBCAC.exe
1⤵
PID:2908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCCAABACCCBBBAAAABACABCAABCBABBBBABBBCBBBBAAACBAACBCCCCCABAABBCACAACBCBCCACAAAACCAABACBABAABCBBABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABBBCCCAACCBBAAACBCBABBAAACBBCABCCBBAABAAABAAAACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCCAABACCCBBBAAAABACABCAABCBABBBBABBBCBBBBAAACBAACBCCCCCABAABBCACAACBCBCCACAAAACCAABACBABAABCBBABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABBBCCCAACCBBAAACBCBABBAAACBBCABCCBBAABAAABAAAACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBAABABACBABBCCAABACCCCACBBAACCCCCCCABACCBBBAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABBBCCCAACCBBAAACBCBABBAAACBBCABCCBBAABAAABAAAACBAC.exe" start= auto displayName= "UserDataSvc_CACBAABABACBABBCCAABACCCCACBBAACCCCCCCABACCBBBAABBA"
  2⤵
  PID:5192
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBAABABACBABBCCAABACCCCACBBAACCCCCCCABACCBBBAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABBBCCCAACCBBAAACBCBABBAAACBBCABCCBBAABAAABAAAACBAC.exe" start= auto displayName= "UserDataSvc_CACBAABABACBABBCCAABACCCCACBBAACCCCCCCABACCBBBAABBA"
    3⤵
    - Launches sc.exe
    PID:4260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBAABABACBABBCCAABACCCCACBBAACCCCCCCABACCBBBAABBA"
  2⤵
  PID:1332
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBAABABACBABBCCAABACCCCACBBAACCCCCCCABACCBBBAABBA"
    3⤵
    - Launches sc.exe
    PID:3736

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCBAAACBCCABBCABCACACBCCBBAAAACABBBBAACBBCCABAABAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCBAAACBCCABBCABCACACBCCBBAAAACABBBBAACBBCCABAABAAC.exe
1⤵
PID:2608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACAAABCBABCCBBAACBABACCCCCBCAABACBBCBBBCBCBCBBCABBBBBCACACCBCCAACACAAACAACACABACAACAABAACCACBCABACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABABCBBCCABACCBCBCBBAAAABABBBACCBCACBACCCABAAAABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACAAABCBABCCBBAACBABACCCCCBCAABACBBCBBBCBCBCBBCABBBBBCACACCBCCAACACAAACAACACABACAACAABAACCACBCABACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABABCBBCCABACCBCBCBBAAAABABBBACCBCACBACCCABAAAABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABBACCABBCABBBCCABCAACCBABBACAACBABCCCAACACCAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABABCBBCCABACCBCBCBBAAAABABBBACCBCACBACCCABAAAABCAC.exe" start= auto displayName= "UserDataSvc_BAABBACCABBCABBBCCABCAACCBABBACAACBABCCCAACACCAAABB"
  2⤵
  PID:2976
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABBACCABBCABBBCCABCAACCBABBACAACBABCCCAACACCAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABABCBBCCABACCBCBCBBAAAABABBBACCBCACBACCCABAAAABCAC.exe" start= auto displayName= "UserDataSvc_BAABBACCABBCABBBCCABCAACCBABBACAACBABCCCAACACCAAABB"
    3⤵
    - Launches sc.exe
    PID:5732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABBACCABBCABBBCCABCAACCBABBACAACBABCCCAACACCAAABB"
  2⤵
  PID:2348
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABBACCABBCABBBCCABCAACCBABBACAACBABCCCAACACCAAABB"
    3⤵
    - Launches sc.exe
    PID:3740

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCBAAACBCCABBCABCACACBCCBBAAAACABBBBAACBBCCABAABAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCBAAACBCCABBCABCACACBCCBBAAAACABBBBAACBBCCABAABAAC.exe
1⤵
PID:4528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABAAAAAABCCCBCAABCCBACAAAAAABACCABBCBABCBACCBAAABBCBBCBABCCBCCCABACABCABBAACBBACCACCCAACAACAAAABBCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBAACCBBCACACBCACAABCAAACCBCABBCBCCCCACABCCCBACBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABAAAAAABCCCBCAABCCBACAAAAAABACCABBCBABCBACCBAAABBCBBCBABCCBCCCABACABCABBAACBBACCACCCAACAACAAAABBCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBAACCBBCACACBCACAABCAAACCBCABBCBCCCCACABCCCBACBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCCBAABACCACBCCCAABABCBBCBACCBBCBBCABCCBBCABBACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBAACCBBCACACBCACAABCAAACCBCABBCBCCCCACABCCCBACBAB.exe" start= auto displayName= "UserDataSvc_BACCCBAABACCACBCCCAABABCBBCBACCBBCBBCABCCBBCABBACCA"
  2⤵
  PID:1844
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCCBAABACCACBCCCAABABCBBCBACCBBCBBCABCCBBCABBACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBAACCBBCACACBCACAABCAAACCBCABBCBCCCCACABCCCBACBAB.exe" start= auto displayName= "UserDataSvc_BACCCBAABACCACBCCCAABABCBBCBACCBBCBBCABCCBBCABBACCA"
    3⤵
    - Launches sc.exe
    PID:1536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCCBAABACCACBCCCAABABCBBCBACCBBCBBCABCCBBCABBACCA"
  2⤵
  PID:2732
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCCBAABACCACBCCCAABABCBBCBACCBBCBBCABCCBBCABBACCA"
    3⤵
    - Launches sc.exe
    PID:2108

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCCBCAACACCAAACACABCCBBCCBBBAAABCBCCCABABBCBCABBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCCBCAACACCAAACACABCCBBCCBBBAAABCBCCCABABBCBCABBBCA.exe
1⤵
PID:2064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABBABBABABCABCCCACACAABBBCBCCCBCCBACCBBBCBBCCBAABBBCBBABABCBCBCABBBAABCCCBBBCACBCBCCABBCBABAAAABCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCBABBCACBCBCCCACBBACBBCCBABBCABBCBCBBCBABCBABCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABBABBABABCABCCCACACAABBBCBCCCBCCBACCBBBCBBCCBAABBBCBBABABCBCBCABBBAABCCCBBBCACBCBCCABBCBABAAAABCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCBABBCACBCBCCCACBBACBBCCBABBCABBCBCBBCBABCBABCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCABCAACACBABCBAABCCBACCBACACBBBBCACCACCCCBCBBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCBABBCACBCBCCCACBBACBBCCBABBCABBCBCBBCBABCBABCCAA.exe" start= auto displayName= "UserDataSvc_BABCABCAACACBABCBAABCCBACCBACACBBBBCACCACCCCBCBBCAC"
  2⤵
  PID:5944
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABCABCAACACBABCBAABCCBACCBACACBBBBCACCACCCCBCBBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCBABBCACBCBCCCACBBACBBCCBABBCABBCBCBBCBABCBABCCAA.exe" start= auto displayName= "UserDataSvc_BABCABCAACACBABCBAABCCBACCBACACBBBBCACCACCCCBCBBCAC"
    3⤵
    - Launches sc.exe
    PID:2188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABCABCAACACBABCBAABCCBACCBACACBBBBCACCACCCCBCBBCAC"
  2⤵
  PID:1240
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABCABCAACACBABCBAABCCBACCBACACBBBBCACCACCCCBCBBCAC"
    3⤵
    - Launches sc.exe
    PID:3488

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCABAAACABAACBBABABCBAABBBACBBBACCBABAACBBCCCCACCCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCABAAACABAACBBABABCBAABBBACBBBACCBABAACBBCCCCACCCBAB.exe
1⤵
PID:3668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBBAABCBACBBABACABBBBBBCCAACBABBCACACBCCACAACBBCABAAABBACAAAACBABCABCAABBACCBACBAAAABAACACCBABCBCBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCAAACBACBCAACCBAACBBCACCCACABCBCACCBCBBCBABCBACCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBBAABCBACBBABACABBBBBBCCAACBABBCACACBCCACAACBBCABAAABBACAAAACBABCABCAABBACCBACBAAAABAACACCBABCBCBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCAAACBACBCAACCBAACBBCACCCACABCBCACCBCBBCBABCBACCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCCBAABBCAACABCACBCBBBABBBCBABBACACBACAABCACABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCAAACBACBCAACCBAACBBCACCCACABCBCACCBCBBCBABCBACCCAC.exe" start= auto displayName= "UserDataSvc_CCCCCBAABBCAACABCACBCBBBABBBCBABBACACBACAABCACABCCC"
  2⤵
  PID:6900
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCCBAABBCAACABCACBCBBBABBBCBABBACACBACAABCACABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCAAACBACBCAACCBAACBBCACCCACABCBCACCBCBBCBABCBACCCAC.exe" start= auto displayName= "UserDataSvc_CCCCCBAABBCAACABCACBCBBBABBBCBABBACACBACAABCACABCCC"
    3⤵
    - Launches sc.exe
    PID:7032

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCABAAACABAACBBABABCBAABBBACBBBACCBABAACBBCCCCACCCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCABAAACABAACBBABABCBAABBBACBBBACCBABAACBBCCCCACCCBAB.exe
1⤵
PID:804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABBBCACACCBACBBBCCAAAAACCACAACCCCBBCABCAABABBABCAAACABABAABBABABACAACAABABACCAAAAACCBCBAAAAAAABCBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBBAACCCBCBCCBBABCABABAACABAABACCCBACCCCBBCABBBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABBBCACACCBACBBBCCAAAAACCACAACCCCBBCABCAABABBABCAAACABABAABBABABACAACAABABACCAAAAACCBCBAAAAAAABCBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBBAACCCBCBCCBBABCABABAACABAABACCCBACCCCBBCABBBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCCBAABBCAACABCACBCBBBABBBCBABBACACBACAABCACABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBBAACCCBCBCCBBABCABABAACABAABACCCBACCCCBBCABBBACCC.exe" start= auto displayName= "UserDataSvc_CCCCCBAABBCAACABCACBCBBBABBBCBABBACACBACAABCACABCCC"
  2⤵
  PID:6908
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCCBAABBCAACABCACBCBBBABBBCBABBACACBACAABCACABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBBAACCCBCBCCBBABCABABAACABAABACCCBACCCCBBCABBBACCC.exe" start= auto displayName= "UserDataSvc_CCCCCBAABBCAACABCACBCBBBABBBCBABBACACBACAABCACABCCC"
    3⤵
    - Launches sc.exe
    PID:7016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCCBAABBCAACABCACBCBBBABBBCBABBACACBACAABCACABCCC"
  2⤵
  PID:7096
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCCBAABBCAACABCACBCBBBABBBCBABBACACBACAABCACABCCC"
    3⤵
    - Launches sc.exe
    PID:4896

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABBBCCCAACCBBAAACBCBABBAAACBBCABCCBBAABAAABAAAACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABBBCCCAACCBBAAACBCBABBAAACBBCABCCBBAABAAABAAAACBAC.exe
1⤵
PID:5564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBAABAABACBBCCBAAAACCBABCCBCCCBCBBBBBABAABCCACAAABAAAABCAAAACACAABCCBCBAABBAABBCAACAACAACBBCBABCCABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBACCBBCCBBCABBACBBACACBCBBBACBBBBBBCCCCCBABBBBBCBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6188
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBAABAABACBBCCBAAAACCBABCCBCCCBCBBBBBABAABCCACAAABAAAABCAAAACACAABCCBCBAABBAABBCAACAACAACBBCBABCCABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBACCBBCCBBCABBACBBACACBCBBBACBBBBBBCCCCCBABBBBBCBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6384

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBBAABCCABCBBBAABCCCBBABABCBBCCABBBCACAACBACCAABBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBBAABCCABCBBBAABCCCBBABABCBBCCABBBCACAACBACCAABBCC.exe
1⤵
PID:5776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABACCBBBCABCBCCCCACACABACBCACCBBBCBCACBCBCCACBACCACABCABCBCBAAACCBCCBBBCCACBBCAAABCABCCABAACBAACABABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBACCCBAAAACABCABCBCABCBCCBBACBBBBACBCCCBCCBBACBCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABACCBBBCABCBCCCCACACABACBCACCBBBCBCACBCBCCACBACCACABCABCBCBAAACCBCCBBBCCACBBCAAABCABCCABAACBAACABABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBACCCBAAAACABCABCBCABCBCCBBACBBBBACBCCCBCCBBACBCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCAAACBAABCCCBACCAAAACABABAACABABBCBBCBBCCBACBBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBACCCBAAAACABCABCBCABCBCCBBACBBBBACBCCCBCCBBACBCABB.exe" start= auto displayName= "UserDataSvc_ACCAAACBAABCCCBACCAAAACABABAACABABBCBBCBBCCBACBBCCC"
  2⤵
  PID:2280
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCAAACBAABCCCBACCAAAACABABAACABABBCBBCBBCCBACBBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBACCCBAAAACABCABCBCABCBCCBBACBBBBACBCCCBCCBBACBCABB.exe" start= auto displayName= "UserDataSvc_ACCAAACBAABCCCBACCAAAACABABAACABABBCBBCBBCCBACBBCCC"
    3⤵
    - Launches sc.exe
    PID:900

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCBBCBAACACBACBCACACACBACBBCCCAABAACCBCAAACABBABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCBBCBAACACBACBCACACACBACBBCCCAABAACCBCAAACABBABCCA.exe
1⤵
PID:1232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCACBBCCAACCACBAAABACCCCABBABBCBBCAACCBBACBCBCAAABAAABAABAABAACCCABBBBBBBCACBAABCCACBABBACAACBAABABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCABBCBABBBAACCAAACBCBBBBCACBBAABBBBABCACBCCBBCCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCACBBCCAACCACBAAABACCCCABBABBCBBCAACCBBACBCBCAAABAAABAABAABAACCCABBBBBBBCACBAABCCACBABBACAACBAABABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCABBCBABBBAACCAAACBCBBBBCACBBAABBBBABCACBCCBBCCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBAABABAACBABABCBBBABBBBCABBBBBACCAAAACBCCABAAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCABBCBABBBAACCAAACBCBBBBCACBBAABBBBABCACBCCBBCCCCBB.exe" start= auto displayName= "UserDataSvc_ABBAABABAACBABABCBBBABBBBCABBBBBACCAAAACBCCABAAABBA"
  2⤵
  PID:5692
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBAABABAACBABABCBBBABBBBCABBBBBACCAAAACBCCABAAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCABBCBABBBAACCAAACBCBBBBCACBBAABBBBABCACBCCBBCCCCBB.exe" start= auto displayName= "UserDataSvc_ABBAABABAACBABABCBBBABBBBCABBBBBACCAAAACBCCABAAABBA"
    3⤵
    - Launches sc.exe
    PID:2932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBAABABAACBABABCBBBABBBBCABBBBBACCAAAACBCCABAAABBA"
  2⤵
  PID:5016
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBAABABAACBABABCBBBABBBBCABBBBBACCAAAACBCCABAAABBA"
    3⤵
    - Launches sc.exe
    PID:5792

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBAABACACCBBCACCCBBCBCBCACBBBACCAACCBABBACCBCACBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBAABACACCBBCACCCBBCBCBCACBBBACCAACCBABBACCBCACBACCC.exe
1⤵
PID:2944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCBCAACCBAAABCCCCABBCCCBACCBCABCBCACBAACAABAACCCBCBBCACBCBCBCABCCAAABAAAACCBCCCCAACBBAAAABAACCBACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCCCBABCABABAABCABACBCABCCCAABACBCCABCCACCCCCAACBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCBCAACCBAAABCCCCABBCCCBACCBCABCBCACBAACAABAACCCBCBBCACBCBCBCABCCAAABAAAACCBCCCCAACBBAAAABAACCBACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCCCBABCABABAABCABACBCABCCCAABACBCCABCCACCCCCAACBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBAABABAACBABABCBBBABBBBCABBBBBACCAAAACBCCABAAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCCCBABCABABAABCABACBCABCCCAABACBCCABCCACCCCCAACBBA.exe" start= auto displayName= "UserDataSvc_ABBAABABAACBABABCBBBABBBBCABBBBBACCAAAACBCCABAAABBA"
  2⤵
  PID:5468
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBAABABAACBABABCBBBABBBBCABBBBBACCAAAACBCCABAAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCCCBABCABABAABCABACBCABCCCAABACBCCABCCACCCCCAACBBA.exe" start= auto displayName= "UserDataSvc_ABBAABABAACBABABCBBBABBBBCABBBBBACCAAAACBCCABAAABBA"
    3⤵
    - Launches sc.exe
    PID:6032

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABABCBBCCABACCBCBCBBAAAABABBBACCBCACBACCCABAAAABCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABABCBBCCABACCBCBCBBAAAABABBBACCBCACBACCCABAAAABCAC.exe
1⤵
PID:3184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACACAAACBCCCBBBCBBBACCACBABBAAABABCAAABBBABBCCCCABCABCACBACBAABBBCCCCABCCBACBCCACCABBACCAAACABCAACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAABCABCBABACABABACBCCCBACBABCCCBCBCACAACCCBACACBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6736
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACACAAACBCCCBBBCBBBACCACBABBAAABABCAAABBBABBCCCCABCABCACBACBAABBBCCCCABCCBACBCCACCABBACCAAACABCAACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAABCABCBABACABABACBCCCBACBABCCCBCBCACAACCCBACACBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCAAACAABACBACACCBAAACBACACBCBBCACACCCCAAABBCAACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAABCABCBABACABABACBCCCBACBABCCCBCBCACAACCCBACACBBBB.exe" start= auto displayName= "UserDataSvc_BCCAAACAABACBACACCBAAACBACACBCBBCACACCCCAAABBCAACBA"
  2⤵
  PID:6792
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCAAACAABACBACACCBAAACBACACBCBBCACACCCCAAABBCAACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAABCABCBABACABABACBCCCBACBABCCCBCBCACAACCCBACACBBBB.exe" start= auto displayName= "UserDataSvc_BCCAAACAABACBACACCBAAACBACACBCBBCACACCCCAAABBCAACBA"
    3⤵
    - Launches sc.exe
    PID:5348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCAAACAABACBACACCBAAACBACACBCBBCACACCCCAAABBCAACBA"
  2⤵
  PID:6972
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCAAACAABACBACACCBAAACBACACBCBBCACACCCCAAABBCAACBA"
    3⤵
    - Launches sc.exe
    PID:6152

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBAACCBBCACACBCACAABCAAACCBCABBCBCCCCACABCCCBACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBAACCBBCACACBCACAABCAAACCBCABBCBCCCCACABCCCBACBAB.exe
1⤵
PID:5368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBAAABBACABABAABBCBBCBBBBCACACBBBBBBCACCCCBABACBCBCCCCABCBBBBCBBBABBAACBBBCABBACACACBABAABACCBBBBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAACBABCABCBBBCACABACCBBACBCCABABBABABCAAACBCCABBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBAAABBACABABAABBCBBCBBBBCACACBBBBBBCACCCCBABACBCBCCCCABCBBBBCBBBABBAACBBBCABBACACACBABAABACCBBBBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAACBABCABCBBBCACABACCBBACBCCABABBABABCAAACBCCABBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCABCCCAACBACCBBCABBBABBBABCAACCABABCAACBCCBCBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAACBABCABCBBBCACABACCBBACBCCABABBABABCAAACBCCABBACC.exe" start= auto displayName= "UserDataSvc_ACBCABCCCAACBACCBBCABBBABBBABCAACCABABCAACBCCBCBABA"
  2⤵
  PID:912
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCABCCCAACBACCBBCABBBABBBABCAACCABABCAACBCCBCBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAACBABCABCBBBCACABACCBBACBCCABABBABABCAAACBCCABBACC.exe" start= auto displayName= "UserDataSvc_ACBCABCCCAACBACCBBCABBBABBBABCAACCABABCAACBCCBCBABA"
    3⤵
    - Launches sc.exe
    PID:6512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCABCCCAACBACCBBCABBBABBBABCAACCABABCAACBCCBCBABA"
  2⤵
  PID:5356
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCABCCCAACBACCBBCABBBABBBABCAACCABABCAACBCCBCBABA"
    3⤵
    - Launches sc.exe
    PID:4860

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBAACCBBCACACBCACAABCAAACCBCABBCBCCCCACABCCCBACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBAACCBBCACACBCACAABCAAACCBCABBCBCCCCACABCCCBACBAB.exe
1⤵
PID:2744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCBCCBAAACCCABAABCCBABAAAAACBACCCAABCAACAABAACCBCBCACCABACBABBCCCCBACBACAABABABABBCBCBAAAAAAACCABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCBACCCBBBCACABBCCCBBCABBBBAAAABBACBBCCCCBBCCAAAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCBCCBAAACCCABAABCCBABAAAAACBACCCAABCAACAABAACCBCBCACCABACBABBCCCCBACBACAABABABABBCBCBAAAAAAACCABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCBACCCBBBCACABBCCCBBCABBBBAAAABBACBBCCCCBBCCAAAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCBCBBBCAAAACACAACCBCCBACBAACCCAACBACBCCCBAABABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCBACCCBBBCACABBCCCBBCABBBBAAAABBACBBCCCCBBCCAAAABC.exe" start= auto displayName= "UserDataSvc_CCCBCBBBCAAAACACAACCBCCBACBAACCCAACBACBCCCBAABABABB"
  2⤵
  PID:6776
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCBCBBBCAAAACACAACCBCCBACBAACCCAACBACBCCCBAABABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCBACCCBBBCACABBCCCBBCABBBBAAAABBACBBCCCCBBCCAAAABC.exe" start= auto displayName= "UserDataSvc_CCCBCBBBCAAAACACAACCBCCBACBAACCCAACBACBCCCBAABABABB"
    3⤵
    - Launches sc.exe
    PID:7124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCBCBBBCAAAACACAACCBCCBACBAACCCAACBACBCCCBAABABABB"
  2⤵
  PID:1832
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCBCBBBCAAAACACAACCBCCBACBAACCCAACBACBCCCBAABABABB"
    3⤵
    - Launches sc.exe
    PID:6904

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCBABBCACBCBCCCACBBACBBCCBABBCABBCBCBBCBABCBABCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCBABBCACBCBCCCACBBACBBCCBABBCABBCBCBBCBABCBABCCAA.exe
1⤵
PID:5856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABACCBBBCABCBCCCCACACABACBCACCBBBCBCACBCBCCACBACCACABCABCBCBAAACCBCCBBBCCACBBCAAABCABCCABAACBAACABABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCCBABABBBCABAABAAAABCCCCABBCCBBCACACBABACCCBCBBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6492
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABACCBBBCABCBCCCCACACABACBCACCBBBCBCACBCBCCACBACCACABCABCBCBAAACCBCCBBBCCACBBCAAABCABCCABAACBAACABABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCCBABABBBCABAABAAAABCCCCABBCCBBCACACBABACCCBCBBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCBBCCAABBBCCCABABCABCCCBCBABBBBBBCCCCCACBCABBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCCBABABBBCABAABAAAABCCCCABBCCBBCACACBABACCCBCBBCCB.exe" start= auto displayName= "UserDataSvc_CACCBBCCAABBBCCCABABCABCCCBCBABBBBBBCCCCCACBCABBCAC"
  2⤵
  PID:6840
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCBBCCAABBBCCCABABCABCCCBCBABBBBBBCCCCCACBCABBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCCBABABBBCABAABAAAABCCCCABBCCBBCACACBABACCCBCBBCCB.exe" start= auto displayName= "UserDataSvc_CACCBBCCAABBBCCCABABCABCCCBCBABBBBBBCCCCCACBCABBCAC"
    3⤵
    - Launches sc.exe
    PID:6720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCBBCCAABBBCCCABABCABCCCBCBABBBBBBCCCCCACBCABBCAC"
  2⤵
  PID:6252
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACCBBCCAABBBCCCABABCABCCCBCBABBBBBBCCCCCACBCABBCAC"
    3⤵
    - Launches sc.exe
    PID:7364

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCBABBCACBCBCCCACBBACBBCCBABBCABBCBCBBCBABCBABCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCBABBCACBCBCCCACBBACBBCCBABBCABBCBCBBCBABCBABCCAA.exe
1⤵
PID:760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAACBCABCCBABBBABACBBBAAAABBABBBCBCBCAACBBBACABCCACBCBBCCACAACBBACAACCBABBBCACCACCCAABCBAABBBAAAACBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBCCBBBCABCCBBACCCACACBCCCCACBAAACACBAACBCBCACCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAACBCABCCBABBBABACBBBAAAABBABBBCBCBCAACBBBACABCCACBCBBCCACAACBBACAACCBABBBCACCACCCAABCBAABBBAAAACBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBCCBBBCABCCBBACCCACACBCCCCACBAAACACBAACBCBCACCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCCACCAABBABACCCCCCBACBACBACCACCBBBCAACCACABCBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBCCBBBCABCCBBACCCACACBCCCCACBAAACACBAACBCBCACCACC.exe" start= auto displayName= "UserDataSvc_CBCCCACCAABBABACCCCCCBACBACBACCACCBBBCAACCACABCBAAA"
  2⤵
  PID:3224
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCCACCAABBABACCCCCCBACBACBACCACCBBBCAACCACABCBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBCCBBBCABCCBBACCCACACBCCCCACBAAACACBAACBCBCACCACC.exe" start= auto displayName= "UserDataSvc_CBCCCACCAABBABACCCCCCBACBACBACCACCBBBCAACCACABCBAAA"
    3⤵
    - Launches sc.exe
    PID:6284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCCACCAABBABACCCCCCBACBACBACCACCBBBCAACCACABCBAAA"
  2⤵
  PID:4412
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCCCACCAABBABACCCCCCBACBACBACCACCBBBCAACCACABCBAAA"
    3⤵
    - Launches sc.exe
    PID:7492

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCABBCBABBBAACCAAACBCBBBBCACBBAABBBBABCACBCCBBCCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCABBCBABBBAACCAAACBCBBBBCACBBAABBBBABCACBCCBBCCCCBB.exe
1⤵
PID:5852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAACACCACBACBACCBCBBCACBCABACBACCCCCCBABCBABABABBCACACBCAACBBBBBAAABAABBBBAACABAACBCBCCACCCCACCCBACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACCAACCCCBCCBACABABABBBCBBACACCACACCAAABCACCCCCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAACACCACBACBACCBCBBCACBCABACBACCCCCCBABCBABABABBCACACBCAACBBBBBAAABAABBBBAACABAACBCBCCACCCCACCCBACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACCAACCCCBCCBACABABABBBCBBACACCACACCAAABCACCCCCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCBAACCBCBBABAAABCACBCCAACBABBBBBBBBBCAAACACABCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACCAACCCCBCCBACABABABBBCBBACACCACACCAAABCACCCCCCCB.exe" start= auto displayName= "UserDataSvc_ABBCBAACCBCBBABAAABCACBCCAACBABBBBBBBBBCAAACACABCAB"
  2⤵
  PID:7820

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCABBCBABBBAACCAAACBCBBBBCACBBAABBBBABCACBCCBBCCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCABBCBABBBAACCAAACBCBBBBCACBBAABBBBABCACBCCBBCCCCBB.exe
1⤵
PID:632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCAABABBCBACCAAAACAAABACACABCCCAABBBACAACBBBCABBABBBBBBAAABCAAAACCAABABACAABBCBAACABBCBCAAACACCBACCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAABBCBABBCCBCBCCACAAABCABCCABABABACCABBCAACABCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCAABABBCBACCAAAACAAABACACABCCCAABBBACAACBBBCABBABBBBBBAAABCAAAACCAABABACAABBCBAACABBCBCAAACACCBACCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAABBCBABBCCBCBCCACAAABCABCCABABABACCABBCAACABCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABCBABCCACCBBBBABBCCBABCBCABCAABCBACABCBBCABABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAABBCBABBCCBCBCCACAAABCABCCABABABACCABBCAACABCACBC.exe" start= auto displayName= "UserDataSvc_BBABCBABCCACCBBBBABBCCBABCBCABCAABCBACABCBBCABABBCC"
  2⤵
  PID:7564

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCCCBABCABABAABCABACBCABCCCAABACBCCABCCACCCCCAACBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCCCBABCABABAABCABACBCABCCCAABACBCCABCCACCCCCAACBBA.exe
1⤵
PID:6848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABACCCCBBABBBBCBBACBCCABBAACCAABCCAAACCACBBAAACCAABABBBBBBCAAABCACBBBAABACAAACBCCBACBCABCBCCAABABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAACBABABCACABAABCBACAABCABACBBACCBCAAACABCCCBCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABACCCCBBABBBBCBBACBCCABBAACCAABCCAAACCACBBAAACCAABABBBBBBCAAABCACBBBAABACAAACBCCBACBCABCBCCAABABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAACBABABCACABAABCBACAABCABACBBACCBCAAACABCCCBCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCABBAACAAACCBAAACBBACACCCBBAACBAAABCCBBBAAAABBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAACBABABCACABAABCBACAABCABACBBACCBCAAACABCCCBCABAB.exe" start= auto displayName= "UserDataSvc_ACCABBAACAAACCBAAACBBACACCCBBAACBAAABCCBBBAAAABBCBA"
  2⤵
  PID:6500
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCABBAACAAACCBAAACBBACACCCBBAACBAAABCCBBBAAAABBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAACBABABCACABAABCBACAABCABACBBACCBCAAACABCCCBCABAB.exe" start= auto displayName= "UserDataSvc_ACCABBAACAAACCBAAACBBACACCCBBAACBAAABCCBBBAAAABBCBA"
    3⤵
    - Launches sc.exe
    PID:6192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCABBAACAAACCBAAACBBACACCCBBAACBAAABCCBBBAAAABBCBA"
  2⤵
  PID:1008
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCABBAACAAACCBAAACBBACACCCBBAACBAAABCCBBBAAAABBCBA"
    3⤵
    - Launches sc.exe
    PID:6456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBBAACCCBCBCCBBABCABABAACABAABACCCBACCCCBBCABBBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBBAACCCBCBCCBBABCABABAACABAABACCCBACCCCBBCABBBACCC.exe
1⤵
PID:6264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBAABACBBBAABACBABCBBCABBAACACACAACCACCACAABBCAAABACBBCBBAABCABACACAAABBABCCBBBAAAACACCCCCBBAABCBBBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBABAAACCCABBBCCCACBBBCCACACABAABBABCBACBBCBBAABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBAABACBBBAABACBABCBBCABBAACACACAACCACCACAABBCAAABACBBCBBAABCABACACAAABBABCCBBBAAAACACCCCCBBAABCBBBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBABAAACCCABBBCCCACBBBCCACACABAABBABCBACBBCBBAABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBBAACCCBCBCCBBABCABABAACABAABACCCBACCCCBBCABBBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBBAACCCBCBCCBBABCABABAACABAABACCCBACCCCBBCABBBACCC.exe
1⤵
PID:6276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBAABBACCCAACCBABAAACBCCCAABBBBACCCABCBABABABCCBBABAACAACBBACACACABBCBABBACACBCACBABCCCBACCAAABCCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCCBCCBABABBBABCABBCBCBABABCCABBCBAABBCBACCABCACABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBAABBACCCAACCBABAAACBCCCAABBBBACCCABCBABABABCCBBABAACAACBBACACACABBCBABBACACBCACBABCCCBACCAAABCCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCCBCCBABABBBABCABBCBCBABABCCABBCBAABBCBACCABCACABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7544

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCAAACBACBCAACCBAACBBCACCCACABCBCACCBCBBCBABCBACCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCAAACBACBCAACCBAACBBCACCCACABCBCACCBCBBCBABCBACCCAC.exe
1⤵
PID:6996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACAAAABCBCCBCAAACBCBAAABCCCABACBBBCAABBBBAABBCBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACAAAABCBCCBCAAACBCBAAABCCCABACBBBCAABBBBAABBCBACB.exe
1⤵
PID:1000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCACCCCCCAABAACBCBCAABABBAABCBBACBBCBCABBABBABAABBCCBCCCACCCABCCACCBCCCBCBBBCBBACBACABABCAAACCCBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBAACBBCBCCCAACCCCACCABBCBABCACAACBABBCCCBCCCCBBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7680

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAACBABABCACABAABCBACAABCABACBBACCBCAAACABCCCBCABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAACBABABCACABAABCBACAABCABACBBACCBCAAACABCCCBCABAB.exe
1⤵
PID:4720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCABBCCCCCCABBCBBBCCCABBAACBABCABCCBBACCAABCCBCBBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCABBCCCCCCABBCBBBCCCABBAACBABCABCCBBACCAABCCBCBBBAC.exe
1⤵
PID:7008

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACAAAABCBCCBCAAACBCBAAABCCCABACBBBCAABBBBAABBCBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACAAAABCBCCBCAAACBCBAAABCCCABACBBBCAABBBBAABBCBACB.exe
1⤵
PID:1540

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCBACCCBBBCACABBCCCBBCABBBBAAAABBACBBCCCCBBCCAAAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCBACCCBBBCACABBCCCBBCABBBBAAAABBACBBCCCCBBCCAAAABC.exe
1⤵
PID:6596

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAABCABCBABACABABACBCCCBACBABCCCBCBCACAACCCBACACBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAABCABCBABACABABACBCCCBACBABCCCBCBCACAACCCBACACBBBB.exe
1⤵
PID:6000

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAABCABCBABACABABACBCCCBACBABCCCBCBCACAACCCBACACBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAABCABCBABACABABACBCCCBACBABCCCBCBCACAACCCBACACBBBB.exe
1⤵
PID:4088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAACBABABCACABAABCBACAABCABACBBACCBCAAACABCCCBCABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAACBABABCACABAABCBACAABCABACBBACCBCAAACABCCCBCABAB.exe
1⤵
PID:6968

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCCBABABBBCABAABAAAABCCCCABBCCBBCACACBABACCCBCBBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCCBABABBBCABAABAAAABCCCCABBCCBBCACACBABACCCBCBBCCB.exe
1⤵
PID:1336

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBCCBBBCABCCBBACCCACACBCCCCACBAAACACBAACBCBCACCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBCCBBBCABCCBBACCCACACBCCCCACBAAACACBAACBCBCACCACC.exe
1⤵
PID:3232

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCBACCCBBBCACABBCCCBBCABBBBAAAABBACBBCCCCBBCCAAAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCBACCCBBBCACABBCCCBBCABBBBAAAABBACBBCCCCBBCCAAAABC.exe
1⤵
PID:6820

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAACBABCABCBBBCACABACCBBACBCCABABBABABCAAACBCCABBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAACBABCABCBBBCACABACCBBACBCCABABBABABCAAACBCCABBACC.exe
1⤵
PID:4532

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAACBABCABCBBBCACABACCBBACBCCABABBABABCAAACBCCABBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAACBABCABCBBBCACABACCBBACBCCABABBABABCAAACBCCABBACC.exe
1⤵
PID:4596

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCCBABABBBCABAABAAAABCCCCABBCCBBCACACBABACCCBCBBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCCBABABBBCABAABAAAABCCCCABBCCBBCACACBABACCCBCBBCCB.exe
1⤵
PID:7420

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBACCBBCCBBCABBACBBACACBCBBBACBBBBBBCCCCCBABBBBBCBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBACCBBCCBBCABBACBBACACBCBBBACBBBBBBCCCCCBABBBBBCBBCA.exe
1⤵
PID:7432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBCCBBBCABCCBBACCCACACBCCCCACBAAACACBAACBCBCACCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBCCBBBCABCCBBACCCACACBCCCCACBAAACACBAACBCBCACCACC.exe
1⤵
PID:7552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBACCCBAAAACABCABCBCABCBCCBBACBBBBACBCCCBCCBBACBCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBACCCBAAAACABCABCBCABCBCCBBACBBBBACBCCCBCCBBACBCABB.exe
1⤵
PID:7764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\$Recycle.Bin\S-1-5-21-3704578903-1610922810-1098216751-1000\qap`g`v~dtlq
Size 10B
SHA256 78f462076f66126e3a286c16645e57a1907e1a0bad0229b6d0a3608f4251a63e
MD5 241d5e18f58d62e25dcf9529ca6efd31
SHA1 958a055435c42e51c1281d049f4566a0ee9aa4a1
SHA512 ff5500758feb63a3589688c66825b98d36fa494aad7aec12a7182d97f419c8c0f2ca244f8aa3fcef9312c0001927e114236d4a36fe39d6373f6545c458866e99
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 28061b9dff5f38a1c9d5225c0afce28f29fe6ce67ad0ee5d1d630c2dd28d2341
MD5 c8c3c3f167bbf8e830601d66ff284110
SHA1 2e2acf52c9916c41f8ce754f2e9beac345cc7175
SHA512 60f03b593a510e2993345baefd16dbcbe1a1289cf11a5b94d1c5a98cadc3b9e8b4a926179e7e9fa92f53e00be38ed8bdc74a864d1c468bda60741366045e0b25
MD5 SHA1 SHA512

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 31.6MB
SHA256 aefd678df57a85b3a6ef02ae5c38a24057e53f338f49e57a83716ab31b407aad
MD5 c77f0fad9a01096e3d8d963d783ab6de
SHA1 b9958e11f7475b1050908191ff9e545114d48c1c
SHA512 d94aed746c531fcea5566405f029bef3bd3656156faeee5ebed10ac49c03be414e571628001bfc15424f397c40fcd4d5736d9c5013434e265aeafb863c7cd45f
SSDEEP 786432:oymbqv8l2r2H2cSDXQLcd2BWuFBKLAyomzeXqhb/UYE6uk5jzZ1spR2qsP:bQ72CWcxLcdaDy7zlhDUmOR/A
TLSH
T1DD77335EF2B644D9D16361BC489AE22AE339BC854BA0C7C7DB148D1B2F237D0DCB6251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\qap`g`v~dtlq
Size 10B
SHA256 592701aeff36466fd5875b5f3b8156278ae42fe5835f23a840c9308a2c89f026
MD5 2942504b89a5afe5de77dc67ca99be57
SHA1 9b195a0925ac6bf6b6a959bc90fc608a64c330a1
SHA512 67010b7f65c7848edbe70f18e9e4f7b6827fb830b6f76a71d57e836bca61e991fadd92d54b8d30c581e0ed8fb127ed02e0da84ecb978b81743d43704076197c9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Program Files\Common Files\microsoft shared\ink\as-IN\qap`g`v~dtlq
Size 10B
SHA256 e7c12c55fa2ac390aefe189331619a5cb9e2f0d5d96a03759f47849791a0e676
MD5 1ea16289e4297b7418357cf75033ba70
SHA1 4b3a69b449ce4fff8f787d061e04c6809db6e6e8
SHA512 2ee50f04c1db3a9d695efc63fac3f0bf799700ed49e38def335e77160299a37f5c3f2b9c8bd6dd03e9e475bde581f857b4e59dd1cfd31f8d1d6f28e2096c7280
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Program Files\Common Files\microsoft shared\ink\ug-CN\qap`g`v~dtlq
Size 10B
SHA256 86578e1b5ef609299e45ba693ca0893ecefbc229c5cbfa418c70de6f3d17e062
MD5 02df125c61e1e6f079482039619692f6
SHA1 a99a70d394793237874c444bbbb3157f5c31b49e
SHA512 d685d69bb7f224451f6108254a2f0dc4fd727be50fa411c716cdc4e75588819173f8e45c4960e73767dd38d09075864cb17c4edd55ec771ae476d520de22e0e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\win_x64\qap`g`v~dtlq
Size 10B
SHA256 08639c0901ae5a792a8377be0157c0ab5e51bd51927d100a65f909e986195b40
MD5 6a4b9daae419628b7245ebca5de2de78
SHA1 4319fcf327ad79c28ea893118476c944e760a63a
SHA512 84456debe87a7ba34883a9b6fbc6377388c11076600779fb9385cb045b684c19825c2297ed22d2795d10213f12365a1fe3e42bded1263e9d68d2e3704120d998
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Program Files\Internet Explorer\es-ES\qap`g`v~dtlq
Size 10B
SHA256 f491723147ccf2749d95aa049719875a1cfbb5a2e10363f7a427d5ffd960b542
MD5 6e0625b8966b697ffc24aeb43cf954eb
SHA1 6862c79364253cfd9c79eb105967aa97fc80ae07
SHA512 61931c68e3c934ff73915cdc3fa2ee635e9ec1570d8a9fce347cbb798f67f5be2160dcdd902a9bd2d1e70023db3f16695fa1ed3c573b3f8ebc6f5d0707c7814d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Program Files\Internet Explorer\uk-UA\qap`g`v~dtlq
Size 10B
SHA256 895a5cd25e76e85bc2ad4ceddf88afc3298d7cc5bc0cc7855bda45724dca6294
MD5 712195c735f36a34ee29b80377ccda37
SHA1 d4dc04b682ff7f69d1fd31a220c33636832b4c26
SHA512 ff973625f0317fbf3b3121723fa6ad3c0649ca3328ab5842f978aa9c7ee197acf33befd9d2e0be832436de9067b7da998ad82b0aa7e9763e7780526bcc5ee70e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Program Files\dotnet\host\fxr\8.0.15\qap`g`v~dtlq
Size 10B
SHA256 ad8fbf08abdc2edc21a0213cbe496951b219f82476d7c44f341f667a460cb7b5
MD5 e4b4be11ea8bf24ad2b9861624d01d33
SHA1 275f22e2e268ff2ef567397cd2aed14b121644c3
SHA512 6ba13176769c9a8b2b0f09f292c8bc374cceb8797df58a1dd23c2b1f38c2a1e1f2566d0690dc4d9345450e470c7cc76f911d59aa38d0a37f97f886bb1888d687
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\qap`g`v~dtlq
Size 10B
SHA256 75c304c814a54e2356416c06da9af7ee90911d615e7eccfc351630dafa2c7c08
MD5 6439f2f824c2a873e13049cf9a324626
SHA1 2362824ae66c34e761fbc9eb07cb0685e07c46ac
SHA512 cef06109dab47f19687cc6dc27d1f5fe0ca14c438d3bfd4b3187e155c1c112cc922504b83f7613b2b666dbdd06e19572a903fdca74578952c1cadfe110a2e49c
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Admin\AppData\Local\Temp\virus_log.txt
Size 1KB
SHA256 8b68aba92754e3f9672e2ed9661d3801d98d3c4e87b9e8c53474fe07cfcfd82f
MD5 9a8e863464b0bd7752bc25057fcfd125
SHA1 5995c70577df540030dad1dad0a64900ccbadd50
SHA512 91c2b207412a97795b031daa3f5ee754ae7374d9b475f9ecfcdd123135e360d4021d40bd9d894f0633d65a00dd1d25215f29eca20e426223cacd85633b20049d
TLSH
T1EE41471684A9ECBBB021549BDA3DEECDC8D4B79B2C4C6B00930D4215B3D5C36FE5A8D1
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0c532964bf145338c3993199c7f1628270e9e0316490ae8710dee5f6e5c5a4c4
MD5 1ed0c1cc150a7a746e29bc0f5d669081
SHA1 ed13091637758abc43a691538590650cb55c106e
SHA512 1df861b9de9dd2ae7d71956422eed6b178c3ce483997eefeb2c84cd6f528d0008aeb07a015c55959d4fc4ca151a9bd5538966768b9bea55b7ec2d5fe9d50b94e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f3fff03296739f326dbc46f6e2c6841dfea1261514ab55bfb0fcc0a88451a9c6
MD5 f4b46b3e8a8570e65eb85798c198e636
SHA1 5cdd7747fe2f7e71cf5819fcd6741ab840760da8
SHA512 171c33896c575ed01d61fc6e37cc2c2ff4f303266e7edf1f020a58f4ebeb17e1f51efb3c216eacb37f64096b5158aff73b63ff9d50040ae1919f7e0d606d4dca
MD5 SHA1 SHA512

Submit Download

svchost_ACACBCCBCAACACCAAACACABCCBBCCBBBAAABCBCCCABABBCBCABBBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCCBCAACACCAAACACABCCBBCCBBBAAABCBCCCABABBCBCABBBCA.exe
Size 44.9MB
SHA256 0916c95582ff1d0fcdcebef7db93aa07313fea7cfcd14d2b9ec0f1b07f5f1518
MD5 333dca8102db1ed7b00582288692fa32
SHA1 c3f0b0c8a85f8bdd6bd2d1eb6bbdf537d61dfe15
SHA512 9f84c27cb1c7376ddf031ac03488039b1b0f622330cc5b238f32c02243fb4a9b73669414d0c19f837c660303deb609af811aa66ac68a11ae38ccae881c27598b
SSDEEP 786432:oymbqv8l2r2H2cSDXQLcd2BWuFBKLAyomzeXqhb/UYE6uk5jzZ1spR2qsPHeuDDj:bQ72CWcxLcdaDy7zlhDUmOR/EHzwSMwP
TLSH
T124A7331EF2B600DED123107C885B926AE339BDC55B95C6CB9A198D077F637E0DCA2346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CABBABCCCCACCCAACCCABAABBAAABACCCABABBCCCACCCABBBCBCCCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBABCCCCACCCAACCCABAABBAAABACCCABABBCCCACCCABBBCBCCCB.exe
Size 45.1MB
SHA256 0bcc6dea99552eb6c99bbfcc693e182d03edecbab93dfd37883042ac62973272
MD5 16a49c89686b8839e385765cb01ecee3
SHA1 963c9be34fac82b5e51ac51cbcd242856554aba1
SHA512 16e6072c56b89ecb3a5ea2bd50cb935ddeb0f61706e676c7434e90849d954238c286351726abb5d42a7d9b9e2ebc838d30f26fac5fb10cb66fec79b6bb3c1dca
SSDEEP 786432:oymbqv8l2r2H2cSDXQLcd2BWuFBKLAyomzeXqhb/UYE6uk5jzZ1spR2qsPHeuDDo:bQ72CWcxLcdaDy7zlhDUmOR/EHzwSMws
TLSH
T1E0A73319F6B600DED123207C885BD26AE339BDC55B95C6CB9A198D077F237E0DCA2346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CABCBABCCCAAABAABAACBCAAAABABABCBACABBACBCCACABCCBCBCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABCCCAAABAABAACBCAAAABABABCBACABBACBCCACABCCBCBCAC.exe
Size 43.2MB
SHA256 a979cf3231aeb85242a5a32f9ddee75afad2bfa0ff1160c02fceb4c9d6795aa2
MD5 786b607bac20de960a6d73a3d508aea9
SHA1 f277cd90d8fc742304694c0a3015ae73f3ca6248
SHA512 c4284acd2e3e55b01971d0e34ab81a6df8e3f26d2d9d4d69db33f6c757142cb82418826e0d67c2f6c1d4b1f786067226f97627038586352e5562545ca51e710d
SSDEEP 786432:oymbqv8l2r2H2cSDXQLcd2BWuFBKLAyomzeXqhb/UYE6uk5jzZ1spR2qsPHeuDDY:bQ72CWcxLcdaDy7zlhDUmOR/EHzwSMwM
TLSH
T155A7332DF2F500DED163607C885BD22AE339BDC15B95C6CB9A198D077F236E0DCA6246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CABCBABCCCAAABAABAACBCAAAABABABCBACABBACBCCACABCCBCBCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABCCCAAABAABAACBCAAAABABABCBACABBACBCCACABCCBCBCAC.exe
Size 44.9MB
SHA256 43645af066467b11be6204a1089c7af2deb7059e2eee8b4910b56b30f4d426b6
MD5 e91b0914cd231f9075cc649d03531dff
SHA1 cd84b9c682bf0a42f908a567e8923df16af70912
SHA512 91c607e135c6a4e5b63e9b07da60be4e7c0238c9a5ccd9cdf95074b6740c56647c1bc17a207de84d87d317c9aa903092949e0e38dd89bad11ac562818a6c647e
SSDEEP 786432:oymbqv8l2r2H2cSDXQLcd2BWuFBKLAyomzeXqhb/UYE6uk5jzZ1spR2qsPHeuDDc:bQ72CWcxLcdaDy7zlhDUmOR/EHzwSMwg
TLSH
T1A4A7331DF2B600DED123207C885B927AE339BDC55B95C6CB9A198D077F637E0DCA2246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CABCCCBAAACBCCABBCABCACACBCCBBAAAACABBBBAACBBCCABAABAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCBAAACBCCABBCABCACACBCCBBAAAACABBBBAACBBCCABAABAAC.exe
Size 42.8MB
SHA256 344af9cc652ca4bebd540d7fea3edfe8fb0be9cd5d14185d864df528b1ee9541
MD5 547d4da3604476ffc23d0e4c9efd676f
SHA1 7fbf9ac5c76115a545e53cf2e8ea3bba7a55b166
SHA512 d832fac8bf7c38d36f990c155f8e0dce10dd84011fb8d6d56f35c14820e3dadad181314f61c7631ac52f24e3e2844e21af8d0beaed33686392a69807a03a3312
SSDEEP 786432:oymbqv8l2r2H2cSDXQLcd2BWuFBKLAyomzeXqhb/UYE6uk5jzZ1spR2qsPHeuDDi:bQ72CWcxLcdaDy7zlhDUmOR/EHzwSMwW
TLSH
T1AAA7332EF2F540DED113207C885BD26AE339BDC15B95C6CB96198D0B7F236E0DCA6246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CABCCCBAAACBCCABBCABCACACBCCBBAAAACABBBBAACBBCCABAABAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCBAAACBCCABBCABCACACBCCBBAAAACABBBBAACBBCCABAABAAC.exe
Size 44.2MB
SHA256 c98e04f570da70fabbde17a8596e601d63c0c302da1823db736481935ac40b63
MD5 fcdfc34f9f65b5446af2a47b37fccf6a
SHA1 8d575619aa45d4e5e365ace1243e3eff6fb9eae0
SHA512 1e36c5eb5425f89af1801be5e862a21d4772c4a9b857f121d91d41f3f3d887abc06aaa96a523aecc09d4289c7ca36fdc5ce902228d3104a5208b103f634adefa
SSDEEP 786432:oymbqv8l2r2H2cSDXQLcd2BWuFBKLAyomzeXqhb/UYE6uk5jzZ1spR2qsPHeuDDF:bQ72CWcxLcdaDy7zlhDUmOR/EHzwSMwB
TLSH
T1BEA7331DF2B500DED123217C889BA23AE339BDC15B95C6CB96198D077F637E0DCA6246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCBCCCAAABBAABCAACCBCBCBBBBABABCBBACABCCABACAAABAA.exe
Size 45.6MB
SHA256 893ccac4360b51d08b2c230fa9aa6dd44b32e69c9add35ff553e29a0ca4cd594
MD5 78e4e6ec4b1ad84ec6791c5810bf5438
SHA1 7b46a0b5ef46868ae902548740e418f78ab99d0b
SHA512 ed1a45613c1927afe8534f4c94a17b4ae90fa1fa77e67290d43f8c72a1204fd3648a9e65ccef9b982bf7515788caeb9c15b252375d75c68ff3dcebbc73454710
SSDEEP 786432:oymbqv8l2r2H2cSDXQLcd2BWuFBKLAyomzeXqhb/UYE6uk5jzZ1spR2qsPHeuDDc:bQ72CWcxLcdaDy7zlhDUmOR/EHzwSMwA
TLSH
T134A7331DF2B600DED123607C885AD23AE339BDC55B95C6CB9A198D073F637E0DCA6246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 029b7af6974171ce1cd8de9289e851b595151e8e63da0fdd281d3a33d1bb501c
MD5 e6db9f6336b18cdce40d27dd64d31303
SHA1 80fa28413ef25bbede5932f1b0710715ebd1e138
SHA512 8157d3dfde29c6898aadd16f207f7e8e5cc387bcbae87fcaa1ffe4bce1a8b3b498fe39de045d492c896840679145ed46d698838968953ce0f172b78b55ff8055
SSDEEP 96:oSeTzWt14W8b48u3uED9eTzWt14W1Pb41Pcek+2j+0F1bk+YhrHOZ08/Y14LcOm1:JePWt+NPWVhePWt+sqFkJj+0FxkRHOZY
TLSH
T13AB1F925E0B5DCB3F23354DBD12DD9C28DE5B36B684C9B04630E4618A795C37DE198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 71b8f9416b05535c979fa13a5cc9a70827c0afc21138c8bb8fe9b3649532cec9
MD5 910d1b9b27cef71c459dc3567e605992
SHA1 48be56a0b68cc771b3d6cbb6d3c37428546a5394
SHA512 9475a3d962d5745fd114d3c50dffe38ad68a1ebcad512159ecb72d1a790273952372c67160e4e228b16de4d6deedee18225dc1acfbc040f34d9577a598fb3e87
SSDEEP 96:oSeTzWt14W8b48u3uED9eTzWt14W1Pb41Pcek+2j+0F1bk+YhrHOZ08/Y14LcOmJ:JePWt+NPWVhePWt+sqFkJj+0FxkRHOZo
TLSH
T114B1F925E0A5DCB3F23258DBD63CD9C28DD5B3AB684C9B04630E4718A799C37DE198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 957553d65564a064138c12d0701084007649b4f6ae784bad574baef834904967
MD5 76da9a025c5cc029c668ed1fea9dbb0e
SHA1 214511251ca7a1b822e34c9b517ac208d53b7866
SHA512 8480ba9123b197472d06d56fa84f985061a3f406e2dd0998a987757165e1fa2898cb3a8c44c936056c6b69a5234c99419defebfb11a97c79bbe31878ca748b42
SSDEEP 96:oSeTzWt14W8b48u3uED9eTzWt14W1Pb41Pcek+2j+0F1bk+YhrHOZ08/Y14LcOmP:JePWt+NPWVhePWt+sqFkJj+0FxkRHOZe
TLSH
T19CB1F825E0A5DCB3F23358DBD63CD9C28DE5B3AB684C9B04630E4718A799837DD198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 fcd7ce0c141c8855225b0a5cab4d6c55dbfe9c5fe45f42c2e9596dad480ac88a
MD5 8f274cb48b60b70626e12a8d8fc75058
SHA1 fad7503794dd25c5473635b7d68019ab2b92ced7
SHA512 3a698006f3365e90627ca90e578f001587bc3a1c4651004553d57341ebde1e97096bda2812d1ec89a64307bddd0f71939075bf2635943cd3c1d520c5240341ef
SSDEEP 96:oSeTzWt14W8b48u3uED9eTzWt14W1Pb41Pcek+2j+0F1bk+YhrHOZ08/Y14LcOmn:JePWt+NPWVhePWt+sqFkJj+0FxkRHOZ+
TLSH
T18AC10825E0A4DCB3F23258DBD63CD9C28CE5B3AB588C9B04630E4718A799C37DD098E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 5eeff73e5624d12b141062f1dd436ebb89f62ca1a9a781f8188cf7eb8f764113
MD5 2e4093bbc7caaf66cbc9b75ff148810a
SHA1 9770d3ad612f8077f27f630811e5a673bd9990a5
SHA512 0119140f0d5b70c8b9ebae8e098bd5c4650f9df59ff0e5322a2d23722ff2a3d67fcd4f59317c2e82f9ca498a9418a279d4b23e2037d04ec10bfbe307b1e26d3d
SSDEEP 96:oSeTzWt14W8b48u3uED9eTzWt14W1Pb41Pcek+2j+0F1bk+YhrHOZ08/Y14LcOmS:JePWt+NPWVhePWt+sqFkJj+0FxkRHOZj
TLSH
T10CC10825E0A5DCB3F23258DBD63CD9D28DE5B3AB588C9B04630E4718A7A5C37DD098E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 fcc08a9cf9833c3cbe921bedcb2280e9a2a706d751ee6010748fb29dedcab205
MD5 653f45aa54c887c7b1f0755982732e50
SHA1 8ce99c2f13785e409dc5fb4d226b6919c5ff7340
SHA512 30a89e99be757f68ac2c63db7459c55725ff470fd09c62cc246d085d49a8450c4af999a127598a2044e290737a4eca2327e9842a0bcb8aec0375624af4328b23
SSDEEP 192:JePWt+NPWVhePWt+sqFkJj+0FxkRHOZf/Y+gOaOtOIL0Gv98+GzApzApK+K+8+1a:7Jj+kWlL5W0GG+E/OX5vN5
TLSH
T196D10726E0A5DCB3B23254DBD63DD9C18CE4B3AB688C9B04630D4719B7A5C37DE198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 1f7ef65fbad87eedc8766e29b534fbf3a775b383078f4ed1ff0c8e3aaefd3265
MD5 10d0ad675b7cbfc7efe5c69f1b74b296
SHA1 cbff2618c668bbee3a6ed86b7485b2081fd7f6c5
SHA512 49aa7a66cfd406524d457fefe8a3b3f1add34502022e4e943a107ae90ce8af921589162f114f6e047e3f580ea483a16d5f0440bdef14f29397c07b377ed8d0e1
SSDEEP 192:JePWt+NPWVhePWt+sqFkJj+0FxkRHOZf/Y+gOaOtOIL0Gv98+GzApzApK+K+8+1M:7Jj+kWlL5W0GG+E/OX5vNv
TLSH
T147E10825E0A5DCB3B23254DBD63DD9D28CE4B3AB688C9B04630D4718B7A5C37DE198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 b42e8ca3a5a122976d7bb96edfa8ced94aa19ec8c447f66ab44dd384d69c22f3
MD5 06cfaaaab417f648ee2674f8e68529a3
SHA1 6e2e18ba2707b6de31b4f1e561088318aa4be81f
SHA512 2a46ee7509dfe0b774c5d0ad06224e228c93ce4eaf9da70d22f781adda480356c0c8b0d3196dc0ea811e45a8e18a27b5f1456087b38f85da2d07ba45e4ecd796
SSDEEP 192:JePWt+NPWVhePWt+sqFkJj+0FxkRHOZf/Y+gOaOtOIL0Gv98+GzApzApK+K+8+1R:7Jj+kWlL5W0GG+E/OX5vNe
TLSH
T182F1E625E0A5DCB3B23254DBD63DD9D28CE4B3AB688C9B04630D4718B7A5C37DE198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 8KB
SHA256 bc30412dcd43d36cc87af7a6e7c777f99fe19f06562dfe8f3f1ea1b1512d5d99
MD5 c9c43ae7b4fbf9d05f16ae8a35748f78
SHA1 175fb673890508c8611be83a2242a4f0c640ffb7
SHA512 38ff8710cd207194842805833be8b51cd08300d11aecb3b2d7ac51a0afc19e8ca2f1d59304a6dbf25d962dcd8cedba2be56441481e5d252519f2727607f5ae3a
SSDEEP 192:JePWt+NPWVhePWt+sqFkJj+0FxkRHOZf/Y+gOaOtOIL0Gv98+GzApzApK+K+8+12:7Jj+kWlL5W0GG+E/OX5vNT
TLSH
T115020725E0A5DCB3F23254DBD63DD9D28CE4B3AB684C9B08630D4718B7A5C36DE198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 8KB
SHA256 a46c79069815d2155b3a543f293ef776be8c2130a9b93a742bfb36d57757398d
MD5 5cc5a794f761d3d0279ad68633ecfd87
SHA1 591b1b9a2bda1eb6eb933a528367ffee9ce69c44
SHA512 8322077a64a34c0eca3e02c29e2a1c5861a66726129bca593775fd58075bcc4139d97e74af2e55482bd2c32c0888691c1b619a388459c95a463cbac4094cd8a5
SSDEEP 192:JePWt+NPWVhePWt+sqFkJj+0FxkRHOZf/Y+gOaOtOIL0Gv98+GzApzApK+K+8+1k:7Jj+kWlL5W0GG+E/OX5vN3Ll
TLSH
T19B02E625E0A5DCB3F23254DBD63DD9D28CE4B3AB6C8C9B04630D4618B7A5C36DE198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 8KB
SHA256 885d7d7588314b032eef00bcab3d1e75439a954085ccb1895732271ff008e72d
MD5 6ad844ec0f0e78e21f7b94f26e8bbb3b
SHA1 d82c37e5a980ab1a9392cf76bf648d6db66f39bd
SHA512 2947cc0a1b8795d10d731918cd7468505cff187179356b49c2d8f80d54106769a6e4a92a29ae2bbe5d7d60e4005de59869b2c3bd0ff6518dc831678bcd8af735
SSDEEP 192:JePWt+NPWVhePWt+sqFkJj+0FxkRHOZf/Y+gOaOtOIL0Gv98+GzApzApK+K+8+1N:7Jj+kWlL5W0GG+E/OX5vN3Lq6i
TLSH
T1A202E625E0A5DCB3F23258DBD63DD9D28CE4B3AB588C9B04630D4718B7A5C36DE198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 8KB
SHA256 d4443969037f1cb73069bd3119ae4b7690e71dc312b281b3016b0c185c419d4d
MD5 ed6cd3b40b8b4692a2937c6ac9f6a5b1
SHA1 9285fe1f33713b868cc938cd2cdf243d0ab71658
SHA512 81c64f2cb13e44e7ba916ba3677c57b6372e5f838dcfdb639aa48908665d2714255eb53264a5a836f7f4c8019e940f86950aecd21d604bf63af615a9e803b553
SSDEEP 192:JePWt+NPWVhePWt+sqFkJj+0FxkRHOZf/Y+gOaOtOIL0Gv98+GzApzApK+K+8+18:7Jj+kWlL5W0GG+E/OX5vN3Lq67L
TLSH
T1D502F625E0A5DCB3F23258DBD63DD9D28CE4B3AB588C9B04630D4718B7A5C36DE198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 8KB
SHA256 ba1088cd661d38f7fccd4f3118eb62c7cd8d4c40b088036a6c6b40124ebeb1fe
MD5 c7a67b051759b43378e5439131795676
SHA1 8cabd418526fdf7b36d3aeaa064ec0b32f723270
SHA512 a91f7734de877c59df361fb6fe919844ec78065a12afb9055592ed8326d9b9c27e16ca9911cfc01b61fcaebbdb895d0af8f22efe12bcd79fdcb8dda959eacea9
SSDEEP 192:JePWt+NPWVhePWt+sqFkJj+0FxkRHOZf/Y+gOaOtOIL0Gv98+GzApzApK+K+8+17:7Jj+kWlL5W0GG+E/OX5vN3Lq67/g
TLSH
T11912E525E0A5DCB3B23258DBD63DD9D28CE4B3AB588C9B04630D4718B7A5C36DE198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 10KB
SHA256 9dff4787ad23ce15fceac5c8d8eef8b2b1ac59d618210fb1a2283f6e0470cb7d
MD5 1a71a62534dcabe1089a35517d38bcc4
SHA1 8a7fe97881cc007ea2395f198c8881e803b6f385
SHA512 b52ae62eb33c7dde6b731675448a3e7f08af191959cb3bea14e792be2f3c7e74a99ff07f68842aa7365283345b70d48489c9df3d1ab6a441df98ca252e5d67aa
SSDEEP 192:JePWt+NPWVhePWt+sqFkJj+0FxkRHOZf/Y+gOaOtOIL0Gv98+GzApzApK+K+8+1s:7Jj+kWlL5W0GG+E/OX5vN3Lq67/+YDUy
TLSH
T1E122E525E0A5DCB3B23258DBD63DDAD28CE4B39B5C8C9B04630D4718B7A5837DE198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 11KB
SHA256 f8477cc5dfcfe06c2e8be3318e3b599448de81eeec20559707a2e26248258f1f
MD5 b58fa22e91b09af3bf010aebfb7930dc
SHA1 c3ff753e88fa18d0d939b891c553351d89d30ea9
SHA512 2bffe4da7cef2691f509a1e4af04a6c8a5e688e7576dce38809fa699910d8ac357099bb9bbe2504cf1b43cc377443877706e3935096f8459ffd0db341dd971ef
SSDEEP 192:JePWt+NPWVhePWt+sqFkJj+0FxkRHOZf/Y+gOaOtOIL0Gv98+GzApzApK+K+8+1s:7Jj+kWlL5W0GG+E/OX5vN3Lq67/+YDUa
TLSH
T10932F625E0A5DCB3F23258DBD63DDAD28CE4B3AB5C8C9B04530D4618B7A5837DE198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 744a07cf7fbda4b54667cb50980815d16a994310f2349010fda1d592bd63e68e
MD5 174225dbe8d64cc29b88f9178e0db1db
SHA1 aa49d552bcfc99ead7c6b9de710421bebd46c26c
SHA512 d120c47e3dea1c88387c1e9193ae11dec63bace23ea9a8d1d82de17200529dc7af8c8ce8ed5ad0d9dec668b4ce3373edb08e27c144d239fa176437a364e4c3d9
SSDEEP 384:7Jj+kWlL5W0GG+E/OX5vN3Lq67/+YDU9NYJyo9MQ:7Jj+7h5W0G/E/IvNLND+YDQNYJyaP
TLSH
T13242E625E0A5DCB3F23268DBD63DD9D28CE4B3AB5C4C9B04530D8718B7A4836DE198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 13KB
SHA256 29c80f30be5738d262dd2e0f008de2c2f542ae7f2b8da37568c10ae851a3d66c
MD5 b2e91dec3381219eb51ba1657832a0c8
SHA1 6acf20e57d6a974f7dc28221aa7ac8316c3410c0
SHA512 de3428a24ff7af032fe5c4084591330b44035789f35710a21ce5fec19aed1f7f1d701878cbf6d7532b44da7474dd01ce8565f854043ca41dd946fb6fc0d03d54
SSDEEP 384:7Jj+kWlL5W0GG+E/OX5vN3Lq67/+YDU9NYJyo9MMWO:7Jj+7h5W0G/E/IvNLND+YDQNYJya3H
TLSH
T1DD52E625E0A5DCB3F23264DBD62DD9D28DD4B3AF5C4C9B04530D8718B7A4836DE198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 abe5c631ff333b56068a766c31a44706561635ccbc76ca9cde64c48425d28417
MD5 01c9d47070324efb081e1f87b527d812
SHA1 7a086d15babe1ab0163e0d907ff97b99bbc25652
SHA512 d493024f075a83cad200526a3329d7f01a07cccf8e20cc646e8718e892fdd06217f93c048c64965d5fb720eab4d2f8eed2ea77c2993b12686c67c02962d516a4
SSDEEP 384:7Jj+kWlL5W0GG+E/OX5vN3Lq67/+YDU9NYJyo9MMW1:7Jj+7h5W0G/E/IvNLND+YDQNYJya3S
TLSH
T1B062E625E0A5DCB3F23268DBD62DDAD28DE4B39F5C4C9B04530D8718B7A4836DE198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 9525052d96d66f83e8f6b903cb452512144a6c3d29980afd7514a26a213ec7a1
MD5 31200bac4a1d5a6a897865c36618db23
SHA1 de9da49dc5c0ae58040eadb5702acd026d60b3af
SHA512 d4992ea1ff7af873f32c8a63044e30666728b8935d3668e2c7a41198c4a84c880c25c125bf772f4e0b220d0ef19887a84f3508abbbf54ae5839f2c99f92cf6c1
SSDEEP 384:7Jj+kWlL5W0GG+E/OX5vN3Lq67/+YDU9NYJyo9MMWK:7Jj+7h5W0G/E/IvNLND+YDQNYJya3/
TLSH
T1CB62E725E0A5DCB3F23268DBD62DDAD28DE4B39F5C4C9B04530D8718B7A4836DE198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 515b891c2cc4e775fda88276c8e182d1d6dc0a9b519795d1861b2251cc8bf40e
MD5 be3b0ee2c1f596587e73ea2eac7eae90
SHA1 6a1aee86e946b4487d0e47ca63c3a802646a340c
SHA512 c96167242e1aa71aac5e0032ce05fb3277f78b1acb9dc3c00a33c9d16219e8acc816f9e6a8f91e0b8036a449f1c423d1e247c9236a4c8bb290d8062162af7ed5
TLSH
T18921D354A039DC73F23228DFC12DC9C28DD4B76B7854AB15330D4629AB8583BDE198E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 15KB
SHA256 ece4eaf0186759f244f848541acd7b952084c72a994375e645c24c012bf98705
MD5 8708994814a3d047a9e48048e87d5428
SHA1 1d5e51600fda93258be0112d94e276da26fc1581
SHA512 7ec35d1d3a770c94cebad10b4fafd1a0f8ea601aa3d008660bff2e84d27f2dc8e0e261811872025b32297dd5c6f06ec2ae30189ad1051283411cf1638312456a
SSDEEP 384:7Jj+kWlL5W0GG+E/OX5vN3Lq67/+YDU9NYJyo9MMWT:7Jj+7h5W0G/E/IvNLND+YDQNYJya36
TLSH
T1A862E725E0A5DCB3F23268DBD62DDAD28DE4B39F5C4C9B04530D8718B7A4836DE198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 15KB
SHA256 a823770c1c710dd85dfc6b9daed558c9f5e41837d66ecc7935d99998a9203c33
MD5 a3f915f5a0003dcb003d55cc80f373eb
SHA1 3f5296edf301a35bbf24f9a468e7f37c936a998f
SHA512 ebdfe49d714e987c4386367947e304689cdd9a2b38f29f6607bbd71b982fbc29f29225d9d48339271140464cd9e6509ded83065b51277c7d4d414240ad172551
SSDEEP 384:7Jj+kWlL5W0GG+E/OX5vN3Lq67/+YDU9NYJyo9MMWJtE:7Jj+7h5W0G/E/IvNLND+YDQNYJya3uO
TLSH
T14F72F825E0A5DCB3F23268DBD62DD9D28DE4B39F5C4C9B04530D8718B7A4836DE198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 16KB
SHA256 04f69bac510152ec0a2eff5767482fc7102dac6414871cc4e671e49088ac4d04
MD5 cbe51168c4f96b4ee440e78e9aeebec4
SHA1 045580a966b73978d6a68d3e6b8fa99eec2542c7
SHA512 612656e26f20822d04b09341485d94f298548ba87fc87468202cfac60991fb8d00776a61002a3106c59aed12a3c93e48cf9b37e7deea317106b45d9e4743e195
SSDEEP 384:7Jj+kWlL5W0GG+E/OX5vN3Lq67/+YDU9NYJyo9MMWJtTC:7Jj+7h5W0G/E/IvNLND+YDQNYJya3uRC
TLSH
T19C72F625E0A5DCB3F23268DBD63DDAD68CE4B39F6C4C9B04530D8618B7A4836DE198D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 16KB
SHA256 d8fd38f8a90b344e579a751a24949aa2d2238e5974320314d3fecd8ad2c289fc
MD5 23dc53a10c5943f4f3b9f890671467f6
SHA1 4d7ab9c8fab833839e7be8d78f94ae616384ad99
SHA512 46c5cf125a5d48844191361324fa651a0d8021337c6c57a003cdc3924bf0750d0a240208eba4a61da4d7813ec685a69e1101cba724ef52bcdf9de6a0287d9df3
SSDEEP 384:7Jj+kWlL5W0GG+E/OX5vN3Lq67/+YDU9NYJyo9MMWJtTld2:7Jj+7h5W0G/E/IvNLND+YDQNYJya3uRe
TLSH
T10E72E625E0A5DCB3F23268DBD63DDAD68CE4B39F5C4C9B04530D8618B7A4836DE198E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 95153374918419db90c77aa1e4377000108abe85b43ab8f0c745f0aff094d674
MD5 a27f8e478e59afbae02b6dd3e46e7780
SHA1 39586fd9bfffcacd4caf334476307c8276b3dc68
SHA512 e32d517abfd3416b8fdc618c32752176cde30278127fb74264e74de82e74f7bd79a32f95a7b4355d7f3772cd8e6c345e3d61eb384b8021476c0e32bad1c9bf32
TLSH
T1DE410625A075DCB3F23268DFC12DD9C28CD4B3AB6C589B05230E4619B798C3BDE198E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 13fca5936bceda1aacd45b1832a51f5989efa0e78d6b7277255aba6207da61a1
MD5 3738090edc1212cc4554a7ecee56a512
SHA1 d41a5290e7385f07ea8198c4049ef035889883e1
SHA512 fc37c5eca7f443714e51c69cd947a24d7fe377f5f73054cccab31b5376addeb1e50571fc03a282c4e3747a77e12f8f12e89a72ab7ad5e51d33b25c463a5c7446
TLSH
T13241C425A075DCB3F22268DFC12DD9C18CD4B3BB6C489A05630E8619B7D883BDD098E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 e60439b6017c134317419b74b0fcabb00fecf3b0f0325eee42f925b09b90e5ff
MD5 c0e408cad59aaf41f2e7bcd0e93e31d3
SHA1 14d71ce64e06906840a75b9f5d81106c55e7eec2
SHA512 27158e6c163a07a6615d43caaf2310babc906c8c738a79cb072d2ba1dc13256b9a3c4100e81cd672d965e4ee9457178201d2c43ff85654d123a745c3490a658c
TLSH
T10251B325A075DCB3F22258DFC62DD9C28CD4B36B6C489A45630E8619B7D983BDD098E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 c086daf51afaa813663d003745f681066156cc0a3751b4ea7aa9ac0fd7cf5ff9
MD5 84046c90bc45c75bfb3af85c295b2542
SHA1 cecfda4d870f239feba280a76a20879a661a7048
SHA512 4378a1530cc48309234e84f777d1c43a77e7339f912e59b62165c72c8dd1b609e49188e46ea7341155744b419b2866dbe4e9b0ef86b775315e208ee8d0bcedf6
TLSH
T1B281E725E0B4DCB7F23258DFC62CD9D28CD8B36B684C9B05630E4619A799C37DD098E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 486d3aad16ce35043fb7dc39416088b1e4bc50ec0bb21d28be6e03012e4397ab
MD5 690571f15cf1df258735c08459f82f53
SHA1 b295a6211d82103791a55b43aede335ca8447362
SHA512 20d2cbceba21782a3e6353fe0210b3fffb8d4b4489e0adeda49d28a0f58c9770804cac608dfa0f78531d95ddc396de674c6e59ff4f6c24b44a6a3a4e1d943bdd
SSDEEP 96:oSeTzWt14W8b48u3uED9eTzWt14W1Pb41Pcek+2j+0F1bk+YhrHOZ08/Y14LcOmF:JePWt+NPWVhePWt+sqFkJj+0FxkRHOZ+
TLSH
T1C9810825E0B5DCB7F23268DBC63CD9D28CD4B3AB684C9B05630D4619A799C37DD098E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 703863ab41939b845fb83192b0b6e602a79c0832c9c7748c6d4f56c15b05ee1e
MD5 133039e4dc58f00a8e2e51bde2e4a274
SHA1 0914a76bee32bb9701d1c96a6dafacd53e95b5a3
SHA512 e16d28142d8c6336e1a5f546966ee6b2296ea80f8f528e6ad00f68b07011b719e4a6299e2e537b02a3432233b0620b3024e0b409c7d66e7c8d88668df4c57078
SSDEEP 96:oSeTzWt14W8b48u3uED9eTzWt14W1Pb41Pcek+2j+0F1bk+YhrHOZ08/Y14LcOmb:JePWt+NPWVhePWt+sqFkJj+0FxkRHOZ0
TLSH
T1A891E825E0B5DCB3F23258DBD63CD9C28CD4B36B684C9B05630E4619A799C37DD098E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-185-0x0000000000790000-0x00000000007B2000-memory.dmp

Download

memory/760-1286-0x0000000000290000-0x00000000002B2000-memory.dmp

Download

memory/804-457-0x0000000000140000-0x0000000000162000-memory.dmp

Download

memory/804-1096-0x0000000000140000-0x0000000000162000-memory.dmp

Download

memory/996-1135-0x00000000003E0000-0x0000000000402000-memory.dmp

Download

memory/996-401-0x00000000003E0000-0x0000000000402000-memory.dmp

Download

memory/1232-1162-0x0000000000C90000-0x0000000000CB2000-memory.dmp

Download

memory/1348-358-0x00000000005F0000-0x0000000000612000-memory.dmp

Download

memory/1348-216-0x00000000005F0000-0x0000000000612000-memory.dmp

Download

memory/1356-224-0x0000000000420000-0x0000000000442000-memory.dmp

Download

memory/1356-352-0x0000000000420000-0x0000000000442000-memory.dmp

Download

memory/1852-13-0x0000000000B40000-0x0000000000B62000-memory.dmp

Download

memory/1852-43-0x0000000000B40000-0x0000000000B62000-memory.dmp

Download

memory/1868-122-0x0000000000660000-0x0000000000682000-memory.dmp

Download

memory/1868-66-0x0000000000660000-0x0000000000682000-memory.dmp

Download

memory/1976-403-0x0000000000550000-0x0000000000572000-memory.dmp

Download

memory/2064-407-0x0000000000C10000-0x0000000000C32000-memory.dmp

Download

memory/2064-1010-0x0000000000C10000-0x0000000000C32000-memory.dmp

Download

memory/2608-1008-0x0000000000FC0000-0x0000000000FE2000-memory.dmp

Download

memory/2608-405-0x0000000000FC0000-0x0000000000FE2000-memory.dmp

Download

memory/2744-1258-0x0000000000900000-0x0000000000922000-memory.dmp

Download

memory/2752-507-0x0000000000CC0000-0x0000000000CE2000-memory.dmp

Download

memory/2752-230-0x0000000000CC0000-0x0000000000CE2000-memory.dmp

Download

memory/2840-505-0x0000000000CC0000-0x0000000000CE2000-memory.dmp

Download

memory/2840-229-0x0000000000CC0000-0x0000000000CE2000-memory.dmp

Download

memory/2908-404-0x0000000000550000-0x0000000000572000-memory.dmp

Download

memory/2944-1163-0x00000000005C0000-0x00000000005E2000-memory.dmp

Download

memory/2944-1198-0x00000000005C0000-0x00000000005E2000-memory.dmp

Download

memory/2944-1327-0x00000000005C0000-0x00000000005E2000-memory.dmp

Download

memory/3076-184-0x0000000000F90000-0x0000000000FB2000-memory.dmp

Download

memory/3076-316-0x0000000000F90000-0x0000000000FB2000-memory.dmp

Download

memory/3080-1134-0x00000000003E0000-0x0000000000402000-memory.dmp

Download

memory/3080-400-0x00000000003E0000-0x0000000000402000-memory.dmp

Download

memory/3184-1222-0x00000000002C0000-0x00000000002E2000-memory.dmp

Download

memory/3400-0-0x00000000002B0000-0x00000000002D2000-memory.dmp

Download

memory/3400-12-0x00000000002B0000-0x00000000002D2000-memory.dmp

Download

memory/3668-1095-0x0000000000140000-0x0000000000162000-memory.dmp

Download

memory/3668-456-0x0000000000140000-0x0000000000162000-memory.dmp

Download

memory/3668-1247-0x0000000000140000-0x0000000000162000-memory.dmp

Download

memory/4212-186-0x0000000000790000-0x00000000007B2000-memory.dmp

Download

memory/4500-65-0x0000000000230000-0x0000000000252000-memory.dmp

Download

memory/4500-117-0x0000000000230000-0x0000000000252000-memory.dmp

Download

memory/4528-406-0x0000000000FC0000-0x0000000000FE2000-memory.dmp

Download

memory/4528-1009-0x0000000000FC0000-0x0000000000FE2000-memory.dmp

Download

memory/4812-67-0x0000000000660000-0x0000000000682000-memory.dmp

Download

memory/4812-126-0x0000000000660000-0x0000000000682000-memory.dmp

Download

memory/4832-183-0x0000000000F90000-0x0000000000FB2000-memory.dmp

Download

memory/4832-284-0x0000000000F90000-0x0000000000FB2000-memory.dmp

Download

memory/5264-178-0x0000000000CF0000-0x0000000000D12000-memory.dmp

Download

memory/5264-213-0x0000000000CF0000-0x0000000000D12000-memory.dmp

Download

memory/5368-1252-0x0000000000900000-0x0000000000922000-memory.dmp

Download

memory/5564-1269-0x0000000000950000-0x0000000000972000-memory.dmp

Download

memory/5564-530-0x0000000000950000-0x0000000000972000-memory.dmp

Download

memory/5772-62-0x0000000000B40000-0x0000000000B62000-memory.dmp

Download

memory/5772-14-0x0000000000B40000-0x0000000000B62000-memory.dmp

Download

memory/5776-1270-0x00000000006A0000-0x00000000006C2000-memory.dmp

Download

memory/5776-531-0x00000000006A0000-0x00000000006C2000-memory.dmp

Download

memory/5852-1312-0x0000000000FF0000-0x0000000001012000-memory.dmp

Download

memory/5852-1342-0x0000000000FF0000-0x0000000001012000-memory.dmp

Download

memory/5856-1285-0x0000000000290000-0x00000000002B2000-memory.dmp

Download

memory/5896-357-0x0000000000E90000-0x0000000000EB2000-memory.dmp

Download

memory/5896-215-0x0000000000E90000-0x0000000000EB2000-memory.dmp

Download

memory/5924-211-0x0000000000CF0000-0x0000000000D12000-memory.dmp

Download

memory/5924-177-0x0000000000CF0000-0x0000000000D12000-memory.dmp

Download