Overview

overview

10

Static

static

10

2026-07-14...er.exe

windows10-2004-x64

9

2026-07-14...er.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    103s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/07/2026, 04:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-14_1740ff20ceac043f3d42572ec31442b0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
  • Size 14.1MB
  • Sample260714-e3qvyses7n
  • SHA256 ff0a2dd188041748e8fccaa39afd02a667fe39ce92262887e8740b3d1cf33a19
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Detects executables manipulated with Fody 1 IoCs
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Drops startup file 6 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 16 IoCs
    persistence
  • Launches sc.exe 64 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-14_1740ff20ceac043f3d42572ec31442b0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_1740ff20ceac043f3d42572ec31442b0_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3248
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACAACBCBBACAAABCABCAAACBBACBCCCABCABACBBABCACCAAAABACBBBCCABCBBCCBCACCBBAABCBAACABABBAAAAACCACBCBAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCAAABBBCBBBCCBBCAABCACBBAABBCABBCCABBCCCBACCABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5916
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACAACBCBBACAAABCABCAAACBBACBCCCABCABACBBABCACCAAAABACBBBCCABCBBCCBCACCBBAABCBAACABABBAAAAACCACBCBAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCAAABBBCBBBCCBBCAABCACBBAABBCABBCCABBCCCBACCABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1612
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBBCAAACAAABBABCCCAACABABBBBBABACBACBCCACCCABBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCAAABBBCBBBCCBBCAABCACBBAABBCABBCCABBCCCBACCABAA.exe" start= auto displayName= "UserDataSvc_ACCBBCAAACAAABBABCCCAACABABBBBBABACBACBCCACCCABBAAA"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5708
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_ACCBBCAAACAAABBABCCCAACABABBBBBABACBACBCCACCCABBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCAAABBBCBBBCCBBCAABCACBBAABBCABBCCABBCCCBACCABAA.exe" start= auto displayName= "UserDataSvc_ACCBBCAAACAAABBABCCCAACABABBBBBABACBACBCCACCCABBAAA"
        3⤵
          PID:4596
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBBCAAACAAABBABCCCAACABABBBBBABACBACBCCACCCABBAAA"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4552
        • C:\Windows\SysWOW64\sc.exe
          sc start "UserDataSvc_ACCBBCAAACAAABBABCCCAACABABBBBBABACBACBCCACCCABBAAA"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3164
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCAAABBBCBBBCCBBCAABCACBBAABBCABBCCABBCCCBACCABAA.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCAAABBBCBBBCCBBCAABCACBBAABBCABBCCABBCCCBACCABAA.exe
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6092
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCAACBBAACCBBCBBCACCCCBBBCCCCCCCACBBACBBBACBCAABCBBBAACBCAABACABACCACBBBACBCAABABCAABBBCBABBCABACCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABCAABBCBABAABCCABBACBABCBBBABACCBBABCBAABCCACCACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3744
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCAACBBAACCBBCBBCACCCCBBBCCCCCCCACBBACBBBACBCAABCBBBAACBCAABACABACCACBBBACBCAABABCAABBBCBABBCABACCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABCAABBCBABAABCCABBACBABCBBBABACCBBABCBAABCCACCACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:204
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAACBCCBAACBBCCBACBAACACAACACCABCCBBBBACCBCBBACCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABCAABBCBABAABCCABBACBABCBBBABACCBBABCBAABCCACCACBB.exe" start= auto displayName= "UserDataSvc_ABAACBCCBAACBBCCBACBAACACAACACCABCCBBBBACCBCBBACCBA"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4112
        • C:\Windows\SysWOW64\sc.exe
          sc create "UserDataSvc_ABAACBCCBAACBBCCBACBAACACAACACCABCCBBBBACCBCBBACCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABCAABBCBABAABCCABBACBABCBBBABACCBBABCBAABCCACCACBB.exe" start= auto displayName= "UserDataSvc_ABAACBCCBAACBBCCBACBAACACAACACCABCCBBBBACCBCBBACCBA"
          3⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:2904
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAACBCCBAACBBCCBACBAACACAACACCABCCBBBBACCBCBBACCBA"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2132
        • C:\Windows\SysWOW64\sc.exe
          sc start "UserDataSvc_ABAACBCCBAACBBCCBACBAACACAACACCABCCBBBBACCBCBBACCBA"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2996
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCAAABBBCBBBCCBBCAABCACBBAABBCABBCCABBCCCBACCABAA.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCAAABBBCBBBCCBBCAABCACBBAABBCABBCCABBCCCBACCABAA.exe
      1⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2188
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCAACBBAACCBBCBBCACCCCBBBCCCCCCCACBBACBBBACBCAABCBBBAACBCAABACABACCACBBBACBCAABABCAABBBCBABBCABACCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABCAABBCBABAABCCABBACBABCBBBABACCBBABCBAABCCACCACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3204
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCAACBBAACCBBCBBCACCCCBBBCCCCCCCACBBACBBBACBCAABCBBBAACBCAABACABACCACBBBACBCAABABCAABBBCBABBCABACCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABCAABBCBABAABCCABBACBABCBBBABACCBBABCBAABCCACCACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:3236
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCBBCBACCBBAACABCBBCBCCACAACAABCBABABBCACCBCCABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABCAABBCBABAABCCABBACBABCBBBABACCBBABCBAABCCACCACBB.exe" start= auto displayName= "UserDataSvc_BABCBBCBACCBBAACABCBBCBCCACAACAABCBABABBCACCBCCABAA"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5816
        • C:\Windows\SysWOW64\sc.exe
          sc create "UserDataSvc_BABCBBCBACCBBAACABCBBCBCCACAACAABCBABABBCACCBCCABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABCAABBCBABAABCCABBACBABCBBBABACCBBABCBAABCCACCACBB.exe" start= auto displayName= "UserDataSvc_BABCBBCBACCBBAACABCBBCBCCACAACAABCBABABBCACCBCCABAA"
          3⤵
          • Launches sc.exe
          PID:4116
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABCBBCBACCBBAACABCBBCBCCACAACAABCBABABBCACCBCCABAA"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3820
        • C:\Windows\SysWOW64\sc.exe
          sc start "UserDataSvc_BABCBBCBACCBBAACABCBBCBCCACAACAABCBABABBCACCBCCABAA"
          3⤵
            PID:1100
      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABCAABBCBABAABCCABBACBABCBBBABACCBBABCBAABCCACCACBB.exe
        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABCAABBCBABAABCCABBACBABCBBBABACCBBABCBAABCCACCACBB.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4616
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCAABACCBAABCBABCACCACCACAABBABBAAABCAAAACCCACCBACBACBCBBBCBCCCBCABBCABAABACBCACACBACBCCCBBBCABBAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCAABACCBAABCBABCACCACCACAABBABBAAABCAAAACCCACCBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2484
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCAABACCBAABCBABCACCACCACAABBABBAAABCAAAACCCACCBACBACBCBBBCBCCCBCABBCABAABACBCACACBACBCCCBBBCABBAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCAABACCBAABCBABCACCACCACAABBABBAAABCAAAACCCACCBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
            3⤵
              PID:2636
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCCABABCACCACBBAAABABBBACBBBCCBAABBABBCCBBCACBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCAABACCBAABCBABCACCACCACAABBABBAAABCAAAACCCACCBACBA.exe" start= auto displayName= "UserDataSvc_AACCCABABCACCACBBAAABABBBACBBBCCBAABBABBCCBBCACBCBB"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:5844
            • C:\Windows\SysWOW64\sc.exe
              sc create "UserDataSvc_AACCCABABCACCACBBAAABABBBACBBBCCBAABBABBCCBBCACBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCAABACCBAABCBABCACCACCACAABBABBAAABCAAAACCCACCBACBA.exe" start= auto displayName= "UserDataSvc_AACCCABABCACCACBBAAABABBBACBBBCCBAABBABBCCBBCACBCBB"
              3⤵
                PID:1272
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCCABABCACCACBBAAABABBBACBBBCCBAABBABBCCBBCACBCBB"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4772
              • C:\Windows\SysWOW64\sc.exe
                sc start "UserDataSvc_AACCCABABCACCACBBAAABABBBACBBBCCBAABBABBCCBBCACBCBB"
                3⤵
                  PID:4560
            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABCAABBCBABAABCCABBACBABCBBBABACCBBABCBAABCCACCACBB.exe
              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABCAABBCBABAABCCABBACBABCBBBABACCBBABCBAABCCACCACBB.exe
              1⤵
              • Drops startup file
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:592
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABCBACBCCBCBAABBCACBABCBCCBBBAABBBBBBCACBBABCCBCCBAABAABCCBABABBBCBAABAAAAABCACABCAABAABBBBCCCABAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBAABAAABACAAAAAAACCCBCABBABAACCAACCACCBCBABBAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:2268
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABCBACBCCBCBAABBCACBABCBCCBBBAABBBBBBCACBBABCCBCCBAABAABCCBABABBBCBAABAAAAABCACABCAABAABBBBCCCABAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBAABAAABACAAAAAAACCCBCABBABAACCAACCACCBCBABBAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                  3⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:5160
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACACBCABCBBBAAACABBBCBCBCBBABABBAACBCBCAABBCCACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBAABAAABACAAAAAAACCCBCABBABAACCAACCACCBCBABBAABCA.exe" start= auto displayName= "UserDataSvc_CBACACBCABCBBBAAACABBBCBCBCBBABABBAACBCBCAABBCCACBA"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:992
                • C:\Windows\SysWOW64\sc.exe
                  sc create "UserDataSvc_CBACACBCABCBBBAAACABBBCBCBCBBABABBAACBCBCAABBCCACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBAABAAABACAAAAAAACCCBCABBABAACCAACCACCBCBABBAABCA.exe" start= auto displayName= "UserDataSvc_CBACACBCABCBBBAAACABBBCBCBCBBABABBAACBCBCAABBCCACBA"
                  3⤵
                    PID:3508
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACACBCABCBBBAAACABBBCBCBCBBABABBAACBCBCAABBCCACBA"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4712
                  • C:\Windows\SysWOW64\sc.exe
                    sc start "UserDataSvc_CBACACBCABCBBBAAACABBBCBCBCBBABABBAACBCBCAABBCCACBA"
                    3⤵
                    • Launches sc.exe
                    PID:5112
              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABCAABBCBABAABCCABBACBABCBBBABACCBBABCBAABCCACCACBB.exe
                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABCAABBCBABAABCCABBACBABCBBBABACCBBABCBAABCCACCACBB.exe
                1⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4240
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAAABABAABCBBCBACCCCABAAABACABCACCBCBBAACACCBCBCCABABACACABCCCACCAAACBBAACBABBACAACBCBCBCCBCBBABABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABABAABCBBCBACCCCABAAABACABCACCBCBBAACACCBCBCCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5640
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAAABABAABCBBCBACCCCABAAABACABCACCBCBBAACACCBCBCCABABACACABCCCACCAAACBBAACBABBACAACBCBCBCCBCBBABABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABABAABCBBCBACCCCABAAABACABCACCBCBBAACACCBCBCCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                    3⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:4108
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBAABAAACBACBCCBBBCCCAABCBABCCABBCBBAABBACBCBAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABABAABCBBCBACCCCABAAABACABCACCBCBBAACACCBCBCCABAB.exe" start= auto displayName= "UserDataSvc_CBBAABAAACBACBCCBBBCCCAABCBABCCABBCBBAABBACBCBAAABB"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2500
                  • C:\Windows\SysWOW64\sc.exe
                    sc create "UserDataSvc_CBBAABAAACBACBCCBBBCCCAABCBABCCABBCBBAABBACBCBAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABABAABCBBCBACCCCABAAABACABCACCBCBBAACACCBCBCCABAB.exe" start= auto displayName= "UserDataSvc_CBBAABAAACBACBCCBBBCCCAABCBABCCABBCBBAABBACBCBAAABB"
                    3⤵
                      PID:2296
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBAABAAACBACBCCBBBCCCAABCBABCCABBCBBAABBACBCBAAABB"
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2504
                    • C:\Windows\SysWOW64\sc.exe
                      sc start "UserDataSvc_CBBAABAAACBACBCCBBBCCCAABCBABCCABBCBBAABBACBCBAAABB"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:5932
                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCAABACCBAABCBABCACCACCACAABBABBAAABCAAAACCCACCBACBA.exe
                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCAABACCBAABCBABCACCACCACAABBABBAAABCAAAACCCACCBACBA.exe
                  1⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:752
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCCBCCCCAABACACAACACCBBBBABBACACABACCBCCABAABABBACCCACCCCBBCBBABBCBBCABBBABCBCBACABCCBBCCACBCACCACBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBCCCCAABACACAACACCBBBBABBACACABACCBCCABAABABBACCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5768
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCCBCCCCAABACACAACACCBBBBABBACACABACCBCCABAABABBACCCACCCCBBCBBABBCBBCABBBABCBCBACABCCBBCCACBCACCACBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBCCCCAABACACAACACCBBBBABBACACABACCBCCABAABABBACCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                      3⤵
                        PID:5092
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCCCABBCCBBCBCBBBBBACCAACCCACBACBCBBAAACBCCCCBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBCCCCAABACACAACACCBBBBABBACACABACCBCCABAABABBACCCA.exe" start= auto displayName= "UserDataSvc_CACCCCABBCCBBCBCBBBBBACCAACCCACBACBCBBAAACBCCCCBCBA"
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3852
                      • C:\Windows\SysWOW64\sc.exe
                        sc create "UserDataSvc_CACCCCABBCCBBCBCBBBBBACCAACCCACBACBCBBAAACBCCCCBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBCCCCAABACACAACACCBBBBABBACACABACCBCCABAABABBACCCA.exe" start= auto displayName= "UserDataSvc_CACCCCABBCCBBCBCBBBBBACCAACCCACBACBCBBAAACBCCCCBCBA"
                        3⤵
                          PID:4304
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCCCABBCCBBCBCBBBBBACCAACCCACBACBCBBAAACBCCCCBCBA"
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:796
                        • C:\Windows\SysWOW64\sc.exe
                          sc start "UserDataSvc_CACCCCABBCCBBCBCBBBBBACCAACCCACBACBCBBAAACBCCCCBCBA"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:4308
                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBAABAAABACAAAAAAACCCBCABBABAACCAACCACCBCBABBAABCA.exe
                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBAABAAABACAAAAAAACCCBCABBABAACCAACCACCBCBABBAABCA.exe
                      1⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:1736
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCCBBCBBCACCAABAACCBCCBBCBCBCACCBCAACCAABBBABBBCACBCCBAACACBCACACBBABCCACABBCACABBCCCCCABCAACBCABABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBBCBBCCBBBCAAACAACABABCAAABCBABABCCCCBABBCAABBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:5780
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCCBBCBBCACCAABAACCBCCBBCBCBCACCBCAACCAABBBABBBCACBCCBAACACBCACACBBABCCACABBCACABBCCCCCABCAACBCABABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBBCBBCCBBBCAAACAACABABCAAABCBABABCCCCBABBCAABBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                          3⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:1264
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBACAACBCCCBBBBAABBCCBBBCABBABCCABCBBAAACCABABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBBCBBCCBBBCAAACAACABABCAAABCBABABCCCCBABBCAABBBAA.exe" start= auto displayName= "UserDataSvc_CCBBACAACBCCCBBBBAABBCCBBBCABBABCCABCBBAAACCABABAAC"
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2600
                        • C:\Windows\SysWOW64\sc.exe
                          sc create "UserDataSvc_CCBBACAACBCCCBBBBAABBCCBBBCABBABCCABCBBAAACCABABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBBCBBCCBBBCAAACAACABABCAAABCBABABCCCCBABBCAABBBAA.exe" start= auto displayName= "UserDataSvc_CCBBACAACBCCCBBBBAABBCCBBBCABBABCCABCBBAAACCABABAAC"
                          3⤵
                            PID:3884
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBACAACBCCCBBBBAABBCCBBBCABBABCCABCBBAAACCABABAAC"
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2748
                          • C:\Windows\SysWOW64\sc.exe
                            sc start "UserDataSvc_CCBBACAACBCCCBBBBAABBCCBBBCABBABCCABCBBAAACCABABAAC"
                            3⤵
                            • Launches sc.exe
                            • System Location Discovery: System Language Discovery
                            PID:4340
                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABABAABCBBCBACCCCABAAABACABCACCBCBBAACACCBCBCCABAB.exe
                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABABAABCBBCBACCCCABAAABACABCACCBCBBAACACCBCBCCABAB.exe
                        1⤵
                        • Drops startup file
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2900
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBBBCACCAABBABAABABABAABBBCBBBABCBBCACBCCACABAABCBACCCABAAABBBCCBCAABCABCCBAABAACCAAABBBBACABACBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCBCCABBAAACCAABCCBBABBBCAAACBABBBABAABABBCCBBACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4740
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBBBCACCAABBABAABABABAABBBCBBBABCBBCACBCCACABAABCBACCCABAAABBBCCBCAABCABCCBAABAACCAAABBBBACABACBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCBCCABBAAACCAABCCBBABBBCAAACBABBBABAABABBCCBBACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                            3⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:5960
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCAABAACACCCBCCCCABACBCCBACBCCCBCCCBBBBBBACCABCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCBCCABBAAACCAABCCBBABBBCAAACBABBBABAABABBCCBBACCB.exe" start= auto displayName= "UserDataSvc_AABCAABAACACCCBCCCCABACBCCBACBCCCBCCCBBBBBBACCABCCB"
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3620
                          • C:\Windows\SysWOW64\sc.exe
                            sc create "UserDataSvc_AABCAABAACACCCBCCCCABACBCCBACBCCCBCCCBBBBBBACCABCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCBCCABBAAACCAABCCBBABBBCAAACBABBBABAABABBCCBBACCB.exe" start= auto displayName= "UserDataSvc_AABCAABAACACCCBCCCCABACBCCBACBCCCBCCCBBBBBBACCABCCB"
                            3⤵
                              PID:3564
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCAABAACACCCBCCCCABACBCCBACBCCCBCCCBBBBBBACCABCCB"
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1244
                            • C:\Windows\SysWOW64\sc.exe
                              sc start "UserDataSvc_AABCAABAACACCCBCCCCABACBCCBACBCCCBCCCBBBBBBACCABCCB"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:5404
                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABABAABCBBCBACCCCABAAABACABCACCBCBBAACACCBCBCCABAB.exe
                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABABAABCBBCBACCCCABAAABACABCACCBCBBAACACCBCBCCABAB.exe
                          1⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:4460
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBBBCACCAABBABAABABABAABBBCBBBABCBBCACBCCACABAABCBACCCABAAABBBCCBCAABCABCCBAABAACCAAABBBBACABACBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCBCCABBAAACCAABCCBBABBBCAAACBABBBABAABABBCCBBACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:5732
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBBBCACCAABBABAABABABAABBBCBBBABCBBCACBCCACABAABCBACCCABAAABBBCCBCAABCABCCBAABAACCAAABBBBACABACBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCBCCABBAAACCAABCCBBABBBCAAACBABBBABAABABBCCBBACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                              3⤵
                              • Scheduled Task/Job: Scheduled Task
                              PID:3688
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACCCABBCABCBCBBCCBCACBAACBABCACCAACAACBABCBBCBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCBCCABBAAACCAABCCBBABBBCAAACBABBBABAABABBCCBBACCB.exe" start= auto displayName= "UserDataSvc_CBACCCABBCABCBCBBCCBCACBAACBABCACCAACAACBABCBBCBBBB"
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:5644
                            • C:\Windows\SysWOW64\sc.exe
                              sc create "UserDataSvc_CBACCCABBCABCBCBBCCBCACBAACBABCACCAACAACBABCBBCBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCBCCABBAAACCAABCCBBABBBCAAACBABBBABAABABBCCBBACCB.exe" start= auto displayName= "UserDataSvc_CBACCCABBCABCBCBBCCBCACBAACBABCACCAACAACBABCBBCBBBB"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:2192
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACCCABBCABCBCBBCCBCACBAACBABCACCAACAACBABCBBCBBBB"
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4548
                            • C:\Windows\SysWOW64\sc.exe
                              sc start "UserDataSvc_CBACCCABBCABCBCBBCCBCACBAACBABCACCAACAACBABCBBCBBBB"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:2980
                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCBCCABBAAACCAABCCBBABBBCAAACBABBBABAABABBCCBBACCB.exe
                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCBCCABBAAACCAABCCBBABBBCAAACBABBBABAABABBCCBBACCB.exe
                          1⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5088
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACBCCACABACABBBABABABAACCCBABABCBCCAACAACBBAACCBCACCBABACBBCBCAAAABCACAAAAABCBACCAACCACBBCCAABCBCACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBABBBCAACACCAABBCBBCABCCBBCCBACABCBCBAACCCBBCABCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                            2⤵
                              PID:4936
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACBCCACABACABBBABABABAACCCBABABCBCCAACAACBBAACCBCACCBABACBBCBCAAAABCACAAAAABCBACCAACCACBBCCAABCBCACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBABBBCAACACCAABBCBBCABCCBBCCBACABCBCBAACCCBBCABCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                3⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:3616
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAABBCAAACBABCCABBBACCCACBABACAAABCABABCBCBCBBCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBABBBCAACACCAABBCBBCABCCBBCCBACABCBCBAACCCBBCABCCCA.exe" start= auto displayName= "UserDataSvc_CBAABBCAAACBABCCABBBACCCACBABACAAABCABABCBCBCBBCBAC"
                              2⤵
                                PID:3836
                                • C:\Windows\SysWOW64\sc.exe
                                  sc create "UserDataSvc_CBAABBCAAACBABCCABBBACCCACBABACAAABCABABCBCBCBBCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBABBBCAACACCAABBCBBCABCCBBCCBACABCBCBAACCCBBCABCCCA.exe" start= auto displayName= "UserDataSvc_CBAABBCAAACBABCCABBBACCCACBABACAAABCABABCBCBCBBCBAC"
                                  3⤵
                                  • Launches sc.exe
                                  • System Location Discovery: System Language Discovery
                                  PID:2776
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAABBCAAACBABCCABBBACCCACBABACAAABCABABCBCBCBBCBAC"
                                2⤵
                                  PID:3368
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc start "UserDataSvc_CBAABBCAAACBABCCABBBACCCACBABACAAABCABABCBCBCBBCBAC"
                                    3⤵
                                    • Launches sc.exe
                                    PID:3400
                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCBCCABBAAACCAABCCBBABBBCAAACBABBBABAABABBCCBBACCB.exe
                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCBCCABBAAACCAABCCBBABBBCAAACBABBBABAABABBCCBBACCB.exe
                                1⤵
                                • Drops startup file
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4448
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCCBCCBCAACAAAACBCCBBCBCBBBAAABCACCBAAABAAAACACCCBBCBCAAAAABCABCBBCABBBACBABBAABAAAABBBAABABAAABCCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACAABBCBACCBCAACCAAAABACBBCCCCACBAABAABAAACCABCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                  2⤵
                                    PID:4932
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCCBCCBCAACAAAACBCCBBCBCBBBAAABCACCBAAABAAAACACCCBBCBCAAAAABCABCBBCABBBACBABBAABAAAABBBAABABAAABCCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACAABBCBACCBCAACCAAAABACBBCCCCACBAABAABAAACCABCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                      3⤵
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1600
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBAACBAAABACACCAACCCBCACCCABBBBBCAACBACAAACAABACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACAABBCBACCBCAACCAAAABACBBCCCCACBAABAABAAACCABCCB.exe" start= auto displayName= "UserDataSvc_ABBAACBAAABACACCAACCCBCACCCABBBBBCAACBACAAACAABACBA"
                                    2⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3432
                                    • C:\Windows\SysWOW64\sc.exe
                                      sc create "UserDataSvc_ABBAACBAAABACACCAACCCBCACCCABBBBBCAACBACAAACAABACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACAABBCBACCBCAACCAAAABACBBCCCCACBAABAABAAACCABCCB.exe" start= auto displayName= "UserDataSvc_ABBAACBAAABACACCAACCCBCACCCABBBBBCAACBACAAACAABACBA"
                                      3⤵
                                      • Launches sc.exe
                                      PID:2464
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBAACBAAABACACCAACCCBCACCCABBBBBCAACBACAAACAABACBA"
                                    2⤵
                                      PID:5100
                                      • C:\Windows\SysWOW64\sc.exe
                                        sc start "UserDataSvc_ABBAACBAAABACACCAACCCBCACCCABBBBBCAACBACAAACAABACBA"
                                        3⤵
                                          PID:1512
                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCBCCABBAAACCAABCCBBABBBCAAACBABBBABAABABBCCBBACCB.exe
                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCBCCABBAAACCAABCCBBABBBCAAACBABBBABAABABBCCBBACCB.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4104
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCAABAACCCABBAAABCBCACAABBBCABCCBAABCAABACBBBCBCCACACCCACABCBACCAAACACAABBCBBCCABCCCBAABCCABBAAABCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCAACACCABACCAACBCACAAABBACBABACBBBCAACCBAABCBBCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                        2⤵
                                          PID:5548
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCAABAACCCABBAAABCBCACAABBBCABCCBAABCAABACBBBCBCCACACCCACABCBACCAAACACAABBCBBCCABCCCBAABCCABBAAABCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCAACACCABACCAACBCACAAABBACBABACBBBCAACCBAABCBBCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                            3⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4600
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCABBCBCCAABBBCCBBABABBCBABBAABCBAACABCCCABBAAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCAACACCABACCAACBCACAAABBACBABACBBBCAACCBAABCBBCACC.exe" start= auto displayName= "UserDataSvc_AABCABBCBCCAABBBCCBBABABBCBABBAABCBAACABCCCABBAAAAA"
                                          2⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:4432
                                          • C:\Windows\SysWOW64\sc.exe
                                            sc create "UserDataSvc_AABCABBCBCCAABBBCCBBABABBCBABBAABCBAACABCCCABBAAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCAACACCABACCAACBCACAAABBACBABACBBBCAACCBAABCBBCACC.exe" start= auto displayName= "UserDataSvc_AABCABBCBCCAABBBCCBBABABBCBABBAABCBAACABCCCABBAAAAA"
                                            3⤵
                                              PID:4304
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCABBCBCCAABBBCCBBABABBCBABBAABCBAACABCCCABBAAAAA"
                                            2⤵
                                              PID:3508
                                              • C:\Windows\SysWOW64\sc.exe
                                                sc start "UserDataSvc_AABCABBCBCCAABBBCCBBABABBCBABBAABCBAACABCCCABBAAAAA"
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:5412
                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBCCCCAABACACAACACCBBBBABBACACABACCBCCABAABABBACCCA.exe
                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBCCCCAABACACAACACCBBBBABBACACABACCBCCABAABABBACCCA.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            PID:1788
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABBBAAABABBCBCCBCCBACBBCACCAACBAAACCCCCBBBABBABCACCACBCAAAAAABACAAAACCACCCCCCACBBCCABCBCBAAABBCBBCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBBCACABCBCACBAAAACACAAACCCCAABBBACABCCBBBACABCBCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                              2⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:5280
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABBBAAABABBCBCCBCCBACBBCACCAACBAAACCCCCBBBABBABCACCACBCAAAAAABACAAAACCACCCCCCACBBCCABCBCBAAABBCBBCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBBCACABCBCACBAAAACACAAACCCCAABBBACABCCBBBACABCBCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:5480
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCACBCABBACAACAAACBBCBBCACBCCBCAAABABBCBCCCBAAACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBBCACABCBCACBAAAACACAAACCCCAABBBACABCCBBBACABCBCCAC.exe" start= auto displayName= "UserDataSvc_CCCACBCABBACAACAAACBBCBBCACBCCBCAAABABBCBCCCBAAACBA"
                                              2⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:2860
                                              • C:\Windows\SysWOW64\sc.exe
                                                sc create "UserDataSvc_CCCACBCABBACAACAAACBBCBBCACBCCBCAAABABBCBCCCBAAACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBBCACABCBCACBAAAACACAAACCCCAABBBACABCCBBBACABCBCCAC.exe" start= auto displayName= "UserDataSvc_CCCACBCABBACAACAAACBBCBBCACBCCBCAAABABBCBCCCBAAACBA"
                                                3⤵
                                                • Launches sc.exe
                                                PID:4140
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCACBCABBACAACAAACBBCBBCACBCCBCAAABABBCBCCCBAAACBA"
                                              2⤵
                                                PID:2708
                                                • C:\Windows\SysWOW64\sc.exe
                                                  sc start "UserDataSvc_CCCACBCABBACAACAAACBBCBBCACBCCBCAAABABBCBCCCBAAACBA"
                                                  3⤵
                                                    PID:1904
                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBBCBBCCBBBCAAACAACABABCAAABCBABABCCCCBABBCAABBBAA.exe
                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBBCBBCCBBBCAAACAACABABCAAABCBABABCCCCBABBCAABBBAA.exe
                                                1⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1232
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAABABCCCBABCBAAAABBCBABBBCACBBCCBCBAABCCCBACBCBBCAABAAACCACBCABACACAACCAABBCCCCAABCABBACBCABABCABACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAAAACBCBCBAACABBBACCAAABBBAABBCBAABBCBCBAAABCACBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                  2⤵
                                                    PID:2204
                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAABABCCCBABCBAAAABBCBABBBCACBBCCBCBAABCCCBACBCBBCAABAAACCACBCABACACAACCAABBCCCCAABCABBACBCABABCABACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAAAACBCBCBAACABBBACCAAABBBAABBCBAABBCBCBAAABCACBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                      3⤵
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:124
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCCBAAACBAABABCCACACCAACBCACABBCACBBABCBAAABCABACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAAAACBCBCBAACABBBACCAAABBBAABBCBAABBCBCBAAABCACBABC.exe" start= auto displayName= "UserDataSvc_BCCCBAAACBAABABCCACACCAACBCACABBCACBBABCBAAABCABACA"
                                                    2⤵
                                                      PID:4768
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc create "UserDataSvc_BCCCBAAACBAABABCCACACCAACBCACABBCACBBABCBAAABCABACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAAAACBCBCBAACABBBACCAAABBBAABBCBAABBCBCBAAABCACBABC.exe" start= auto displayName= "UserDataSvc_BCCCBAAACBAABABCCACACCAACBCACABBCACBBABCBAAABCABACA"
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:52
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCCBAAACBAABABCCACACCAACBCACABBCACBBABCBAAABCABACA"
                                                      2⤵
                                                        PID:4736
                                                        • C:\Windows\SysWOW64\sc.exe
                                                          sc start "UserDataSvc_BCCCBAAACBAABABCCACACCAACBCACABBCACBBABCBAAABCABACA"
                                                          3⤵
                                                            PID:5972
                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBBCBBCCBBBCAAACAACABABCAAABCBABABCCCCBABBCAABBBAA.exe
                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBBCBBCCBBBCAAACAACABABCAAABCBABABCCCCBABBCAABBBAA.exe
                                                        1⤵
                                                        • Drops startup file
                                                        • Executes dropped EXE
                                                        • Adds Run key to start application
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1668
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACACBCBCCCCCCCCAAACAABCCCBCBCBBCBCCCACABBCAACCCACCACABCCBCCAACCACBCBBCBACABCBCACCCAACBCABCABCBAAABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACBCBCCCCCCCCAAACAABCCCBCBCBBCBCCCACABBCAACCCACCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                          2⤵
                                                            PID:1840
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACACBCBCCCCCCCCAAACAABCCCBCBCBBCBCCCACABBCAACCCACCACABCCBCCAACCACBCBBCBACABCBCACCCAACBCABCABCBAAABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACBCBCCCCCCCCAAACAABCCCBCBCBBCBCCCACABBCAACCCACCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                              3⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:5052
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBCCBCABAAACBBBCBBBBBAABBCCBAABBBAAAACBAABCAAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACBCBCCCCCCCCAAACAABCCCBCBCBBCBCCCACABBCAACCCACCACA.exe" start= auto displayName= "UserDataSvc_CACBCCBCABAAACBBBCBBBBBAABBCCBAABBBAAAACBAABCAAAABB"
                                                            2⤵
                                                              PID:5648
                                                              • C:\Windows\SysWOW64\sc.exe
                                                                sc create "UserDataSvc_CACBCCBCABAAACBBBCBBBBBAABBCCBAABBBAAAACBAABCAAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACBCBCCCCCCCCAAACAABCCCBCBCBBCBCCCACABBCAACCCACCACA.exe" start= auto displayName= "UserDataSvc_CACBCCBCABAAACBBBCBBBBBAABBCCBAABBBAAAACBAABCAAAABB"
                                                                3⤵
                                                                • Launches sc.exe
                                                                PID:5912
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBCCBCABAAACBBBCBBBBBAABBCCBAABBBAAAACBAABCAAAABB"
                                                              2⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:3320
                                                              • C:\Windows\SysWOW64\sc.exe
                                                                sc start "UserDataSvc_CACBCCBCABAAACBBBCBBBBBAABBCCBAABBBAAAACBAABCAAAABB"
                                                                3⤵
                                                                • Launches sc.exe
                                                                PID:3688
                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBBCACABCBCACBAAAACACAAACCCCAABBBACABCCBBBACABCBCCAC.exe
                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBBCACABCBCACBAAAACACAAACCCCAABBBACABCCBBBACABCBCCAC.exe
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2032
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCACBBCBACCCCABACBBABACCCBCACBBACABACBBABAAAACCBCAAAACBCBBCBCACABACCACABCCCCCBAABCACBCCABBBABACCACBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACBBCBACCCCABACBBABACCCBCACBBACABACBBABAAAACCBCAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                              2⤵
                                                                PID:4844
                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCACBBCBACCCCABACBBABACCCBCACBBACABACBBABAAAACCBCAAAACBCBBCBCACABACCACABCCCCCBAABCACBCCABBBABACCACBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACBBCBACCCCABACBBABACCCBCACBBACABACBBABAAAACCBCAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                  3⤵
                                                                  • Scheduled Task/Job: Scheduled Task
                                                                  PID:2468
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABACACAACCCCCCCABBBBBABABABBBAAABAAACBCBABCBACCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACBBCBACCCCABACBBABACCCBCACBBACABACBBABAAAACCBCAAAA.exe" start= auto displayName= "UserDataSvc_CABACACAACCCCCCCABBBBBABABABBBAAABAAACBCBABCBACCCAC"
                                                                2⤵
                                                                  PID:1332
                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                    sc create "UserDataSvc_CABACACAACCCCCCCABBBBBABABABBBAAABAAACBCBABCBACCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACBBCBACCCCABACBBABACCCBCACBBACABACBBABAAAACCBCAAAA.exe" start= auto displayName= "UserDataSvc_CABACACAACCCCCCCABBBBBABABABBBAAABAAACBCBABCBACCCAC"
                                                                    3⤵
                                                                    • Launches sc.exe
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:2996
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABACACAACCCCCCCABBBBBABABABBBAAABAAACBCBABCBACCCAC"
                                                                  2⤵
                                                                    PID:4044
                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                      sc start "UserDataSvc_CABACACAACCCCCCCABBBBBABABABBBAAABAAACBCBABCBACCCAC"
                                                                      3⤵
                                                                        PID:6080
                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACAABBCBACCBCAACCAAAABACBBCCCCACBAABAABAAACCABCCB.exe
                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACAABBCBACCBCAACCAAAABACBBCCCCACBAABAABAAACCABCCB.exe
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Adds Run key to start application
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:1204
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBAAACCAAACCABCCBAACAAABAABBCAACBBCBBABACBCCBCACACACBBBABCBBABABBACBCBBAACCAACBCBABACAACBBABCAAAAAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAABBABBBBBBCAACBCCBBAAAAACBACACABABABCAABBABCBAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                      2⤵
                                                                        PID:4696
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBAAACCAAACCABCCBAACAAABAABBCAACBBCBBABACBCCBCACACACBBBABCBBABABBACBCBBAACCAACBCBABACAACBBABCAAAAAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAABBABBBBBBCAACBCCBBAAAAACBACACABABABCAABBABCBAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                          3⤵
                                                                            PID:1044
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCBBCACCBCCAABCAACBACCABCBACCBCCAABABCCACAAACBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAABBABBBBBBCAACBCCBBAAAAACBACACABABABCAABBABCBAABC.exe" start= auto displayName= "UserDataSvc_CCBCBBCACCBCCAABCAACBACCABCBACCBCCAABABCCACAAACBBAA"
                                                                          2⤵
                                                                            PID:2776
                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                              sc create "UserDataSvc_CCBCBBCACCBCCAABCAACBACCABCBACCBCCAABABCCACAAACBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAABBABBBBBBCAACBCCBBAAAAACBACACABABABCAABBABCBAABC.exe" start= auto displayName= "UserDataSvc_CCBCBBCACCBCCAABCAACBACCABCBACCBCCAABABCCACAAACBBAA"
                                                                              3⤵
                                                                                PID:1720
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCBBCACCBCCAABCAACBACCABCBACCBCCAABABCCACAAACBBAA"
                                                                              2⤵
                                                                                PID:2852
                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                  sc start "UserDataSvc_CCBCBBCACCBCCAABCAACBACCABCBACCBCCAABABCCACAAACBBAA"
                                                                                  3⤵
                                                                                    PID:5724
                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACAABBCBACCBCAACCAAAABACBBCCCCACBAABAABAAACCABCCB.exe
                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACAABBCBACCBCAACCAAAABACBBCCCCACBAABAABAAACCABCCB.exe
                                                                                1⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:1616
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACAAABBBBCACACCAAAAABCAAACBABBCACCCACCBCACCCAABAACBCBBCBCAACAAACCABACCCCBABBABCACCACABCAABBBBCCAAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCAABBACCCAABABAAABABABACCACCBCBAABACCBCCCCBCBAABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                  2⤵
                                                                                    PID:3884
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACAAABBBBCACACCAAAAABCAAACBABBCACCCACCBCACCCAABAACBCBBCBCAACAAACCABACCCCBABBABCACCACABCAABBBBCCAAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCAABBACCCAABABAAABABABACCACCBCBAABACCBCCCCBCBAABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                      3⤵
                                                                                        PID:3560
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACBCBBCACABBBCCBBBBCBACCCCBABABBBAACBAABCBBACABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCAABBACCCAABABAAABABABACCACCBCBAABACCBCCCCBCBAABCAC.exe" start= auto displayName= "UserDataSvc_BBACBCBBCACABBBCCBBBBCBACCCCBABABBBAACBAABCBBACABCA"
                                                                                      2⤵
                                                                                        PID:3140
                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                          sc create "UserDataSvc_BBACBCBBCACABBBCCBBBBCBACCCCBABABBBAACBAABCBBACABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCAABBACCCAABABAAABABABACCACCBCBAABACCBCCCCBCBAABCAC.exe" start= auto displayName= "UserDataSvc_BBACBCBBCACABBBCCBBBBCBACCCCBABABBBAACBAABCBBACABCA"
                                                                                          3⤵
                                                                                            PID:1452
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACBCBBCACABBBCCBBBBCBACCCCBABABBBAACBAABCBBACABCA"
                                                                                          2⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:3636
                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                            sc start "UserDataSvc_BBACBCBBCACABBBCCBBBBCBACCCCBABABBBAACBAABCBBACABCA"
                                                                                            3⤵
                                                                                            • Launches sc.exe
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2176
                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBABBBCAACACCAABBCBBCABCCBBCCBACABCBCBAACCCBBCABCCCA.exe
                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBABBBCAACACCAABBCBBCABCCBBCCBACABCBCBAACCCBBCABCCCA.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2736
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCBBBBAAAAAABCBBACAACACACCBAACACBCCBBCCCCAAABCBCABCBABCABCAACCABCACCABABBABABBCAAAACCABBACBACCAACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAAAACCABBACCCBBACBBABACACBBBABACABCABABAAAAAACBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                          2⤵
                                                                                            PID:1640
                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCBBBBAAAAAABCBBACAACACACCBAACACBCCBBCCCCAAABCBCABCBABCABCAACCABCACCABABBABABBCAAAACCABBACBACCAACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAAAACCABBACCCBBACBBABACACBBBABACABCABABAAAAAACBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                              3⤵
                                                                                                PID:2392
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBAACCBABBBCCACAACBBBABCAACBBBABCBAACACBBBABCCBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAAAACCABBACCCBBACBBABACACBBBABACABCABABAAAAAACBBBA.exe" start= auto displayName= "UserDataSvc_CCBBAACCBABBBCCACAACBBBABCAACBBBABCBAACACBBBABCCBCA"
                                                                                              2⤵
                                                                                                PID:1340
                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                  sc create "UserDataSvc_CCBBAACCBABBBCCACAACBBBABCAACBBBABCBAACACBBBABCCBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAAAACCABBACCCBBACBBABACACBBBABACABCABABAAAAAACBBBA.exe" start= auto displayName= "UserDataSvc_CCBBAACCBABBBCCACAACBBBABCAACBBBABCBAACACBBBABCCBCA"
                                                                                                  3⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:5340
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBAACCBABBBCCACAACBBBABCAACBBBABCBAACACBBBABCCBCA"
                                                                                                2⤵
                                                                                                  PID:3268
                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                    sc start "UserDataSvc_CCBBAACCBABBBCCACAACBBBABCAACBBBABCBAACACBBBABCCBCA"
                                                                                                    3⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:3216
                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBABBBCAACACCAABBCBBCABCCBBCCBACABCBCBAACCCBBCABCCCA.exe
                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBABBBCAACACCAABBCBBCABCCBBCCBACABCBCBAACCCBBCABCCCA.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Adds Run key to start application
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:3176
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAAABCBBAABCCCABBBCAACCBABBACAAABACCCBBBCCAAACCCBBBBBAABACBCCBCBABACBBCCCCCCABABCCCCBCABBBCABABABABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAABCBBAABCCCABBBCAACCBABBACAAABACCCBBBCCAAACCCBBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                  2⤵
                                                                                                    PID:3152
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAAABCBBAABCCCABBBCAACCBABBACAAABACCCBBBCCAAACCCBBBBBAABACBCCBCBABACBBCCCCCCABABCCCCBCABBBCABABABABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAABCBBAABCCCABBBCAACCBABBACAAABACCCBBBCCAAACCCBBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                      3⤵
                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                      PID:3824
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBAABCBABAABBCACAACAAAABBABACABBCCCBCBCCCCCBBBBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAABCBBAABCCCABBBCAACCBABBACAAABACCCBBBCCAAACCCBBBBB.exe" start= auto displayName= "UserDataSvc_ABBAABCBABAABBCACAACAAAABBABACABBCCCBCBCCCCCBBBBCBC"
                                                                                                    2⤵
                                                                                                      PID:4532
                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                        sc create "UserDataSvc_ABBAABCBABAABBCACAACAAAABBABACABBCCCBCBCCCCCBBBBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAABCBBAABCCCABBBCAACCBABBACAAABACCCBBBCCAAACCCBBBBB.exe" start= auto displayName= "UserDataSvc_ABBAABCBABAABBCACAACAAAABBABACABBCCCBCBCCCCCBBBBCBC"
                                                                                                        3⤵
                                                                                                          PID:1928
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBAABCBABAABBCACAACAAAABBABACABBCCCBCBCCCCCBBBBCBC"
                                                                                                        2⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:3632
                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                          sc start "UserDataSvc_ABBAABCBABAABBCACAACAAAABBABACABBCCCBCBCCCCCBBBBCBC"
                                                                                                          3⤵
                                                                                                          • Launches sc.exe
                                                                                                          PID:2236
                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCAACACCABACCAACBCACAAABBACBABACBBBCAACCBAABCBBCACC.exe
                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCAACACCABACCAACBCACAAABBACBABACBBBCAACCBAABCBBCACC.exe
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:4160
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBABCACBAABACBAACBABBBCBCCBBACBCCBBAAABCACCABABCBAAABCBBCBABBAABBBCCCBBACACACABCBBAAAAACCAACCCACACCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCACBCCCBBBCBABBCABACABBCABBBABAAACABCBBBCCABAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                        2⤵
                                                                                                          PID:6000
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBABCACBAABACBAACBABBBCBCCBBACBCCBBAAABCACCABABCBAAABCBBCBABBAABBBCCCBBACACACABCBBAAAAACCAACCCACACCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCACBCCCBBBCBABBCABACABBCABBBABAAACABCBBBCCABAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                            3⤵
                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                            PID:3892
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBBACACCAACACCCCAABBCBCCAABACBCABAACCBABCACCBCAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCACBCCCBBBCBABBCABACABBCABBBABAAACABCBBBCCABAAAA.exe" start= auto displayName= "UserDataSvc_BBBBACACCAACACCCCAABBCBCCAABACBCABAACCBABCACCBCAACB"
                                                                                                          2⤵
                                                                                                            PID:2980
                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                              sc create "UserDataSvc_BBBBACACCAACACCCCAABBCBCCAABACBCABAACCBABCACCBCAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCACBCCCBBBCBABBCABACABBCABBBABAAACABCBBBCCABAAAA.exe" start= auto displayName= "UserDataSvc_BBBBACACCAACACCCCAABBCBCCAABACBCABAACCBABCACCBCAACB"
                                                                                                              3⤵
                                                                                                                PID:4952
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBBACACCAACACCCCAABBCBCCAABACBCABAACCBABCACCBCAACB"
                                                                                                              2⤵
                                                                                                                PID:4224
                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                  sc start "UserDataSvc_BBBBACACCAACACCCCAABBCBCCAABACBCABAACCBABCACCBCAACB"
                                                                                                                  3⤵
                                                                                                                  • Launches sc.exe
                                                                                                                  PID:3200
                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCAACACCABACCAACBCACAAABBACBABACBBBCAACCBAABCBBCACC.exe
                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCAACACCABACCAACBCACAAABBACBABACBBBCAACCBAABCBBCACC.exe
                                                                                                              1⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Adds Run key to start application
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2592
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAAAACCACBCCCBBBCBABBCABACABBCABBBABAAACABCBBBCCABAAAACABCCBBBCACABCABCCBBBBABBBCBABBCBBAAAACCACCBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCACBCCCBBBCBABBCABACABBCABBBABAAACABCBBBCCABAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                2⤵
                                                                                                                  PID:4720
                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAAAACCACBCCCBBBCBABBCABACABBCABBBABAAACABCBBBCCABAAAACABCCBBBCACABCABCCBBBBABBBCBABBCBBAAAACCACCBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCACBCCCBBBCBABBCABACABBCABBBABAAACABCBBBCCABAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                    3⤵
                                                                                                                      PID:1828
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABABBCCBAABACBBBCABCBBCBBBCCAAACBACCACBBABBABBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCACBCCCBBBCBABBCABACABBCABBBABAAACABCBBBCCABAAAA.exe" start= auto displayName= "UserDataSvc_BBABABBCCBAABACBBBCABCBBCBBBCCAAACBACCACBBABBABBCAA"
                                                                                                                    2⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:4564
                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                      sc create "UserDataSvc_BBABABBCCBAABACBBBCABCBBCBBBCCAAACBACCACBBABBABBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCACBCCCBBBCBABBCABACABBCABBBABAAACABCBBBCCABAAAA.exe" start= auto displayName= "UserDataSvc_BBABABBCCBAABACBBBCABCBBCBBBCCAAACBACCACBBABBABBCAA"
                                                                                                                      3⤵
                                                                                                                      • Launches sc.exe
                                                                                                                      PID:1856
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABABBCCBAABACBBBCABCBBCBBBCCAAACBACCACBBABBABBCAA"
                                                                                                                    2⤵
                                                                                                                      PID:1516
                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                        sc start "UserDataSvc_BBABABBCCBAABACBBBCABCBBCBBBCCAAACBACCACBBABBABBCAA"
                                                                                                                        3⤵
                                                                                                                        • Launches sc.exe
                                                                                                                        PID:5796
                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACBCBCCCCCCCCAAACAABCCCBCBCBBCBCCCACABBCAACCCACCACA.exe
                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACBCBCCCCCCCCAAACAABCCCBCBCBBCBCCCACABBCAACCCACCACA.exe
                                                                                                                    1⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Adds Run key to start application
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:2008
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCBCAAACACCCCCABCACBCCABABCBBBCCBBCACCACABABAABCABBAABBAABABABACCCBCBAAABCCCACBAABCCCBBAACCACCBBBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAABCCCBAACCBABABBACBCCBBAACCABBAAAAACBCCACBCBACCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                      2⤵
                                                                                                                        PID:2296
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCBCAAACACCCCCABCACBCCABABCBBBCCBBCACCACABABAABCABBAABBAABABABACCCBCBAAABCCCACBAABCCCBBAACCACCBBBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAABCCCBAACCBABABBACBCCBBAACCABBAAAAACBCCACBCBACCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                          3⤵
                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                          PID:1828
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABABBBACBCACBCBBBBBBCACBACBCBCACAAAACAACBCACBABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAABCCCBAACCBABABBACBCCBBAACCABBAAAAACBCCACBCBACCAAA.exe" start= auto displayName= "UserDataSvc_BABABBBACBCACBCBBBBBBCACBACBCBCACAAAACAACBCACBABBBC"
                                                                                                                        2⤵
                                                                                                                          PID:4484
                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                            sc create "UserDataSvc_BABABBBACBCACBCBBBBBBCACBACBCBCACAAAACAACBCACBABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAABCCCBAACCBABABBACBCCBBAACCABBAAAAACBCCACBCBACCAAA.exe" start= auto displayName= "UserDataSvc_BABABBBACBCACBCBBBBBBCACBACBCBCACAAAACAACBCACBABBBC"
                                                                                                                            3⤵
                                                                                                                              PID:4308
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABABBBACBCACBCBBBBBBCACBACBCBCACAAAACAACBCACBABBBC"
                                                                                                                            2⤵
                                                                                                                              PID:1748
                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                sc start "UserDataSvc_BABABBBACBCACBCBBBBBBCACBACBCBCACAAAACAACBCACBABBBC"
                                                                                                                                3⤵
                                                                                                                                • Launches sc.exe
                                                                                                                                PID:3444
                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACBCBCCCCCCCCAAACAABCCCBCBCBBCBCCCACABBCAACCCACCACA.exe
                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACBCBCCCCCCCCAAACAABCCCBCBCBBCBCCCACABBCAACCCACCACA.exe
                                                                                                                            1⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:4296
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAACCBCABAACCBACCBABABAACACCACCBACBBCBBABCCBAACBABBBBCACBCCBCABACCAACBBBCBAABBABACAABCAAABAAAACABAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBABABBCBACACCCABAACCBAAACCCCBCABCBCCCBBBACCCCBBAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                              2⤵
                                                                                                                                PID:256
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAACCBCABAACCBACCBABABAACACCACCBACBBCBBABCCBAACBABBBBCACBCCBCABACCAACBBBCBAABBABACAABCAAABAAAACABAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBABABBCBACACCCABAACCBAAACCCCBCABCBCCCBBBACCCCBBAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                  3⤵
                                                                                                                                    PID:2580
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBBCBABBBBCBBBCBBBABACCAACBCBABACBCCCACACAAABACCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBABABBCBACACCCABAACCBAAACCCCBCABCBCCCBBBACCCCBBAACC.exe" start= auto displayName= "UserDataSvc_BBBBCBABBBBCBBBCBBBABACCAACBCBABACBCCCACACAAABACCAC"
                                                                                                                                  2⤵
                                                                                                                                    PID:5268
                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                      sc create "UserDataSvc_BBBBCBABBBBCBBBCBBBABACCAACBCBABACBCCCACACAAABACCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBABABBCBACACCCABAACCBAAACCCCBCABCBCCCBBBACCCCBBAACC.exe" start= auto displayName= "UserDataSvc_BBBBCBABBBBCBBBCBBBABACCAACBCBABACBCCCACACAAABACCAC"
                                                                                                                                      3⤵
                                                                                                                                        PID:2404
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBBCBABBBBCBBBCBBBABACCAACBCBABACBCCCACACAAABACCAC"
                                                                                                                                      2⤵
                                                                                                                                        PID:1908
                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                          sc start "UserDataSvc_BBBBCBABBBBCBBBCBBBABACCAACBCBABACBCCCACACAAABACCAC"
                                                                                                                                          3⤵
                                                                                                                                          • Launches sc.exe
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:2168
                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAAAACBCBCBAACABBBACCAAABBBAABBCBAABBCBCBAAABCACBABC.exe
                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAAAACBCBCBAACABBBACCAAABBBAABBCBAABBCBCBAAABCACBABC.exe
                                                                                                                                      1⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:1964
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACCACBBBCAACBBABABABACBCBCBAAABCAABBCABABCACBCCCACAAAABBAACAAACCCCBCBAAAACBBBAABABCBBAABABCABABBBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABBBCABCCBCCCABBCBACABBBBCBBCCCCCCBBBAAABABAACACBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                        2⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:2368
                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACCACBBBCAACBBABABABACBCBCBAAABCAABBCABABCACBCCCACAAAABBAACAAACCCCBCBAAAACBBBAABABCBBAABABCABABBBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABBBCABCCBCCCABBCBACABBBBCBBCCCCCCBBBAAABABAACACBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                          3⤵
                                                                                                                                            PID:5040
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACCBBBBBBACBBCAACCACBACACBABACBBCCCACBCCABBCAACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABBBCABCCBCCCABBCBACABBBBCBBCCCCCCBBBAAABABAACACBAA.exe" start= auto displayName= "UserDataSvc_BAACCBBBBBBACBBCAACCACBACACBABACBBCCCACBCCABBCAACAC"
                                                                                                                                          2⤵
                                                                                                                                            PID:2824
                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                              sc create "UserDataSvc_BAACCBBBBBBACBBCAACCACBACACBABACBBCCCACBCCABBCAACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABBBCABCCBCCCABBCBACABBBBCBBCCCCCCBBBAAABABAACACBAA.exe" start= auto displayName= "UserDataSvc_BAACCBBBBBBACBBCAACCACBACACBABACBBCCCACBCCABBCAACAC"
                                                                                                                                              3⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:1976
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACCBBBBBBACBBCAACCACBACACBABACBBCCCACBCCABBCAACAC"
                                                                                                                                            2⤵
                                                                                                                                              PID:4456
                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                sc start "UserDataSvc_BAACCBBBBBBACBBCAACCACBACACBABACBBCCCACBCCABBCAACAC"
                                                                                                                                                3⤵
                                                                                                                                                  PID:932
                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACBBCBACCCCABACBBABACCCBCACBBACABACBBABAAAACCBCAAAA.exe
                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACBBCBACCCCABACBBABACCCBCACBBACABACBBABAAAACCBCAAAA.exe
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:4376
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCBAACCCACCBBCACBCAACCABCACCCBCBCAAAAAACCCBCCACABABCBBABACBBCCACBBCACABCBCABBBCAABBBCCBCBCACBABCCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAAAABCCBCBABCAACBCACACABACBBBACCAACCACCABBCBACABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                2⤵
                                                                                                                                                  PID:7572
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCBAACCCACCBBCACBCAACCABCACCCBCBCAAAAAACCCBCCACABABCBBABACBBCCACBBCACABCBCABBBCAABBBCCBCBCACBABCCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAAAABCCBCBABCAACBCACACABACBBBACCAACCACCABBCBACABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                    3⤵
                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                    PID:7888
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCCCCBCBBBBBBBBBAAACBBBAABACBABCACCABABCABAAAAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAAAABCCBCBABCAACBCACACABACBBBACCAACCACCABBCBACABAAA.exe" start= auto displayName= "UserDataSvc_BABCCCCBCBBBBBBBBBAAACBBBAABACBABCACCABABCABAAAAAAC"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:8012
                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                      sc create "UserDataSvc_BABCCCCBCBBBBBBBBBAAACBBBAABACBABCACCABABCABAAAAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAAAABCCBCBABCAACBCACACABACBBBACCAACCACCABBCBACABAAA.exe" start= auto displayName= "UserDataSvc_BABCCCCBCBBBBBBBBBAAACBBBAABACBABCACCABABCABAAAAAAC"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:7688
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABCCCCBCBBBBBBBBBAAACBBBAABACBABCACCABABCABAAAAAAC"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:8072
                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                          sc start "UserDataSvc_BABCCCCBCBBBBBBBBBAAACBBBAABACBABCACCABABCABAAAAAAC"
                                                                                                                                                          3⤵
                                                                                                                                                          • Launches sc.exe
                                                                                                                                                          PID:3348
                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCACBCCCBBBCBABBCABACABBCABBBABAAACABCBBBCCABAAAA.exe
                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCACBCCCBBBCBABBCABACABBCABBBABAAACABCBBBCCABAAAA.exe
                                                                                                                                                      1⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:2256
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCBBCBBBBAACBCCBCBACAAACAAACCACAABACBBAAABCACCAAAAACAACACBBBAABBCAABCBBBBABBACBCBABCAABBBCBABBCBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABACCAAAABAACACCCABBCCCAAAABCBBCCAABCACACCAACACCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                        2⤵
                                                                                                                                                          PID:3972
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCBBCBBBBAACBCCBCBACAAACAAACCACAABACBBAAABCACCAAAAACAACACBBBAABBCAABCBBBBABBACBCBABCAABBBCBABBCBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABACCAAAABAACACCCABBCCCAAAABCBBCCAABCACACCAACACCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                            3⤵
                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                            PID:6160
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABCABAACBCBBACABBACCBCBCCBACABBCCCCBCCBABACBBCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABACCAAAABAACACCCABBCCCAAAABCBBCCAABCACACCAACACCCCA.exe" start= auto displayName= "UserDataSvc_CCABCABAACBCBBACABBACCBCBCCBACABBCCCCBCCBABACBBCABA"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:6348
                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                              sc create "UserDataSvc_CCABCABAACBCBBACABBACCBCBCCBACABBCCCCBCCBABACBBCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABACCAAAABAACACCCABBCCCAAAABCBBCCAABCACACCAACACCCCA.exe" start= auto displayName= "UserDataSvc_CCABCABAACBCBBACABBACCBCBCCBACABBCCCCBCCBABACBBCABA"
                                                                                                                                                              3⤵
                                                                                                                                                              • Launches sc.exe
                                                                                                                                                              PID:6688
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABCABAACBCBBACABBACCBCBCCBACABBCCCCBCCBABACBBCABA"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:7116
                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                sc start "UserDataSvc_CCABCABAACBCBBACABBACCBCBCCBACABBCCCCBCCBABACBBCABA"
                                                                                                                                                                3⤵
                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                PID:4012
                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCACBCCCBBBCBABBCABACABBCABBBABAAACABCBBBCCABAAAA.exe
                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCACBCCCBBBCBABBCABACABBCABBBABAAACABCBBBCCABAAAA.exe
                                                                                                                                                            1⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:2472
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACCCBCCBBCCBABBCBCCBBACBABCABACABCBCCBBCBCACABBABBACCACCCCACACBABCBBBCCCAABABCBBAAABACAACACCABBABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBBCBBBBAACBCCBCBACAAACAAACCACAABACBBAAABCACCAAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                              2⤵
                                                                                                                                                                PID:5192
                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACCCBCCBBCCBABBCBCCBBACBABCABACABCBCCBBCBCACABBABBACCACCCCACACBABCBBBCCCAABABCBBAAABACAACACCABBABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBBCBBBBAACBCCBCBACAAACAAACCACAABACBBAAABCACCAAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:6192
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACAACABABBAACAACABBCCAAAACCABBAABCBABBABAABACAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBBCBBBBAACBCCBCBACAAACAAACCACAABACBBAAABCACCAAAAAC.exe" start= auto displayName= "UserDataSvc_BAACAACABABBAACAACABBCCAAAACCABBAABCBABBABAABACAAAA"
                                                                                                                                                                  2⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:6396
                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                    sc create "UserDataSvc_BAACAACABABBAACAACABBCCAAAACCABBAABCBABBABAABACAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBBCBBBBAACBCCBCBACAAACAAACCACAABACBBAAABCACCAAAAAC.exe" start= auto displayName= "UserDataSvc_BAACAACABABBAACAACABBCCAAAACCABBAABCBABBABAABACAAAA"
                                                                                                                                                                    3⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:6676
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACAACABABBAACAACABBCCAAAACCABBAABCBABBABAABACAAAA"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:7036
                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                      sc start "UserDataSvc_BAACAACABABBAACAACABBCCAAAACCABBAABCBABBABAABACAAAA"
                                                                                                                                                                      3⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:6392
                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCACBCCCBBBCBABBCABACABBCABBBABAAACABCBBBCCABAAAA.exe
                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAACCACBCCCBBBCBABBCABACABBCABBBABAAACABCBBBCCABAAAA.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:6004
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBAACCBACACACBACACACAAAACABAACCBBBCBBBCACBABABCCCACBABBAABAABBABAACCCBACBCBABCBCCCCACAACAACABBBABABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCAAAAACACAACCACBABBBABCCBCCABAABAAAACBABAAAACBCBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                    2⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:4796
                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBAACCBACACACBACACACAAAACABAACCBBBCBBBCACBABABCCCACBABBAABAABBABAACCCBACBCBABCBCCCCACAACAACABBBABABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCAAAAACACAACCACBABBBABCCBCCABAABAAAACBABAAAACBCBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                      3⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                      PID:3420
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABBCABACCCACABCCCACCAAABAACCABBBCBBCBCBAACCCCABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCAAAAACACAACCACBABBBABCCBCCABAABAAAACBABAAAACBCBCCB.exe" start= auto displayName= "UserDataSvc_BAABBCABACCCACABCCCACCAAABAACCABBBCBBCBCBAACCCCABCC"
                                                                                                                                                                    2⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:6232
                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                      sc create "UserDataSvc_BAABBCABACCCACABCCCACCAAABAACCABBBCBBCBCBAACCCCABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCAAAAACACAACCACBABBBABCCBCCABAABAAAACBABAAAACBCBCCB.exe" start= auto displayName= "UserDataSvc_BAABBCABACCCACABCCCACCAAABAACCABBBCBBCBCBAACCCCABCC"
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                      PID:6668
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABBCABACCCACABCCCACCAAABAACCABBBCBBCBCBAACCCCABCC"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:6968
                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                        sc start "UserDataSvc_BAABBCABACCCACABCCCACCAAABAACCABBBCBBCBCBAACCCCABCC"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:6716
                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAABBABBBBBBCAACBCCBBAAAAACBACACABABABCAABBABCBAABC.exe
                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAABBABBBBBBCAACBCCBBAAAAACBACACABABABCAABBABCBAABC.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:5884
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBAACAAAABACBCABAACACBABCBBCBCCCABCBBACCCBCBABCABBBCCBCAABAABBBABABCCCBCCABCBCCBACCABBBAAAACBABBABBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCBCCBBACCCCBCACAAABCBBACBACBBAACAACACBAACCBABCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:6280
                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBAACAAAABACBCABAACACBABCBBCBCCCABCBBACCCBCBABCABBBCCBCAABAABBBABABCCCBCCABCBCCBACCABBBAAAACBABBABBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCBCCBBACCCCBCACAAABCBBACBACBBAACAACACBAACCBABCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                            3⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                            PID:6588
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBBCCAABBCCCAABBBAACCCBCCACCCCACBCCACBBABACACABCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCBCCBBACCCCBCACAAABCBBACBACBBAACAACACBAACCBABCBCC.exe" start= auto displayName= "UserDataSvc_BBBBCCAABBCCCAABBBAACCCBCCACCCCACBCCACBBABACACABCCA"
                                                                                                                                                                          2⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:6720
                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                            sc create "UserDataSvc_BBBBCCAABBCCCAABBBAACCCBCCACCCCACBCCACBBABACACABCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCBCCBBACCCCBCACAAABCBBACBACBBAACAACACBAACCBABCBCC.exe" start= auto displayName= "UserDataSvc_BBBBCCAABBCCCAABBBAACCCBCCACCCCACBCCACBBABACACABCCA"
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:6196
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBBCCAABBCCCAABBBAACCCBCCACCCCACBCCACBBABACACABCCA"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:6296
                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                              sc start "UserDataSvc_BBBBCCAABBCCCAABBBAACCCBCCACCCCACBCCACBBABACACABCCA"
                                                                                                                                                                              3⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:2364
                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAABBABBBBBBCAACBCCBBAAAAACBACACABABABCAABBABCBAABC.exe
                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAABBABBBBBBCAACBCCBBAAAAACBACACABABABCAABBABCBAABC.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:2640
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCCCBCBBCBABACACBBBCAAACACCAABABACCBCABBCAABAAABBBBABBCBBBBBBCACBABBAAAABABAAABCCBCABBBACAAAAAAABCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABBABACACBBCCBCBAAACCBBCBBABBBBABBBBBBBBBBBAAACCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:7000
                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCCCBCBBCBABACACBBBCAAACACCAABABACCBCABBCAABAAABBBBABBCBBBBBBCACBABBAAAABABAAABCCBCABBBACAAAAAAABCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABBABACACBBCCBCBAAACCBBCBBABBBBABBBBBBBBBBBAAACCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                PID:2200
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBCCACCCCBBBBACABACABAACBCCCBCACBBCAABCCABCCBCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABBABACACBBCCBCBAAACCBBCBBABBBBABBBBBBBBBBBAAACCBAA.exe" start= auto displayName= "UserDataSvc_BACBCCACCCCBBBBACABACABAACBCCCBCACBBCAABCCABCCBCACA"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:6416
                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                  sc create "UserDataSvc_BACBCCACCCCBBBBACABACABAACBCCCBCACBBCAABCCABCCBCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABBABACACBBCCBCBAAACCBBCBBABBBBABBBBBBBBBBBAAACCBAA.exe" start= auto displayName= "UserDataSvc_BACBCCACCCCBBBBACABACABAACBCCCBCACBBCAABCCABCCBCACA"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:5824
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBCCACCCCBBBBACABACABAACBCCCBCACBBCAABCCABCCBCACA"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:6360
                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                      sc start "UserDataSvc_BACBCCACCCCBBBBACABACABAACBCCCBCACBBCAABCCABCCBCACA"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:6948
                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAABCCCBAACCBABABBACBCCBBAACCABBAAAAACBCCACBCBACCAAA.exe
                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAABCCCBAACCBABABBACBCCBBAACCABBAAAAACBCCACBCBACCAAA.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:2700
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACABAABBBABBCCBCACCABCBACABBCCAACAABAACAAAABBACACCBAACCBABABBABBACCAAACBCCBCAACCCCBABCBBAAABAACCBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBBABBCCAAAABCBCBBBBCCCCCBCBCCAAAAABCABBCCBBBABBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:6856
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACABAABBBABBCCBCACCABCBACABBCCAACAABAACAAAABBACACCBAACCBABABBABBACCAAACBCCBCAACCCCBABCBBAAABAACCBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBBABBCCAAAABCBCBBBBCCCCCBCBCCAAAAABCABBCCBBBABBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                        PID:6284
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBABBBABBACAAACCCCABABACBBACCCBCCCCACBBACCABCACABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBBABBCCAAAABCBCBBBBCCCCCBCBCCAAAAABCABBCCBBBABBCBB.exe" start= auto displayName= "UserDataSvc_CBBABBBABBACAAACCCCABABACBBACCCBCCCCACBBACCABCACABB"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:1468
                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                          sc create "UserDataSvc_CBBABBBABBACAAACCCCABABACBBACCCBCCCCACBBACCABCACABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBBABBCCAAAABCBCBBBBCCCCCBCBCCAAAAABCABBCCBBBABBCBB.exe" start= auto displayName= "UserDataSvc_CBBABBBABBACAAACCCCABABACBBACCCBCCCCACBBACCABCACABB"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                          PID:7052
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBABBBABBACAAACCCCABABACBBACCCBCCCCACBBACCABCACABB"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:5524
                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                            sc start "UserDataSvc_CBBABBBABBACAAACCCCABABACBBACCCBCCCCACBBACCABCACABB"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:6956
                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAABCCCBAACCBABABBACBCCBBAACCABBAAAAACBCCACBCBACCAAA.exe
                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAABCCCBAACCBABABBACBCCBBAACCABBAAAAACBCCACBCBACCAAA.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          PID:4272
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBBABACCBBCAAABBAACBCAAABCBACCAABBCACBCBCCCBBCABBABBBABBCAABACCCBCCCBCBBBAAAACCABBAAACCBABABBCAAABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCBCAABCACABAAAAACBBBBABBBCBBABCAAAABBBBBABCABBBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4764
                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBBABACCBBCAAABBAACBCAAABCBACCAABBCACBCBCCCBBCABBABBBABBCAABACCCBCCCBCBBBAAAACCABBAAACCBABABBCAAABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCBCAABCACABAAAAACBBBBABBBCBBABCAAAABBBBBABCABBBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                PID:6436
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACCCCCACCABAACBAACAACBBCCCBABCBBBCBCBABABCBCABCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCBCAABCACABAAAAACBBBBABBBCBBABCAAAABBBBBABCABBBCCA.exe" start= auto displayName= "UserDataSvc_CBACCCCCACCABAACBAACAACBBCCCBABCBBBCBCBABABCBCABCAC"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:6936
                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                  sc create "UserDataSvc_CBACCCCCACCABAACBAACAACBBCCCBABCBBBCBCBABABCBCABCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCBCAABCACABAAAAACBBBBABBBCBBABCAAAABBBBBABCABBBCCA.exe" start= auto displayName= "UserDataSvc_CBACCCCCACCABAACBAACAACBBCCCBABCBBBCBCBABABCBCABCAC"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                  PID:6268
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACCCCCACCABAACBAACAACBBCCCBABCBBBCBCBABABCBCABCAC"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:2632
                                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                    sc start "UserDataSvc_CBACCCCCACCABAACBAACAACBBCCCBABCBBBCBCBABABCBCABCAC"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                    PID:7108
                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBABABBCBACACCCABAACCBAAACCCCBCABCBCCCBBBACCCCBBAACC.exe
                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBABABBCBACACCCABAACCBAAACCCCBCABCBCCCBBBACCCCBBAACC.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                PID:1092
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCCAAABAACCBACBCBBBACBAACCBABBACBACCBCBBBBBCABBABAABBBBCABAACACABACAAAACBCABAABBCCAABAAACBAACCBCCBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACCABBBCBABBACAAABCAABAAACBCACCBBABACABCBCBAACBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:6864
                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCCAAABAACCBACBCBBBACBAACCBABBACBACCBCBBBBBCABBABAABBBBCABAACACABACAAAACBCABAABBCCAABAAACBAACCBCCBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACCABBBCBABBACAAABCAABAAACBCACCBBABACABCBCBAACBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:6248
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCCAABCAABACBABAABCCCBCACBABBBCABBCCBABCCBABBBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACCABBBCBABBACAAABCAABAAACBCACCBBABACABCBCBAACBCCB.exe" start= auto displayName= "UserDataSvc_BACCCAABCAABACBABAABCCCBCACBABBBCABBCCBABCCBABBBBBA"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:6840
                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                        sc create "UserDataSvc_BACCCAABCAABACBABAABCCCBCACBABBBCABBCCBABCCBABBBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACCABBBCBABBACAAABCAABAAACBCACCBBABACABCBCBAACBCCB.exe" start= auto displayName= "UserDataSvc_BACCCAABCAABACBABAABCCCBCACBABBBCABBCCBABCCBABBBBBA"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                        PID:1468
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCCAABCAABACBABAABCCCBCACBABBBCABBCCBABCCBABBBBBA"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:6848
                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                          sc start "UserDataSvc_BACCCAABCAABACBABAABCCCBCACBABBBCABBCCBABCCBABBBBBA"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                          PID:6888
                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBABABBCBACACCCABAACCBAAACCCCBCABCBCCCBBBACCCCBBAACC.exe
                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBABABBCBACACCCABAACCBAAACCCCBCABCBCCCBBBACCCCBBAACC.exe
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      PID:5764
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAABAAABCCBAABBBCCBABBCACBCCBABCACAACACBBABBAAAAAACCBBBBABCBCACCBBCBAACCBAABCACBAACCBABACBCAACCBBABAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABABCCCACBAAAAABCABCACCACABAAABBABCBACCAABACBBAAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:6772
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAABAAABCCBAABBBCCBABBCACBCCBABCACAACACBBABBAAAAAACCBBBBABCBCACCBBCBAACCBAABCACBAACCBABACBCAACCBBABAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABABCCCACBAAAAABCABCACCACABAAABBABCBACCAABACBBAAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                            PID:6160
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCACABACACACBCACACABACACCAAACACCAAACACBBCBCABCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABABCCCACBAAAAABCABCACCACABAAABBABCBACCAABACBBAAACCC.exe" start= auto displayName= "UserDataSvc_BABCACABACACACBCACACABACACCAAACACCAAACACBBCBCABCBBA"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:6344
                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                              sc create "UserDataSvc_BABCACABACACACBCACACABACACCAAACACCAAACACBBCBCABCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABABCCCACBAAAAABCABCACCACABAAABBABCBACCAABACBBAAACCC.exe" start= auto displayName= "UserDataSvc_BABCACABACACACBCACACABACACCAAACACCAAACACBBCBCABCBBA"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:4228
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABCACABACACACBCACACABACACCAAACACCAAACACBBCBCABCBBA"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:6404
                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                  sc start "UserDataSvc_BABCACABACACACBCACACABACACCAAACACCAAACACBBCBCABCBBA"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:6628
                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABBBCABCCBCCCABBCBACABBBBCBBCCCCCCBBBAAABABAACACBAA.exe
                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABBBCABCCBCCCABBCBACABBBBCBBCCCCCCBBBAAABABAACACBAA.exe
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                              PID:5668
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACABCBCBABCCBBBCAACBCABBCCBCBACBBBCCCCCCABACBCCCBAABBABACBBCCCBCABABBABABBCACCCABABBCACABAAACAACACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBABCCAACCCCCACABBBCCBCAAAABABBAAABAABBBABBBABCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:2244
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACABCBCBABCCBBBCAACBCABBCCBCBACBBBCCCCCCABACBCCCBAABBABACBBCCCBCABABBABABBCACCCABABBCACABAAACAACACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBABCCAACCCCCACABBBCCBCAAAABABBAAABAABBBABBBABCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                    PID:6868
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACACBBCAABCBABBCCBCCCCBCACCBCCBABCCACBCAAAABABACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBABCCAACCCCCACABBBCCBCAAAABABBAAABAABBBABBBABCACB.exe" start= auto displayName= "UserDataSvc_AACACBBCAABCBABBCCBCCCCBCACCBCCBABCCACBCAAAABABACBC"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:1512
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                      sc create "UserDataSvc_AACACBBCAABCBABBCCBCCCCBCACCBCCBABCCACBCAAAABABACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBABCCAACCCCCACABBBCCBCAAAABABBAAABAABBBABBBABCACB.exe" start= auto displayName= "UserDataSvc_AACACBBCAABCBABBCCBCCCCBCACCBCCBABCCACBCAAAABABACBC"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:6340
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACACBBCAABCBABBCCBCCCCBCACCBCCBABCCACBCAAAABABACBC"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:6784
                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:6676
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                            sc start "UserDataSvc_AACACBBCAABCBABBCCBCCCCBCACCBCCBABCCACBCAAAABABACBC"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:4812
                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCAABBACCCAABABAAABABABACCACCBCBAABACCBCCCCBCBAABCAC.exe
                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCAABBACCCAABABAAABABABACCACCBCBAABACCBCCCCBCBAABCAC.exe
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:5104
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBABACCACCABACCACCBACBCCBCBBCCCCCAAAACCACABABACCABCCBBCBBCBCCBCBCCACAACCCBCCAABCABCABBCBBBCCBCCABBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBAAACACACAACAABABCCABCCBCBCCBCBACBCACCBABCACAACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:7208
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBABACCACCABACCACCBACBCCBCBBCCCCCAAAACCACABABACCABCCBBCBBCBCCBCBCCACAACCCBCCAABCABCABBCBBBCCBCCABBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBAAACACACAACAABABCCABCCBCBCCBCBACBCACCBABCACAACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                PID:7272
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAACBAACAACBBBAABACBAAACCBBAABBCABAABBCCCBBBCCCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBAAACACACAACAABABCCABCCBCBCCBCBACBCACCBABCACAACAB.exe" start= auto displayName= "UserDataSvc_CCAACBAACAACBBBAABACBAAACCBBAABBCABAABBCCCBBBCCCABB"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:7292
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                sc create "UserDataSvc_CCAACBAACAACBBBAABACBAAACCBBAABBCABAABBCCCBBBCCCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBAAACACACAACAABABCCABCCBCBCCBCBACBCACCBABCACAACAB.exe" start= auto displayName= "UserDataSvc_CCAACBAACAACBBBAABACBAAACCBBAABBCABAABBCCCBBBCCCABB"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:7332
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAACBAACAACBBBAABACBAAACCBBAABBCABAABBCCCBBBCCCABB"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:7352
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                  sc start "UserDataSvc_CCAACBAACAACBBBAABACBAAACCBBAABBCABAABBCCCBBBCCCABB"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:7436
                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAAAACCABBACCCBBACBBABACACBBBABACABCABABAAAAAACBBBA.exe
                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAAAAACCABBACCCBBACBBABACACBBBABACABCABABAAAAAACBBBA.exe
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:3404
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCABABCBBBACCACABAACACCBBCAACAACCBCACCAAACBBCBAACAACACAAAABAABCACCCCAAAABBAACBCABABCACCBCABBBAABBBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCBBCCACBCABBBBABABAACBCCACCCCCCCAABCCCBBACBCBCAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:8336
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCABABCBBBACCACABAACACCBBCAACAACCBCACCAAACBBCBAACAACACAAAABAABCACCCCAAAABBAACBCABABCACCBCABBBAABBBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCBBCCACBCABBBBABABAACBCCACCCCCCCAABCCCBBACBCBCAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:8384
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAABCCABCABCAAABBCAAABAABCCAACCCACBAAAABBCCACCCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCBBCCACBCABBBBABABAACBCCACCCCCCCAABCCCBBACBCBCAACB.exe" start= auto displayName= "UserDataSvc_BCAABCCABCABCAAABBCAAABAABCCAACCCACBAAAABBCCACCCBBB"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:8556
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                        sc create "UserDataSvc_BCAABCCABCABCAAABBCAAABAABCCAACCCACBAAAABBCCACCCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCBBCCACBCABBBBABABAACBCCACCCCCCCAABCCCBBACBCBCAACB.exe" start= auto displayName= "UserDataSvc_BCAABCCABCABCAAABBCAAABAABCCAACCCACBAAAABBCCACCCBBB"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                        PID:8736
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAABCCABCABCAAABBCAAABAABCCAACCCACBAAAABBCCACCCBBB"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:8860
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                          sc start "UserDataSvc_BCAABCCABCABCAAABBCAAABAABCCAACCCACBAAAABBCCACCCBBB"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:8984
                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAABCBBAABCCCABBBCAACCBABBACAAABACCCBBBCCAAACCCBBBBB.exe
                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAABCBBAABCCCABBBCAACCBABBACAAABACCCBBBCCAAACCCBBBBB.exe
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:6184
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBBAAABBAABBCCACCBCBBBCCCBAAABCAABCCBBCCCCBBBBCAACCAACAAACABCBAAABBBAACAACABBAACBACBABABACBBCBBAACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBAAABBAABBCCACCBCBBBCCCBAAABCAABCCBBCCCCBBBBCAACCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:8720
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBBAAABBAABBCCACCBCBBBCCCBAAABCAABCCBBCCCCBBBBCAACCAACAAACABCBAAABBBAACAACABBAACBACBABABACBBCBBAACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBAAABBAABBCCACCBCBBBCCCBAAABCAABCCBBCCCCBBBBCAACCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:8544
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCAABCCAAAACBBBACCCCACCACCCCBCACCBACACCBCBCCAABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBAAABBAABBCCACCBCBBBCCCBAAABCAABCCBBCCCCBBBBCAACCAA.exe" start= auto displayName= "UserDataSvc_CBCAABCCAAAACBBBACCCCACCACCCCBCACCBACACCBCBCCAABBCC"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:8792
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                  sc create "UserDataSvc_CBCAABCCAAAACBBBACCCCACCACCCCBCACCBACACCBCBCCAABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBAAABBAABBCCACCBCBBBCCCBAAABCAABCCBBCCCCBBBBCAACCAA.exe" start= auto displayName= "UserDataSvc_CBCAABCCAAAACBBBACCCCACCACCCCBCACCBACACCBCBCCAABBCC"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                  PID:8660
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCAABCCAAAACBBBACCCCACCACCCCBCACCBACACCBCBCCAABBCC"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:8612
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                    sc start "UserDataSvc_CBCAABCCAAAACBBBACCCCACCACCCCBCACCBACACCBCBCCAABBCC"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                    PID:8992
                                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCAAAAACACAACCACBABBBABCCBCCABAABAAAACBABAAAACBCBCCB.exe
                                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCAAAAACACAACCACBABBBABCCBCCABAABAAAACBABAAAACBCBCCB.exe
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:6536
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABBBBABCCCAAACCACCAAACBCABCCCAABBBBACBCAAACBCBBBCBBCBCBCBBBCAABBCCACCBBCABBBABBBCCCCBCBBBABAABBCBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBBBABCCCAAACCACCAAACBCABCCCAABBBBACBCAAACBCBBBCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:8416
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABBBBABCCCAAACCACCAAACBCABCCCAABBBBACBCAAACBCBBBCBBCBCBCBBBCAABBCCACCBBCABBBABBBCCCCBCBBBABAABBCBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBBBABCCCAAACCACCAAACBCABCCCAABBBBACBCAAACBCBBBCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                      PID:5932
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAAABBBCBABBBBCBBBBABCACCBCABAACACBCBCAAACCBABABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBBBABCCCAAACCACCAAACBCABCCCAABBBBACBCAAACBCBBBCBBC.exe" start= auto displayName= "UserDataSvc_CBAAABBBCBABBBBCBBBBABCACCBCABAACACBCBCAAACCBABABAC"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:5544
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                        sc create "UserDataSvc_CBAAABBBCBABBBBCBBBBABCACCBCABAACACBCBCAAACCBABABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBBBABCCCAAACCACCAAACBCABCCCAABBBBACBCAAACBCBBBCBBC.exe" start= auto displayName= "UserDataSvc_CBAAABBBCBABBBBCBBBBABCACCBCABAACACBCBCAAACCBABABAC"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                        PID:4000
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAAABBBCBABBBBCBBBBABCACCBCABAACACBCBCAAACCBABABAC"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:8552
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                          sc start "UserDataSvc_CBAAABBBCBABBBBCBBBBABCACCBCABAACACBCBCAAACCBABABAC"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:8424
                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCBCCBBACCCCBCACAAABCBBACBACBBAACAACACBAACCBABCBCC.exe
                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCBCCBBACCCCBCACAAABCBBACBACBBAACAACACBAACCBABCBCC.exe
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:7024
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBBCCCCBBBBBABABBBAAABCCABCABABACBBCBACBAABBABBCAAACBACBCBCBACBCBBBBCBABAABAACCCBACBBBBBCCABACAACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCACCABBBAACCAACCABBBBCACBCCBAACACBACACCCBAAABAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:9864
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBBCCCCBBBBBABABBBAAABCCABCABABACBBCBACBAABBABBCAAACBACBCBCBACBCBBBBCBABAABAACCCBACBBBBBCCABACAACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCACCABBBAACCAACCABBBBCACBCCBAACACBACACCCBAAABAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:10096
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCABCBAABAAACCAACBCACACACCAABBACACBBBBACCBBBBBBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCACCABBBAACCAACCABBBBCACBCCBAACACBACACCCBAAABAABBB.exe" start= auto displayName= "UserDataSvc_CCCABCBAABAAACCAACBCACACACCAABBACACBBBBACCBBBBBBABB"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:10172
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                  sc create "UserDataSvc_CCCABCBAABAAACCAACBCACACACCAABBACACBBBBACCBBBBBBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCACCABBBAACCAACCABBBBCACBCCBAACACBACACCCBAAABAABBB.exe" start= auto displayName= "UserDataSvc_CCCABCBAABAAACCAACBCACACACCAABBACACBBBBACCBBBBBBABB"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:9628
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCABCBAABAAACCAACBCACACACCAABBACACBBBBACCBBBBBBABB"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:9900
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                      sc start "UserDataSvc_CCCABCBAABAAACCAACBCACACACCAABBACACBBBBACCBBBBBBABB"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                      PID:9696
                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBBCBBBBAACBCCBCBACAAACAAACCACAABACBBAAABCACCAAAAAC.exe
                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBBCBBBBAACBCCBCBACAAACAAACCACAABACBBAAABCACCAAAAAC.exe
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:7128
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACABCAABBBBACABBCCBABABBCCBABCABABCAAABCBACBABCACCACBAABBBBACAABACACCACAACCBCACCBAACCBAABAACBACBCABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACCCBAABCBAABCAABBABCCACCBBCCBBCACAACACBCBBBBCAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:9988
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACABCAABBBBACABBCCBABABBCCBABCABABCAAABCBACBABCACCACBAABBBBACAABACACCACAACCBCACCBAACCBAABAACBACBCABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACCCBAABCBAABCAABBABCCACCBBCCBBCACAACACBCBBBBCAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:10144
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBBACCBCBABBABBCBCABBACBBBABACCABCCACACBCBACACCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACCCBAABCBAABCAABBABCCACCBBCCBBCACAACACBCBBBBCAABA.exe" start= auto displayName= "UserDataSvc_AABBBACCBCBABBABBCBCABBACBBBABACCABCCACACBCBACACCCB"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:10228
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                            sc create "UserDataSvc_AABBBACCBCBABBABBCBCABBACBBBABACCABCCACACBCBACACCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACCCBAABCBAABCAABBABCCACCBBCCBBCACAACACBCBBBBCAABA.exe" start= auto displayName= "UserDataSvc_AABBBACCBCBABBABBCBCABBACBBBABACCABCCACACBCBACACCCB"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:9876
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBBACCBCBABBABBCBCABBACBBBABACCABCCACACBCBACACCCB"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:9484
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                sc start "UserDataSvc_AABBBACCBCBABBABBCBCABBACBBBABACCABCCACACBCBACACCCB"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:9776
                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABACCAAAABAACACCCABBCCCAAAABCBBCCAABCACACCAACACCCCA.exe
                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABACCAAAABAACACCCABBCCCAAAABCBBCCAABCACACCAACACCCCA.exe
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:2388
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAABBAACCCCBACCBBBCBBBBACCABCBCBACBBAACABBBCCCBBBAACCAAACCBCABAABABACCCAAAABBACCBBCBABAAAABCCCBACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBCCCCCAACBBCCCABBACABCCABABACBBCBBCAAABBACBCCACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:5164
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAABBAACCCCBACCBBBCBBBBACCABCBCBACBBAACABBBCCCBBBAACCAAACCBCABAABABACCCAAAABBACCBBCBABAAAABCCCBACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBCCCCCAACBBCCCABBACABCCABABACBBCBBCAAABBACBCCACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                    PID:10116
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACABBACCCCBBCABCACAABABCBCBBBBCABBCCBAABCACACBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBCCCCCAACBBCCCABBACABCCABABACBBCBBCAAABBACBCCACABA.exe" start= auto displayName= "UserDataSvc_CBACABBACCCCBBCABCACAABABCBCBBBBCABBCCBAABCACACBCCA"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:9940
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                      sc create "UserDataSvc_CBACABBACCCCBBCABCACAABABCBCBBBBCABBCCBAABCACACBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBCCCCCAACBBCCCABBACABCCABABACBBCBBCAAABBACBCCACABA.exe" start= auto displayName= "UserDataSvc_CBACABBACCCCBBCABCACAABABCBCBBBBCABBCCBAABCACACBCCA"
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                      PID:10248
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACABBACCCCBBCABCACAABABCBCBBBBCABBCCBAABCACACBCCA"
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:10744
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                        sc start "UserDataSvc_CBACABBACCCCBBCABCACAABABCBCBBBBCABBCCBAABCACACBCCA"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:11128
                                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABACCAAAABAACACCCABBCCCAAAABCBBCCAABCACACCAACACCCCA.exe
                                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABACCAAAABAACACCCABBCCCAAAABCBBCCAABCACACCAACACCCCA.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:6504
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAACBBAACABABBABACBBBCBAACCCBBBCACCACACCABACCCBBBCCACBACACABCCCCCABCCBABBCABAAAAAACCCBCABCCBBCCAACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCBBAACBCBCCABCBCCBBCCCAABBBBABCACCCABCAACABBBCCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:9324
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAACBBAACABABBABACBBBCBAACCCBBBCACCACACCABACCCBBBCCACBACACABCCCCCABCCBABBCABAAAAAACCCBCABCCBBCCAACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCBBAACBCBCCABCBCCBBCCCAABBBBABCACCCABCAACABBBCCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:9788
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBCCCBBBCABACACAACABCAACBABCACBBCAABCACACACCBBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCBBAACBCBCCABCBCCBBCCCAABBBBABCACCCABCAACABBBCCABC.exe" start= auto displayName= "UserDataSvc_CCBBCCCBBBCABACACAACABCAACBABCACBBCAABCACACACCBBBBC"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:10496
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                sc create "UserDataSvc_CCBBCCCBBBCABACACAACABCAACBABCACBBCAABCACACACCBBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCBBAACBCBCCABCBCCBBCCCAABBBBABCACCCABCAACABBBCCABC.exe" start= auto displayName= "UserDataSvc_CCBBCCCBBBCABACACAACABCAACBABCACBBCAABCACACACCBBBBC"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:11036
                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBBCBBBBAACBCCBCBACAAACAAACCACAABACBBAAABCACCAAAAAC.exe
                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBBCBBBBAACBCCBCBACAAACAAACCACAABACBBAAABCACCAAAAAC.exe
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:6740
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACABBCCCACAAABCACAABCBBAACBBACBBABBCACACCCCCAAABBBACCCABABAABCABABABABCCAABCBACAAABCBBCACBCABCCCCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABBCCCACAAABCACAABCBBAACBBACBBABBCACACCCCCAAABBBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:1704
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACABBCCCACAAABCACAABCBBAACBBACBBABBCACACCCCCAAABBBACCCABABAABCABABABABCCAABCBACAAABCBBCACBCABCCCCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABBCCCACAAABCACAABCBBAACBBACBBABBCACACCCCCAAABBBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                    PID:10444
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABACBCAAABCCBCBBCCAABBABBCBBCCCCBCBCBABCACBCCBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABBCCCACAAABCACAABCBBAACBBACBBABBCACACCCCCAAABBBACC.exe" start= auto displayName= "UserDataSvc_CAABACBCAAABCCBCBBCCAABBABBCBBCCCCBCBCBABCACBCCBBAA"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:10972
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                      sc create "UserDataSvc_CAABACBCAAABCCBCBBCCAABBABBCBBCCCCBCBCBABCACBCCBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABBCCCACAAABCACAABCBBAACBBACBBABBCACACCCCCAAABBBACC.exe" start= auto displayName= "UserDataSvc_CAABACBCAAABCCBCBBCCAABBABBCBBCCCCBCBCBABCACBCCBBAA"
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:3212
                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCAAAAACACAACCACBABBBABCCBCCABAABAAAACBABAAAACBCBCCB.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCAAAAACACAACCACBABBBABCCBCCABAABAAAACBABAAAACBCBCCB.exe
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    PID:6700
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBAAACCBABCAACBCCBCAACBACAACAACCCBCCCAAACBCBCAABABCCACBBAACABCBCBAACABCCCAABBBACABACCAAAABCBBCBCCCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCBBAABACCCAABACAABBBAAABABBCACABACABACBBBBABCAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:2872
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBAAACCBABCAACBCCBCAACBACAACAACCCBCCCAAACBCBCAABABCCACBBAACABCBCBAACABCCCAABBBACABACCAAAABCBBCBCCCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCBBAABACCCAABACAABBBAAABABBCACABACABACBBBBABCAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                          PID:10620
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBACCAACABBBBBCCACBCCACAABBBACABBCBCBACCAAABCBAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCBBAABACCCAABACAABBBAAABABBCACABACABACBBBBABCAABCA.exe" start= auto displayName= "UserDataSvc_CCBACCAACABBBBBCCACBCCACAABBBACABBCBCBACCAAABCBAACB"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:11096
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                            sc create "UserDataSvc_CCBACCAACABBBBBCCACBCCACAABBBACABBCBCBACCAAABCBAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCBBAABACCCAABACAABBBAAABABBCACABACABACBBBBABCAABCA.exe" start= auto displayName= "UserDataSvc_CCBACCAACABBBBBCCACBCCACAABBBACABBCBCBACCAAABCBAACB"
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                                                                            PID:556
                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABABCCCACBAAAAABCABCACCACABAAABBABCBACCAABACBBAAACCC.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABABCCCACBAAAAABCABCACCACABAAABBABCBACCAABACBBAAACCC.exe
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        PID:6328
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCBCABBBBACCCBACBCBACCCBBBAABBBAACAAACCCBCCBABCCBABCACBABCCBABACAACBABCAABACBAACCACAAABABCCBCCABACCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACABCCCBACBABABBCCCBBACAACBBCBBCBBACABCCAAAACBABACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:9844
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCBCABBBBACCCBACBCBACCCBBBAABBBAACAAACCCBCCBABCCBABCACBABCCBABACAACBABCAABACBAACCACAAABABCCBCCABACCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACABCCCBACBABABBCCCBBACAACBBCBBCBBACABCCAAAACBABACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                              PID:10636
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCAACCBACCAAABBBCABABAAABACBBBACCAABAAAABBACCBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACABCCCBACBABABBCCCBBACAACBBCBBCBBACABCCAAAACBABACCBA.exe" start= auto displayName= "UserDataSvc_ACBCAACCBACCAAABBBCABABAAABACBBBACCAABAAAABBACCBABB"
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:10932
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                sc create "UserDataSvc_ACBCAACCBACCAAABBBCABABAAABACBBBACCAABAAAABBACCBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACABCCCBACBABABBCCCBBACAACBBCBBCBBACABCCAAAACBABACCBA.exe" start= auto displayName= "UserDataSvc_ACBCAACCBACCAAABBBCABABAAABACBBBACCAABAAAABBACCBABB"
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:3304
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCAACCBACCAAABBBCABABAAABACBBBACCAABAAAABBACCBABB"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:4920
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                    sc start "UserDataSvc_ACBCAACCBACCAAABBBCABABAAABACBBBACCAABAAAABBACCBABB"
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:6412
                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCBCCBBACCCCBCACAAABCBBACBACBBAACAACACBAACCBABCBCC.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCBCCBBACCCCBCACAAABCBBACBACBBAACAACACBAACCBABCBCC.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  PID:3808
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABACCCBBABBBBBCBACCCBCAAABCCACCABACAACABCABBCBACBCABCBCBACCAACCBBCAACCCBABCBCABACBCABBAACBCBBBBBCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBBCCACCBACCCBCBCCBABABBAACCCACACCABAAACCACBCBCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:2176
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABACCCBBABBBBBCBACCCBCAAABCCACCABACAACABCABBCBACBCABCBCBACCAACCBBCAACCCBABCBCABACBCABBAACBCBBBBBCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBBCCACCBACCCBCBCCBABABBAACCCACACCABAAACCACBCBCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                        PID:10968
                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACCABBBCBABBACAAABCAABAAACBCACCBBABACABCBCBAACBCCB.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACCABBBCBABBACAAABCAABAAACBCACCBBABACABCBCBAACBCCB.exe
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                    PID:6808
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACCBAACACCBAAAACACCBABCACBAAAAABAACABBABAAAACACBACBBABAABABBABBABBBCBCCBBBCACCBBACACCBCACBCCACBCABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBACCCAACBAACCACBABABBBBCACCCCCCABABACBBBAABBCABBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:7664
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACCBAACACCBAAAACACCBABCACBAAAAABAACABBABAAAACACBACBBABAABABBABBABBBCBCCBBBCACCBBACACCBCACBCCACBCABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBACCCAACBAACCACBABABBBBCACCCCCCABABACBBBAABBCABBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                          PID:7728
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCCBCABACBCBBABCCBCCBBCABBBACABCBACAACBBCBBABBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBACCCAACBAACCACBABABBBBCACCCCCCABABACBBBAABBCABBCCC.exe" start= auto displayName= "UserDataSvc_BACCCBCABACBCBBABCCBCCBBCABBBACABCBACAACBBCBBABBBBC"
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:7752
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                            sc create "UserDataSvc_BACCCBCABACBCBBABCCBCCBBCABBBACABCBACAACBBCBBABBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBACCCAACBAACCACBABABBBBCACCCCCCABABACBBBAABBCABBCCC.exe" start= auto displayName= "UserDataSvc_BACCCBCABACBCBBABCCBCCBBCABBBACABCBACAACBBCBBABBBBC"
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:7864
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCCBCABACBCBBABCCBCCBBCABBBACABCBACAACBBCBBABBBBC"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:7896
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                sc start "UserDataSvc_BACCCBCABACBCBBABCCBCCBBCABBBACABCBACAACBBCBBABBBBC"
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:8056
                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABBABACACBBCCBCBAAACCBBCBBABBBBABBBBBBBBBBBAAACCBAA.exe
                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABBABACACBBCCBCBAAACCBBCBBABBBBABBBBBBBBBBBAAACCBAA.exe
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                              PID:7080
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCACCABBBBBACCCABAAAACABCCBCAAACCAAAABCCCABCACCACBACAACCAABCCBCCACABBABACBCBBCCCBACBACCBBACBCCCABACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBBBBBBCBCBCABBBBBBCBBACBBBCCCCAAABBBBBCAACACABACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:7976
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCACCABBBBBACCCABAAAACABCCBCAAACCAAAABCCCABCACCACBACAACCAABCCBCCACABBABACBCBBCCCBACBACCBBACBCCCABACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBBBBBBCBCBCABBBBBBCBBACBBBCCCCAAABBBBBCAACACABACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                    PID:7192
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBABABCBACABBAAABCBBCAABACAABCBAAABCABBACACBCACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBBBBBBCBCBCABBBBBBCBBACBBBCCCCAAABBBBBCAACACABACAB.exe" start= auto displayName= "UserDataSvc_BCCBABABCBACABBAAABCBBCAABACAABCBAAABCABBACACBCACBA"
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:7336
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                    sc create "UserDataSvc_BCCBABABCBACABBAAABCBBCAABACAABCBAAABCABBACACBCACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBBBBBBCBCBCABBBBBBCBBACBBBCCCCAAABBBBBCAACACABACAB.exe" start= auto displayName= "UserDataSvc_BCCBABABCBACABBAAABCBBCAABACAABCBAAABCABBACACBCACBA"
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                    PID:7644
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBABABCBACABBAAABCBBCAABACAABCBAAABCABBACACBCACBA"
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:7712
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                      sc start "UserDataSvc_BCCBABABCBACABBAAABCBBCAABACAABCBAAABCABBACACBCACBA"
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                      PID:8044
                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABABCCCACBAAAAABCABCACCACABAAABBABCBACCAABACBBAAACCC.exe
                                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABABCCCACBAAAAABCABCACCACABAAABBABCBACCAABACBBAAACCC.exe
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                  PID:2564
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABACBCACBBACBCABCCBAABABBCBCAAAACACACBACBBBBCCCBBCBCCAACBCBCBBBCCAAAACCACABCABBABABCBCBBAABCACBCBBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACACACABACBACCBCBABBCCABCCBCAACCBACABCBBCCBCCBBBABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:8048
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABACBCACBBACBCABCCBAABABBCBCAAAACACACBACBBBBCCCBBCBCCAACBCBCBBBCCAAAACCACABCABBABABCBCBBAABCACBCBBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACACACABACBACCBCBABBCCABCCBCAACCBACABCBBCCBCCBBBABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                        PID:8172
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBCABABBCBCAAAAAACCABBAAACBACCACABBBCBBCAAACCAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACACACABACBACCBCBABBCCABCCBCAACCBACABCBBCCBCCBBBABBC.exe" start= auto displayName= "UserDataSvc_CCBBCABABBCBCAAAAAACCABBAAACBACCACABBBCBBCAAACCAABA"
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:7284
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                          sc create "UserDataSvc_CCBBCABABBCBCAAAAAACCABBAAACBACCACABBBCBBCAAACCAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACACACABACBACCBCBABBCCABCCBCAACCBACABCBBCCBCCBBBABBC.exe" start= auto displayName= "UserDataSvc_CCBBCABABBCBCAAAAAACCABBAAACBACCACABBBCBBCAAACCAABA"
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:7420
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBCABABBCBCAAAAAACCABBAAACBACCACABBBCBBCAAACCAABA"
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:7616
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                            sc start "UserDataSvc_CCBBCABABBCBCAAAAAACCABBAAACBACCACABBBCBBCAAACCAABA"
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:7756
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACCABBBCBABBACAAABCAABAAACBCACCBBABACABCBCBAACBCCB.exe
                                                                                                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACCABBBCBABBACAAABCAABAAACBCACCBBABACABCBCBAACBCCB.exe
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                          PID:7004
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABCCCABABABCBBBCAABABCCCBACABBCBACBAACBACBBCBAABCCACABACACCBCBABACCBAACAABBCAACCAABCAABBCCBCBABCCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAAAACCBACACAABABBCCACCBBCBCCCACAAAAABCCBABBACBBACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:7200
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABCCCABABABCBBBCAABABCCCBACABBCBACBAACBACBBCBAABCCACABACACCBCBABACCBAACAABBCAACCAABCAABBCCBCBABCCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAAAACCBACACAABABBCCACCBBCBCCCACAAAAABCCBABBACBBACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:7224
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBBABCAACABCBBAAABBBABBCCCBACCAAABACCACACCBAACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAAAACCBACACAABABBCCACCBBCBCCCACAAAAABCCBABBACBBACAB.exe" start= auto displayName= "UserDataSvc_ABBBBABCAACABCBBAAABBBABBCCCBACCAAABACCACACCBAACBCB"
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:7676
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                  sc create "UserDataSvc_ABBBBABCAACABCBBAAABBBABBCCCBACCAAABACCACACCBAACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAAAACCBACACAABABBCCACCBBCBCCCACAAAAABCCBABBACBBACAB.exe" start= auto displayName= "UserDataSvc_ABBBBABCAACABCBBAAABBBABBCCCBACCAAABACCACACCBAACBCB"
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:7996
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBBABCAACABCBBAAABBBABBCCCBACCAAABACCACACCBAACBCB"
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:8128
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:7224
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                      sc start "UserDataSvc_ABBBBABCAACABCBBAAABBBABBCCCBACCAAABACCACACCBAACBCB"
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                      PID:2108
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABBABACACBBCCBCBAAACCBBCBBABBBBABBBBBBBBBBBAAACCBAA.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABBABACACBBCCBCBAAACCBBCBBABBBBABBBBBBBBBBBAAACCBAA.exe
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                  PID:7160
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCACCBABAABACAACABBAACACCCCBACBACCCCBCBBABCBACBACBAACACCAAAAABBBBCCBABCBABAAAACBCCAACACCACACACBCCBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCAACCAAAACCBCCBACBACCBCAABBBAABABBCBCACABBAABCAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1936
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCACCBABAABACAACABBAACACCCCBACBACCCCBCBBABCBACBACBAACACCAAAAABBBBCCBABCBABAAAACBCCAACACCACACACBCCBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCAACCAAAACCBCCBACBACCBCAABBBAABABBCBCACABBAABCAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4996
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACBABBBCCAAABCCBBBABAAABCCCAACCABCBABACBACBCBBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCAACCAAAACCBCCBACBACCBCAABBBAABABBCBCACABBAABCAAAC.exe" start= auto displayName= "UserDataSvc_CBACBABBBCCAAABCCBBBABAAABCCCAACCABCBABACBACBCBBABA"
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4140
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                            sc create "UserDataSvc_CBACBABBBCCAAABCCBBBABAAABCCCAACCABCBABACBACBCBBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCAACCAAAACCBCCBACBACCBCAABBBAABABBCBCACABBAABCAAAC.exe" start= auto displayName= "UserDataSvc_CBACBABBBCCAAABCCBBBABAAABCCCAACCABCBABACBACBCBBABA"
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:8004
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACBABBBCCAAABCCBBBABAAABCCCAACCABCBABACBACBCBBABA"
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:7416
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                              sc start "UserDataSvc_CBACBABBBCCAAABCCBBBABAAABCCCAACCABCBABACBACBCBBABA"
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:7644
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBABCCAACCCCCACABBBCCBCAAAABABBAAABAABBBABBBABCACB.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBABCCAACCCCCACABBBCCBCAAAABABBAAABAABBBABBBABCACB.exe
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                          PID:896
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCBACBACCBBBBACCACBACCABCBBACBAAAABBBCCCCCCAAAAACACBCABBAAAAACCBBCCAABCCABBACAABCCBBCABAAABBBAACAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBABCACBCBBCCCACBABCCCCCCACBCABBBABCCABAABCACAAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4176
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCBACBACCBBBBACCACBACCABCBBACBAAAABBBCCCCCCAAAAACACBCABBAAAAACCBBCCAABCCABBACAABCCBBCABAAABBBAACAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBABCACBCBBCCCACBABCCCCCCACBCABBBABCCABAABCACAAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                PID:6152
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBCAAACCBBCABACBCABBACCBABACAACAAABCAAAACCBAACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBABCACBCBBCCCACBABCCCCCCACBCABBBABCCABAABCACAAABCB.exe" start= auto displayName= "UserDataSvc_AABBCAAACCBBCABACBCABBACCBABACAACAAABCAAAACCBAACBCA"
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:8036
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                  sc create "UserDataSvc_AABBCAAACCBBCABACBCABBACCBABACAACAAABCAAAACCBAACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBABCACBCBBCCCACBABCCCCCCACBCABBBABCCABAABCACAAABCB.exe" start= auto displayName= "UserDataSvc_AABBCAAACCBBCABACBCABBACCBABACAACAAABCAAAACCBAACBCA"
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:7700
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBCAAACCBBCABACBCABBACCBABACAACAAABCAAAACCBAACBCA"
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4856
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                      sc start "UserDataSvc_AABBCAAACCBBCABACBCABBACCBABACAACAAABCAAAACCBAACBCA"
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                      PID:700
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBBABBCCAAAABCBCBBBBCCCCCBCBCCAAAAABCABBCCBBBABBCBB.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBBABBCCAAAABCBCBBBBCCCCCBCBCCAAAAABCABBCCBBBABBCBB.exe
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:6876
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBABCACCABACCCABBBBBCCCBAAABABACACCCABCABCCBBBCCAACABAAAABBCAAABAABBCCABCAABAABACACCBABBACAABBBCACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABAAAABBCBBACABCAACCACCCABCBACAAABBACCBABAAABABABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:7204
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBABCACCABACCCABBBBBCCCBAAABABACACCCABCABCCBBBCCAACABAAAABBCAAABAABBCCABCAABAABACACCBABBACAABBBCACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABAAAABBCBBACABCAACCACCCABCBACAAABBACCBABAAABABABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                        PID:3612
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABAAABCBBCBCCBCCCCACCABCABACCCCACABBAACABBCABBBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABAAAABBCBBACABCAACCACCCABCBACAAABBACCBABAAABABABAC.exe" start= auto displayName= "UserDataSvc_AABAAABCBBCBCCBCCCCACCABCABACCCCACABBAACABBCABBBBCC"
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:7744
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                          sc create "UserDataSvc_AABAAABCBBCBCCBCCCCACCABCABACCCCACABBAACABBCABBBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABAAAABBCBBACABCAACCACCCABCBACAAABBACCBABAAABABABAC.exe" start= auto displayName= "UserDataSvc_AABAAABCBBCBCCBCCCCACCABCABACCCCACABBAACABBCABBBBCC"
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:7620
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABAAABCBBCBCCBCCCCACCABCABACCCCACABBAACABBCABBBBCC"
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:6432
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                              sc start "UserDataSvc_AABAAABCBBCBCCBCCCCACCABCABACCCCACABBAACABBCABBBBCC"
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:7620
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCBCAABCACABAAAAACBBBBABBBCBBABCAAAABBBBBABCABBBCCA.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCBCAABCACABAAAAACBBBBABBBCBBABCAAAABBBBBABCABBBCCA.exe
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                            PID:7244
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAACCABABCCCCABAABCACBAABCCBCCACBAABCACABBBABCBCABCACCCCCCCABCBACBCCABBCACABCAABCBCAACCCBCCACBAAAABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCABBCACBBCACABBBACBAACCCBBCCACBCCBCBCACBCCAABBABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:7688
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAACCABABCCCCABAABCACBAABCCBCCACBAABCACABBBABCBCABCACCCCCCCABCBACBCCABBCACABCAABCBCAACCCBCCACBAAAABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCABBCACBBCACABBBACBAACCCBBCCACBCCBCBCACBCCAABBABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                  PID:7276
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCBAABABACCCACCCABBAACBAABABCAABACBBBBACBCBACAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCABBCACBBCACABBBACBAACCCBBCCACBCCBCBCACBCCAABBABCC.exe" start= auto displayName= "UserDataSvc_AACCBAABABACCCACCCABBAACBAABABCAABACBBBBACBCBACAACC"
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:7732
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                  sc create "UserDataSvc_AACCBAABABACCCACCCABBAACBAABABCAABACBBBBACBCBACAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCABBCACBBCACABBBACBAACCCBBCCACBCCBCBCACBCCAABBABCC.exe" start= auto displayName= "UserDataSvc_AACCBAABABACCCACCCABBAACBAABABCAABACBBBBACBCBACAACC"
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:7212
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCBAABABACCCACCCABBAACBAABABCAABACBBBBACBCBACAACC"
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3380
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                      sc start "UserDataSvc_AACCBAABABACCCACCCABBAACBAABABCAABACBBBBACBCBACAACC"
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                      PID:7564
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBAAACACACAACAABABCCABCCBCBCCBCBACBCACCBABCACAACAB.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBAAACACACAACAABABCCABCCBCBCCBCBACBCACCBABCACAACAB.exe
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                  PID:7484
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCABBCAABAAACABBCBAACAAACACCBABCCCAABBCAABBCCBBBAAABACACAAABABACAACAACCCBBCBBCACCACABABACCBCAAAACCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCABBCAABAAACABBCBAACAAACACCBABCCCAABBCAABBCCBBBAAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:8472
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCABBCAABAAACABBCBAACAAACACCBABCCCAABBCAABBCCBBBAAABACACAAABABACAACAACCCBBCBBCACCACABABACCBCAAAACCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCABBCAABAAACABBCBAACAAACACCBABCCCAABBCAABBCCBBBAAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                        PID:8688
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCAACABBABAAABBCACCCABBCAACBCCACBCCAABBCBBBBCBBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCABBCAABAAACABBCBAACAAACACCBABCCCAABBCAABBCCBBBAAABA.exe" start= auto displayName= "UserDataSvc_CBCAACABBABAAABBCACCCABBCAACBCCACBCCAABBCBBBBCBBABC"
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:8772
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                          sc create "UserDataSvc_CBCAACABBABAAABBCACCCABBCAACBCCACBCCAABBCBBBBCBBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCABBCAABAAACABBCBAACAAACACCBABCCCAABBCAABBCCBBBAAABA.exe" start= auto displayName= "UserDataSvc_CBCAACABBABAAABBCACCCABBCAACBCCACBCCAABBCBBBBCBBABC"
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                          PID:8952
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCAACABBABAAABBCACCCABBCAACBCCACBCCAABBCBBBBCBBABC"
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:9148
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                            sc start "UserDataSvc_CBCAACABBABAAABBCACCCABBCAACBCCACBCCAABBCBBBBCBBABC"
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:8292
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBAAACACACAACAABABCCABCCBCBCCBCBACBCACCBABCACAACAB.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBAAACACACAACAABABCCABCCBCBCCBCBACBCACCBABCACAACAB.exe
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                          PID:7492
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCAAAABBACBCBBACCABBACCABBBCCCBABCBBCCCACABAACABCCACCBACAABCBCCAABCBBCBCCAABCCCBCCCBACBBACABCCCBCBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCAABACBCCBBABACAACBACACBCABCBAABABBCCABBCAAABABAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:8436
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCAAAABBACBCBBACCABBACCABBBCCCBABCBBCCCACABAACABCCACCBACAABCBCCAABCBBCBCCAABCCCBCCCBACBBACABCCCBCBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCAABACBCCBBABACAACBACACBCABCBAABABBCCABBCAAABABAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                PID:8704
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACACAABBABCCAABACACABAABCBABAACBCABCBACCCBBABCAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCAABACBCCBBABACAACBACACBCABCBAABABBCCABBCAAABABAACC.exe" start= auto displayName= "UserDataSvc_ACACAABBABCCAABACACABAABCBABAACBCABCBACCCBBABCAABCB"
                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:8820
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                  sc create "UserDataSvc_ACACAABBABCCAABACACABAABCBABAACBCABCBACCCBBABCAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCAABACBCCBBABACAACBACACBCABCBAABABBCCABBCAAABABAACC.exe" start= auto displayName= "UserDataSvc_ACACAABBABCCAABACACABAABCBABAACBCABCBACCCBBABCAABCB"
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                  PID:8964
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACACAABBABCCAABACACABAABCBABAACBCABCBACCCBBABCAABCB"
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:9032
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                    sc start "UserDataSvc_ACACAABBABCCAABACACABAABCBABAACBCABCBACCCBBABCAABCB"
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5488
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBACCCAACBAACCACBABABBBBCACCCCCCABABACBBBAABBCABBCCC.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBACCCAACBAACCACBABABBBBCACCCCCCABABACBBBAABBCABBCCC.exe
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                PID:8108
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBACABBCCCBABACCBCCBBBCAACCBBCACABBBBACBABCCCBBACCCCCCBBCCBCAABACACBABBAAAABBBACCAACCAACABCABBCAAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAAABAACAABCACCCAACBABBACCCCCACCCBABBCBAAAABBCACCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3892
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBACABBCCCBABACCBCCBBBCAACCBBCACABBBBACBABCCCBBACCCCCCBBCCBCAABACACBABBAAAABBBACCAACCAACABCABBCAAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAAABAACAABCACCCAACBABBACCCCCACCCBABBCBAAAABBCACCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                      PID:10612
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBACBAABBCCBABCCAAACABCCCBAACABCACBCABBCCBCCCACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAAABAACAABCACCCAACBABBACCCCCACCCBABBCBAAAABBCACCCCC.exe" start= auto displayName= "UserDataSvc_CACBACBAABBCCBABCCAAACABCCCBAACABCACBCABBCCBCCCACBA"
                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:11060
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                        sc create "UserDataSvc_CACBACBAABBCCBABCCAAACABCCCBAACABCACBCABBCCBCCCACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAAABAACAABCACCCAACBABBACCCCCACCCBABBCBAAAABBCACCCCC.exe" start= auto displayName= "UserDataSvc_CACBACBAABBCCBABCCAAACABCCCBAACABCACBCABBCCBCCCACBA"
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                        PID:10756
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBACBAABBCCBABCCAAACABCCCBAACABCACBCABBCCBCCCACBA"
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:11000
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                          sc start "UserDataSvc_CACBACBAABBCCBABCCAAACABCCCBAACABCACBCABBCCBCCCACBA"
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6392
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBACCCAACBAACCACBABABBBBCACCCCCCABABACBBBAABBCABBCCC.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBACCCAACBAACCACBABABBBBCACCCCCCABABACBBBAABBCABBCCC.exe
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                        PID:8136
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBBBABCCAACAACABBCAABCCBACACCAACAACBABCACBAACCCBABABCBCBBAAACCBCBAACAABABAABCABBBCBCACABBBBCCCCCACCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBBCBCBCCCBCBAABABCAACBCCBCACAABBABBCACBCBCCBCCCBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:9380
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBBBABCCAACAACABBCAABCCBACACCAACAACBABCACBAACCCBABABCBCBBAAACCBCBAACAABABAABCABBBCBCACABBBBCCCCCACCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBBCBCBCCCBCBAABABCAACBCCBCACAABBABBCACBCBCCBCCCBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                              PID:10708
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCBBABBCBBCBBCBBBABCAAABCCCCACABABCACACCBAABBCABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBBCBCBCCCBCBAABABCAACBCCBCACAABBABBCACBCBCCBCCCBBBA.exe" start= auto displayName= "UserDataSvc_BBCBBABBCBBCBBCBBBABCAAABCCCCACABABCACACCBAABBCABCB"
                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:11244
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                sc create "UserDataSvc_BBCBBABBCBBCBBCBBBABCAAABCCCCACABABCACACCBAABBCABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBBCBCBCCCBCBAABABCAACBCCBCACAABBABBCACBCBCCBCCCBBBA.exe" start= auto displayName= "UserDataSvc_BBCBBABBCBBCBBCBBBABCAAABCCCCACABABCACACCBAABBCABCB"
                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10712
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCBBABBCBBCBBCBBBABCAAABCCCCACABABCACACCBAABBCABCB"
                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6496
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    sc start "UserDataSvc_BBCBBABBCBBCBBCBBBABCAAABCCCCACABABCACACCBAABBCABCB"
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11044
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBBBBBBCBCBCABBBBBBCBBACBBBCCCCAAABBBBBCAACACABACAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBBBBBBCBCBCABBBBBBCBBACBBBCCCCAAABBBBBCAACACABACAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                PID:7692
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCBBBABCAAABABBCBBCBBABCAAABCBAAACACCCCACBAAABAACBBBACCBCCBABCBABBCABBCBAABACBBAAAACCBBBBBBCBAABABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCBBACCBBBAAABCABABCBBAACBBABAACBBCAACACCAABCCCABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10180
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCBBBABCAAABABBCBBCBBABCAAABCBAAACACCCCACBAAABAACBBBACCBCCBABCBABBCABBCBAABACBBAAAACCBBBBBBCBAABABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCBBACCBBBAAABCABABCBBAACBBABAACBBCAACACCAABCCCABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:556
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACBABCACABCBBCCBABACBCABBCCBBCCCAACBCCBBCAAACBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCBBACCBBBAAABCABABCBBAACBBABAACBBCAACACCAABCCCABBC.exe" start= auto displayName= "UserDataSvc_ABACBABCACABCBBCCBABACBCABBCCBBCCCAACBCCBBCAAACBABB"
                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3796
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        sc create "UserDataSvc_ABACBABCACABCBBCCBABACBCABBCCBBCCCAACBCCBBCAAACBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCBBACCBBBAAABCABABCBBAACBBABAACBBCAACACCAABCCCABBC.exe" start= auto displayName= "UserDataSvc_ABACBABCACABCBBCCBABACBCABBCCBBCCCAACBCCBBCAAACBABB"
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6944
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACBABCACABCBBCCBABACBCABBCCBBCCCAACBCCBBCAAACBABB"
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7388
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            sc start "UserDataSvc_ABACBABCACABCBBCCBABACBCABBCCBBCCCAACBCCBBCAAACBABB"
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12576
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACACACABACBACCBCBABBCCABCCBCAACCBACABCBBCCBCCBBBABBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACACACABACBACCBCBABBCCABCCBCAACCBACABCBBCCBCCBBBABBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7748
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBACACCAAAACAACBCACCABCABBBAAACCBCBACAABABCAABABAABABCBBBBCAABBBCACAACAACCAACAAACCBCCABCBBCACAACBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCCBCABBBCACCBBCCACCCCBACAAAACCACABAAABBACAAAAACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBACACCAAAACAACBCACCABCABBBAAACCBCBACAABABCAABABAABABCBBBBCAABBBCACAACAACCAACAAACCBCCABCBBCACAACBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCCBCABBBCACCBBCCACCCCBACAAAACCACABAAABBACAAAAACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6716
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCABBCCBCBBAABBAACCBABBCCCCACACCAAACCBCAABBCAAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCCBCABBBCACCBBCCACCCCBACAAAACCACABAAABBACAAAAACBCA.exe" start= auto displayName= "UserDataSvc_ABCCABBCCBCBBAABBAACCBABBCCCCACACCAAACCBCAABBCAAACB"
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7488
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                sc create "UserDataSvc_ABCCABBCCBCBBAABBAACCBABBCCCCACACCAAACCBCAABBCAAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCCBCABBBCACCBBCCACCCCBACAAAACCACABAAABBACAAAAACBCA.exe" start= auto displayName= "UserDataSvc_ABCCABBCCBCBBAABBAACCBABBCCCCACACCAAACCBCAABBCAAACB"
                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11804
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCCABBCCBCBBAABBAACCBABBCCCCACACCAAACCBCAABBCAAACB"
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6952
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACACACABACBACCBCBABBCCABCCBCAACCBACABCBBCCBCCBBBABBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACACACABACBACCBCBABBCCABCCBCAACCBACABCBBCCBCCBBBABBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7908
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCBCCCAAACCBBABABBCCABABBCAAABACBCBABABABBCABABBCABBCABAACCCBCABBBAAACBABBABAAACACBBACCCCCBCBCBBCCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCAACCCCABAAAACBCCCCCBCAACABBBBAACACBABACAACCBBCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10612
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCBCCCAAACCBBABABBCCABABBCAAABACBCBABABABBCABABBCABBCABAACCCBCABBBAAACBABBABAAACACBBACCCCCBCBCBBCCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCAACCCCABAAAACBCCCCCBCAACABBBBAACACBABACAACCBBCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11108
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACBACBABACBABBBBAAACCBAABAABBBAABBABCBBAACACBCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCAACCCCABAAAACBCCCCCBCAACABBBBAACACBABACAACCBBCAAB.exe" start= auto displayName= "UserDataSvc_BCACBACBABACBABBBBAAACCBAABAABBBAABBABCBBAACACBCBAA"
                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5172
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      sc create "UserDataSvc_BCACBACBABACBABBBBAAACCBAABAABBBAABBABCBBAACACBCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCAACCCCABAAAACBCCCCCBCAACABBBBAACACBABACAACCBBCAAB.exe" start= auto displayName= "UserDataSvc_BCACBACBABACBABBBBAAACCBAABAABBBAABBABCBBAACACBCBAA"
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12016
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBBBBBBCBCBCABBBBBBCBBACBBBCCCCAAABBBBBCAACACABACAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBBBBBBCBCBCABBBBBBCBBACBBBCCCCAAABBBBBCAACACABACAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1764
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBABBAAABCCCCBCBACCBCAABACACAACBCBBBCBBCBABBBBBABAACABAAACACBCCBBCAAAACBACACCCBCBBABBABBCAABCBCBCCCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACABABCBCCACBACCCAACBACACCCACCABAAACCCAACCBABCCCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6252
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBABBAAABCCCCBCBACCBCAABACACAACBCBBBCBBCBABBBBBABAACABAAACACBCCBBCAAAACBACACCCBCBBABBABBCAABCBCBCCCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACABABCBCCACBACCCAACBACACCCACCABAAACCCAACCBABCCCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6868
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABAAAAACCABCAACBCCABCBABBACACCACCCBAABCACBAAACBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACABABCBCCACBACCCAACBACACCCACCABAAACCCAACCBABCCCABB.exe" start= auto displayName= "UserDataSvc_AABAAAAACCABCAACBCCABCBABBACACCACCCBAABCACBAAACBBBC"
                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4828
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            sc create "UserDataSvc_AABAAAAACCABCAACBCCABCBABBACACCACCCBAABCACBAAACBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACABABCBCCACBACCCAACBACACCCACCABAAACCCAACCBABCCCABB.exe" start= auto displayName= "UserDataSvc_AABAAAAACCABCAACBCCABCBABBACACCACCCBAABCACBAAACBBBC"
                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12000
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAAAACCBACACAABABBCCACCBBCBCCCACAAAAABCCBABBACBBACAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAAAACCBACACAABABBCCACCBBCBCCCACAAAAABCCBABBACBBACAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7576
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBBBCABCAAACABAACCCACCCCCAABBAAABAABCABBBCCBBACCAACACBBCABABBACBAABABAACBABBAABABCCBCCCACCCCCBCBBBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCAABAABBACBAAAAAABCABBBACACABBCAABBBAAABBCACBAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11636
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBBBCABCAAACABAACCCACCCCCAABBAAABAABCABBBCCBBACCAACACBBCABABBACBAABABAACBABBAABABCCBCCCACCCCCBCBBBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCAABAABBACBAAAAAABCABBBACACABBCAABBBAAABBCACBAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6704
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAAAACCBACACAABABBCCACCBBCBCCCACAAAAABCCBABBACBBACAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAAAACCBACACAABABBCCACCBBCBCCCACAAAAABCCBABBACBBACAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBBCCCAABBACBCAACCAACAACACBACCAAAABAAAABBCBCABAAAABCAABBAAACCABBCACACCCCBBBBAACCCABABBCCAAACCCABBAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBCCCAABBACBCAACCAACAACACBACCAAAABAAAABBCBCABAAAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11388
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBBCCCAABBACBCAACCAACAACACBACCAAAABAAAABBCBCABAAAABCAABBAAACCABBCACACCCCBBBBAACCCABABBCCAAACCCABBAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBCCCAABBACBCAACCAACAACACBACCAAAABAAAABBCBCABAAAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11472
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAAAABCCBCBABCAACBCACACABACBBBACCAACCACCABBCBACABAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAAAABCCBCBABCAACBCACACABACBBBACCAACCACCABBCBACABAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7760
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBAABAACBBBBBCCCAABCACBCBCBAAAACBBBBBACCABBBABACACBBBCCBABBAABCCCBCCABBBCBACABBCCBABCACBCABCCAACCABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCAABACCCCBAACBCAACBAAABABCACBACBBBACAACCCABCCCBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11976
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBAABAACBBBBBCCCAABCACBCBCBAAAACBBBBBACCABBBABACACBBBCCBABBAABCCCBCCABBBCBACABBCCBABCACBCABCCAACCABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCAABACCCCBAACBCAACBAAABABCACBACBBBACAACCCABCCCBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12540
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7996
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCAACCAAAACCBCCBACBACCBCAABBBAABABBCBCACABBAABCAAAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCAACCAAAACCBCCBACBACCBCAABBBAABABBCBCACABBAABCAAAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7528
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBCACCBCBAAACCCBBAABCACACABACABCCCBCCABABACAABBBAACACABBCCABABACABABBBCBCABBBCBCBBABBBCBAAABCBBBCAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCABACCABABBCCCBBACBCAAACCCBBCCBCABCBACCCBAAACBCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:12212
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBCACCBCBAAACCCBBAABCACACABACABCCCBCCABABACAABBBAACACABBCCABABACABABBBCBCABBBCBCBBABBBCBAAABCBBBCAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCABACCABABBCCCBBACBCAAACCCBBCCBCABCBACCCBAAACBCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12564
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCAACCAAAACCBCCBACBACCBCAABBBAABABBCBCACABBAABCAAAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCAACCAAAACCBCCBACBACCBCAABBBAABABBCBCACABBAABCAAAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCACAACABCCCBBCBBCCBBBBAAACABBCABACACBBBCAACAACCBAABBACCCBBCACCCBCAAABABBBCCBCBCAABABAACCABCAAACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCACACAABBCCBABAAAACABCACACCBBBACAACBBCCCAAABCBAAAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCACAACABCCCBBCBBCCBBBBAAACABBCABACACBBBCAACAACCBAABBACCCBBCACCCBCAAABABBBCCBCBCAABABAACCABCAAACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCACACAABBCCBABAAAACABCACACCBBBACAACBBCCCAAABCBAAAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAAAABCCBCBABCAACBCACACABACBBBACCAACCACCABBCBACABAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAAAABCCBCBABCAACBCACACABACBBBACCAACCACCABBCBACABAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABCCABACBCBABACBAABABCCBBCACABBBCBBACBBBACAACCAAAACBBAACCCBBACACBCCBACCAACBCBAAABCBBBBCAACCCBCBACAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAACBBACBBAAABACBBAAACBCCAAABCCBACCAACACCACBABCBCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABAAAABBCBBACABCAACCACCCABCBACAAABBACCBABAAABABABAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABAAAABBCBBACABCAACCACCCABCBACAAABBACCBABAAABABABAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAABAABBCABABBABAABCAACBACABABCAABBBCBBCACCCCBCBACAAABABAABACABCBCBBCBACCBBCBCCCBBBCCCCCCAABCCABCCABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAAAACACBBCCACAABACCCCCBBBAACCABCBACCBCABBAAACBACACB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABAAAABBCBBACABCAACCACCCABCBACAAABBACCBABAAABABABAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABAAAABBCBBACABCAACCACCCABCBACAAABBACCBABAAABABABAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCABBCACBBCACABBBACBAACCCBBCCACBCCBCBCACBCCAABBABCC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCABBCACBBCACABBBACBAACCCBBCCACBCCBCBCACBCCAABBABCC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACAAABBAAACAABBCAABCAACACCCABAABACBCABBABBBAABBACABCBAACACBBBBAACACAABAACBCAACCBCCAABCBCBCCAABCACCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABBBCABCBBBACCCBACCBAABCAACAABCABABCACBACCAACBCCAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACAAABBAAACAABBCAABCAACACCCABAABACBCABBABBBAABBACABCBAACACBBBBAACACAABAACBCAACCBCCAABCBCBCCAABCACCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABBBCABCBBBACCCBACCBAABCAACAABCABABCACBACCAACBCCAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACACBBCBCCBACBBBACCCACCCBBCBBCAACACBABBBBCBBACCCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABBBCABCBBBACCCBACCBAABCAACAABCABABCACBACCAACBCCAABC.exe" start= auto displayName= "UserDataSvc_ACACBBCBCCBACBBBACCCACCCBBCBBCAACACBABBBBCBBACCCBAC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sc create "UserDataSvc_ACACBBCBCCBACBBBACCCACCCBBCBBCAACACBABBBBCBBACCCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABBBCABCBBBACCCBACCBAABCAACAABCABABCACBACCAACBCCAABC.exe" start= auto displayName= "UserDataSvc_ACACBBCBCCBACBBBACCCACCCBBCBBCAACACBABBBBCBBACCCBAC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACACBBCBCCBACBBBACCCACCCBBCBBCAACACBABBBBCBBACCCBAC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sc start "UserDataSvc_ACACBBCBCCBACBBBACCCACCCBBCBBCAACACBABBBBCBBACCCBAC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBABCACBCBBCCCACBABCCCCCCACBCABBBABCCABAABCACAAABCB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBABCACBCBBCCCACBABCCCCCCACBCABBBABCCABAABCACAAABCB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACAAABBAAACAABBCAABCAACACCCABAABACBCABBABBBAABBACABCBAACACBBBBAACACAABAACBCAACCBCCAABCBCBCCAABCACCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABBBCABCBBBACCCBACCBAABCAACAABCABABCACBACCAACBCCAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACAAABBAAACAABBCAABCAACACCCABAABACBCABBABBBAABBACABCBAACACBBBBAACACAABAACBCAACCBCCAABCBCBCCAABCACCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABBBCABCBBBACCCBACCBAABCAACAABCABABCACBACCAACBCCAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCACCCCBBABBCBCBCCCBCACAAAACBCACACBABACBCCCCCACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABBBCABCBBBACCCBACCBAABCAACAABCABABCACBACCAACBCCAABC.exe" start= auto displayName= "UserDataSvc_BBCACCCCBBABBCBCBCCCBCACAAAACBCACACBABACBCCCCCACBCA"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sc create "UserDataSvc_BBCACCCCBBABBCBCBCCCBCACAAAACBCACACBABACBCCCCCACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABBBCABCBBBACCCBACCBAABCAACAABCABABCACBACCAACBCCAABC.exe" start= auto displayName= "UserDataSvc_BBCACCCCBBABBCBCBCCCBCACAAAACBCACACBABACBCCCCCACBCA"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCACCCCBBABBCBCBCCCBCACAAAACBCACACBABACBCCCCCACBCA"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sc start "UserDataSvc_BBCACCCCBBABBCBCBCCCBCACAAAACBCACACBABACBCCCCCACBCA"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCBBCCACBCABBBBABABAACBCCACCCCCCCAABCCCBBACBCBCAACB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCBBCCACBCABBBBABABAACBCCACCCCCCCAABCCCBBACBCBCAACB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCBACAACABBCABCABAACBACBABBABCBCCCCACBCACABBCAAAACBBACCBACCBBCBCBCBACACABACCACACACBBBAAAABACBAACCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACACBCBABCAACABBBBAAACAABAAAABABBBBCCACCCAAAABCBBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCBACAACABBCABCABAACBACBABBABCBCCCCACBCACABBCAAAACBBACCBACCBBCBCBCBACACABACCACACACBBBAAAABACBAACCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACACBCBABCAACABBBBAAACAABAAAABABBBBCCACCCAAAABCBBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCAAABCCCBCCAABABCAACACCCABCBAAABBBBCBAAABAACACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACACBCBABCAACABBBBAAACAABAAAABABBBBCCACCCAAAABCBBACC.exe" start= auto displayName= "UserDataSvc_CCCCAAABCCCBCCAABABCAACACCCABCBAAABBBBCBAAABAACACBA"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sc create "UserDataSvc_CCCCAAABCCCBCCAABABCAACACCCABCBAAABBBBCBAAABAACACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACACBCBABCAACABBBBAAACAABAAAABABBBBCCACCCAAAABCBBACC.exe" start= auto displayName= "UserDataSvc_CCCCAAABCCCBCCAABABCAACACCCABCBAAABBBBCBAAABAACACBA"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCAAABCCCBCCAABABCAACACCCABCBAAABBBBCBAAABAACACBA"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sc start "UserDataSvc_CCCCAAABCCCBCCAABABCAACACCCABCBAAABBBBCBAAABAACACBA"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCBBCCACBCABBBBABABAACBCCACCCCCCCAABCCCBBACBCBCAACB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCBBCCACBCABBBBABABAACBCCACCCCCCCAABCCCBBACBCBCAACB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCCCABCAABACAABAACACBAACBABABBCBACBBACBAAACBACABCCCABACABACAAABABCACAAAAAABACCABBBCACACACCCACAABAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAAACAABCACCAAAAABCBCBAAABAAACBBCCCCAAACBCCCACCCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCCCABCAABACAABAACACBAACBABABBCBACBBACBAAACBACABCCCABACABACAAABABCACAAAAAABACCABBBCACACACCCACAABAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAAACAABCACCAAAAABCBCBAAABAAACBBCCCCAAACBCCCACCCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCBBACBAAACABCACCCABBABAABCACABCCBCCABACCBACACBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAAACAABCACCAAAAABCBCBAAABAAACBBCCCCAAACBCCCACCCCAC.exe" start= auto displayName= "UserDataSvc_BBCBBACBAAACABCACCCABBABAABCACABCCBCCABACCBACACBACB"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sc create "UserDataSvc_BBCBBACBAAACABCACCCABBABAABCACABCCBCCABACCBACACBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAAACAABCACCAAAAABCBCBAAABAAACBBCCCCAAACBCCCACCCCAC.exe" start= auto displayName= "UserDataSvc_BBCBBACBAAACABCACCCABBABAABCACABCCBCCABACCBACACBACB"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCBBACBAAACABCACCCABBABAABCACABCCBCCABACCBACACBACB"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sc start "UserDataSvc_BBCBBACBAAACABCACCCABBABAABCACABCCBCCABACCBACACBACB"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCAABACBCCBBABACAACBACACBCABCBAABABBCCABBCAAABABAACC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCAABACBCCBBABACAACBACACBCABCBAABABBCCABBCAAABABAACC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBABABBCBAAACCBBBCCCBABBCBABAAAACACABACAACBACACBBBACACAACBBCCAACCBACCBCAACCACABCBCAAAABBCABBBAABCCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBACACBBAAACCCBAAAAACCCCBCCCAABABABBBCCAACAABCABAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBABABBCBAAACCBBBCCCBABBCBABAAAACACABACAACBACACBBBACACAACBBCCAACCBACCBCAACCACABCBCAAAABBCABBBAABCCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBACACBBAAACCCBAAAAACCCCBCCCAABABABBBCCAACAABCABAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCAAAABBBCBBBAACCABACBABCBACCACCCBBACBCABAABBAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBACACBBAAACCCBAAAAACCCCBCCCAABABABBBCCAACAABCABAAAA.exe" start= auto displayName= "UserDataSvc_BBCCAAAABBBCBBBAACCABACBABCBACCACCCBBACBCABAABBAAAB"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sc create "UserDataSvc_BBCCAAAABBBCBBBAACCABACBABCBACCACCCBBACBCABAABBAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBACACBBAAACCCBAAAAACCCCBCCCAABABABBBCCAACAABCABAAAA.exe" start= auto displayName= "UserDataSvc_BBCCAAAABBBCBBBAACCABACBABCBACCACCCBBACBCABAABBAAAB"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCAAAABBBCBBBAACCABACBABCBACCACCCBBACBCABAABBAAAB"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sc start "UserDataSvc_BBCCAAAABBBCBBBAACCABACBABCBACCACCCBBACBCABAABBAAAB"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCAABACBCCBBABACAACBACACBCABCBAABABBCCABBCAAABABAACC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCAABACBCCBBABACAACBACACBCABCBAABABBCCABBCAAABABAACC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBCCCBACBBCBBACBCAACAACBBACAAAABBBACBBCCCBABACAABCBBBAABCACABACBBACCAACCACCACBABBABCBAAACCAAACCAABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBACCCCAACAABBAACABABAACCABCCCBAABBCBABBBCACCAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBCCCBACBBCBBACBCAACAACBBACAAAABBBACBBCCCBABACAABCBBBAABCACABACBBACCAACCACCACBABBABCBAAACCAAACCAABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBACCCCAACAABBAACABABAACCABCCCBAABBCBABBBCACCAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCAABBCCBACCCCBCCBCBBAABCBAAACACABCBCACAACCBCBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBACCCCAACAABBAACABABAACCABCCCBAABBCBABBBCACCAAACB.exe" start= auto displayName= "UserDataSvc_BBBCAABBCCBACCCCBCCBCBBAABCBAAACACABCBCACAACCBCBCBA"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sc create "UserDataSvc_BBBCAABBCCBACCCCBCCBCBBAABCBAAACACABCBCACAACCBCBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBACCCCAACAABBAACABABAACCABCCCBAABBCBABBBCACCAAACB.exe" start= auto displayName= "UserDataSvc_BBBCAABBCCBACCCCBCCBCBBAABCBAAACACABCBCACAACCBCBCBA"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCAABBCCBACCCCBCCBCBBAABCBAAACACABCBCACAACCBCBCBA"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sc start "UserDataSvc_BBBCAABBCCBACCCCBCCBCBBAABCBAAACACABCBCACAACCBCBCBA"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCABBCAABAAACABBCBAACAAACACCBABCCCAABBCAABBCCBBBAAABA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCABBCAABAAACABBCBAACAAACACCBABCCCAABBCAABBCCBBBAAABA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBBBBABAABCABACBCCABAABBABBCBAACAACAABACCBCBCBACABABCAABCCCBABACACCAABAABCCAACAAAABACCCACCAAABCBABACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBBCCCABCBACCABCCBCCBCACBABABAAABABCBCCBCCBBACCACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBBBBABAABCABACBCCABAABBABBCBAACAACAABACCBCBCBACABABCAABCCCBABACACCAABAABCCAACAAAABACCCACCAAABCBABACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBBCCCABCBACCABCCBCCBCACBABABAAABABCBCCBCCBBACCACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCBCCCCBACCCBACBBBAACCACBCBCBCABAABACBCABCBAABCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBBCCCABCBACCABCCBCCBCACBABABAAABABCBCCBCCBBACCACAC.exe" start= auto displayName= "UserDataSvc_BBCCBCCCCBACCCBACBBBAACCACBCBCBCABAABACBCABCBAABCAC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sc create "UserDataSvc_BBCCBCCCCBACCCBACBBBAACCACBCBCBCABAABACBCABCBAABCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBBCCCABCBACCABCCBCCBCACBABABAAABABCBCCBCCBBACCACAC.exe" start= auto displayName= "UserDataSvc_BBCCBCCCCBACCCBACBBBAACCACBCBCBCABAABACBCABCBAABCAC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCBCCCCBACCCBACBBBAACCACBCBCBCABAABACBCABCBAABCAC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sc start "UserDataSvc_BBCCBCCCCBACCCBACBBBAACCACBCBCBCABAABACBCABCBAABCAC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCABBCAABAAACABBCBAACAAACACCBABCCCAABBCAABBCCBBBAAABA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCABBCAABAAACABBCBAACAAACACCBABCCCAABBCAABBCCBBBAAABA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBBABABAACAABBBAAACBAABCABAABCCBCBCCAACCBCABABCCCBCBCACABCBAACABBCCBBABACAABBABBACBBCCCAAACCBABBCCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBABABAACAABBBAAACBAABCABAABCCBCBCCAACCBCABABCCCBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBBABABAACAABBBAAACBAABCABAABCCBCBCCAACCBCABABCCCBCBCACABCBAACABBCCBBABACAABBABBACBBCCCAAACCBABBCCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBABABAACAABBBAAACBAABCABAABCCBCBCCAACCBCABABCCCBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCCCACBCBBABCCBBCCBBAACBBACCCBACCBCABAAAACCCBCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBABABAACAABBBAAACBAABCABAABCCBCBCCAACCBCABABCCCBCBC.exe" start= auto displayName= "UserDataSvc_CACCCCACBCBBABCCBBCCBBAACBBACCCBACCBCABAAAACCCBCBCC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sc create "UserDataSvc_CACCCCACBCBBABCCBBCCBBAACBBACCCBACCBCABAAAACCCBCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBABABAACAABBBAAACBAABCABAABCCBCBCCAACCBCABABCCCBCBC.exe" start= auto displayName= "UserDataSvc_CACCCCACBCBBABCCBBCCBBAACBBACCCBACCBCABAAAACCCBCBCC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCCCACBCBBABCCBBCCBBAACBBACCCBACCBCABAAAACCCBCBCC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sc start "UserDataSvc_CACCCCACBCBBABCCBBCCBBAACBBACCCBACCBCABAAAACCCBCBCC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBAAABBAABBCCACCBCBBBCCCBAAABCAABCCBBCCCCBBBBCAACCAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBAAABBAABBCCACCBCBBBCCCBAAABCAABCCBBCCCCBBBBCAACCAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBBCBCCBAAACABCBCABBACCABCBACABBCBBBCCABAABACCBAACABBCCBBCCABCACABCBACBACBCCACACCCCBBABBAABCCBBABACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBAABBBCBCBBBAACBBABAAACACBCBBCCAAAACCBCCCAABBAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBBCBCCBAAACABCBCABBACCABCBACABBCBBBCCABAABACCBAACABBCCBBCCABCACABCBACBACBCCACACCCCBBABBAABCCBBABACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBAABBBCBCBBBAACBBABAAACACBCBBCCAAAACCBCCCAABBAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAACABABBACBBCCCACBAACCBCCCBBACACAAAAAACAACCACAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBAABBBCBCBBBAACBBABAAACACBCBBCCAAAACCBCCCAABBAAAB.exe" start= auto displayName= "UserDataSvc_BAAACABABBACBBCCCACBAACCBCCCBBACACAAAAAACAACCACAABA"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sc create "UserDataSvc_BAAACABABBACBBCCCACBAACCBCCCBBACACAAAAAACAACCACAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBAABBBCBCBBBAACBBABAAACACBCBBCCAAAACCBCCCAABBAAAB.exe" start= auto displayName= "UserDataSvc_BAAACABABBACBBCCCACBAACCBCCCBBACACAAAAAACAACCACAABA"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAACABABBACBBCCCACBAACCBCCCBBACACAAAAAACAACCACAABA"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sc start "UserDataSvc_BAAACABABBACBBCCCACBAACCBCCCBBACACAAAAAACAACCACAABA"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBAAABBAABBCCACCBCBBBCCCBAAABCAABCCBBCCCCBBBBCAACCAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBAAABBAABBCCACCBCBBBCCCBAAABCAABCCBBCCCCBBBBCAACCAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBAACBABBBACBAAACCAACABCBBCCABBACCBABBABBBBCCCBAAAACABCCCCCACCAACBBCCCCABBAAAAAAAACCBBACABCBAABABCACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCACAABBCBBCBABBCBAABBBCBCABCBACAACCABCAAACCACABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBAACBABBBACBAAACCAACABCBBCCABBACCBABBABBBBCCCBAAAACABCCCCCACCAACBBCCCCABBAAAAAAAACCBBACABCBAABABCACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCACAABBCBBCBABBCBAABBBCBCABCBACAACCABCAAACCACABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCABBAAACBACAABAACCAABAABACACCACAABBABACCCABAABCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCACAABBCBBCBABBCBAABBBCBCABCBACAACCABCAAACCACABAAA.exe" start= auto displayName= "UserDataSvc_ABCABBAAACBACAABAACCAABAABACACCACAABBABACCCABAABCCB"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sc create "UserDataSvc_ABCABBAAACBACAABAACCAABAABACACCACAABBABACCCABAABCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCACAABBCBBCBABBCBAABBBCBCABCBACAACCABCAAACCACABAAA.exe" start= auto displayName= "UserDataSvc_ABCABBAAACBACAABAACCAABAABACACCACAABBABACCCABAABCCB"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCABBAAACBACAABAACCAABAABACACCACAABBABACCCABAABCCB"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sc start "UserDataSvc_ABCABBAAACBACAABAACCAABAABACACCACAABBABACCCABAABCCB"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:12620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABBBCABCBBBACCCBACCBAABCAACAABCABABCACBACCAACBCCAABC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABBBCABCBBBACCCBACCBAABCAACAABCABABCACBACCAACBCCAABC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBBCCCAABBACBCAACCAACAACACBACCAAAABAAAABBCBCABAAAABCAABBAAACCABBCACACCCCBBBBAACCCABABBCCAAACCCABBAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCCBAACBBCAAACCCCABBBBBCCACBBCBBCABAABBBCABBBBAACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBBCCCAABBACBCAACCAACAACACBACCAAAABAAAABBCBCABAAAABCAABBAAACCABBCACACCCCBBBBAACCCABABBCCAAACCCABBAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCCBAACBBCAAACCCCABBBBBCCACBBCBBCABAABBBCABBBBAACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABBBCABCBBBACCCBACCBAABCAACAABCABABCACBACCAACBCCAABC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABBBCABCBBBACCCBACCBAABCAACAABCABABCACBACCAACBCCAABC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACBABCAAABBABCAACAABABCCCBCABCCACCBCABBBABACAAACCACBBBBAACCBCCCABCCABAABACCCCABAABCABABCCBBABACACAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBCCCAABBACBCAACCAACAACACBACCAAAABAAAABBCBCABAAAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACBABCAAABBABCAACAABABCCCBCABCCACCBCABBBABACAAACCACBBBBAACCBCCCABCCABAABACCCCABAABCABABCCBBABACACAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBCCCAABBACBCAACCAACAACACBACCAAAABAAAABBCBCABAAAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBBBABCCCAAACCACCAAACBCABCCCAABBBBACBCAAACBCBBBCBBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBBBABCCCAAACCACCAAACBCABCCCAABBBBACBCAAACBCBBBCBBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBBBABCCCAAACCACCAAACBCABCCCAABBBBACBCAAACBCBBBCBBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBBBABCCCAAACCACCAAACBCABCCCAABBBBACBCAAACBCBBBCBBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACACBCBABCAACABBBBAAACAABAAAABABBBBCCACCCAAAABCBBACC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACACBCBABCAACABBBBAAACAABAAAABABBBBCCACCCAAAABCBBACC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCACACCABCCAACABBBCBAACBCCABBACAABBABABAABCBACCABBCCBCCBBBAAABACCCABAACABABACCAACBCCCAABCCBAACCBBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACBBBCACAACCCCACBBBCAABBAACCACCBBCCCCCABBAAACABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCACACCABCCAACABBBCBAACBCCABBACAABBABABAABCBACCABBCCBCCBBBAAABACCCABAACABABACCAACBCCCAABCCBAACCBBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACBBBCACAACCCCACBBBCAABBAACCACCBBCCCCCABBAAACABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCAAACAAACAACCBBACBBBACABCAABCCACAABAABCCCCBACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACBBBCACAACCCCACBBBCAABBAACCACCBBCCCCCABBAAACABBAB.exe" start= auto displayName= "UserDataSvc_BABCAAACAAACAACCBBACBBBACABCAABCCACAABAABCCCCBACBAB"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sc create "UserDataSvc_BABCAAACAAACAACCBBACBBBACABCAABCCACAABAABCCCCBACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACBBBCACAACCCCACBBBCAABBAACCACCBBCCCCCABBAAACABBAB.exe" start= auto displayName= "UserDataSvc_BABCAAACAAACAACCBBACBBBACABCAABCCACAABAABCCCCBACBAB"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABCAAACAAACAACCBBACBBBACABCAABCCACAABAABCCCCBACBAB"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sc start "UserDataSvc_BABCAAACAAACAACCBBACBBBACABCAABCCACAABAABCCCCBACBAB"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAAACAABCACCAAAAABCBCBAAABAAACBBCCCCAAACBCCCACCCCAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAAACAABCACCAAAAABCBCBAAABAAACBBCCCCAAACBCCCACCCCAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBAACCCCABACAAABACBBACABCCACABABBCBCCAABACACABBBCAAACBBABCCBCCCBBCBCABAACBABAABBCCBCBCABCABABAACCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBABCACABCBBCCBABACBCABBCCBBCCCAACBCCBBCAAACBABBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBAACCCCABACAAABACBBACABCCACABABBCBCCAABACACABBBCAAACBBABCCBCCCBBCBCABAACBABAABBCCBCBCABCABABAACCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBABCACABCBBCCBABACBCABBCCBBCCCAACBCCBBCAAACBABBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABCAABACCCAACBBCAABACCBCBBBCBCBBBAAAACBCBBBACBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBABCACABCBBCCBABACBCABBCCBBCCCAACBCCBBCAAACBABBACAA.exe" start= auto displayName= "UserDataSvc_BCABCAABACCCAACBBCAABACCBCBBBCBCBBBAAAACBCBBBACBBBB"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sc create "UserDataSvc_BCABCAABACCCAACBBCAABACCBCBBBCBCBBBAAAACBCBBBACBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBABCACABCBBCCBABACBCABBCCBBCCCAACBCCBBCAAACBABBACAA.exe" start= auto displayName= "UserDataSvc_BCABCAABACCCAACBBCAABACCBCBBBCBCBBBAAAACBCBBBACBBBB"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAAACAABCACCAAAAABCBCBAAABAAACBBCCCCAAACBCCCACCCCAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAAACAABCACCAAAAABCBCBAAABAAACBBCCCCAAACBCCCACCCCAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAAACBCCCCBCAABABBABBCCBAAAAAAAABBBCACBBCBACACCAACCACCCBCCCCBCACACAAABAAAAABCAABAACBBAAAAAACBACCAABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBAABABBBABAACACCCBAACBCCABAACABBCAACCACCABACCBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAAACBCCCCBCAABABBABBCCBAAAAAAAABBBCACBBCBACACCAACCACCCBCCCCBCACACAAABAAAAABCAABAACBBAAAAAACBACCAABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBAABABBBABAACACCCBAACBCCABAACABBCAACCACCABACCBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACABCCAABBAACABABABCCCBAAABBBABCCBCACCBBCAABAAABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBAABABBBABAACACCCBAACBCCABAACABBCAACCACCABACCBBCAB.exe" start= auto displayName= "UserDataSvc_AACABCCAABBAACABABABCCCBAAABBBABCCBCACCBBCAABAAABAB"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBACACBBAAACCCBAAAAACCCCBCCCAABABABBBCCAACAABCABAAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBACACBBAAACCCBAAAAACCCCBCCCAABABABBBCCAACAABCABAAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACAAAACCAABCACACBCACAACBACCCABCACABBCBBAACCBCCAACCBBCBBACCACCBACBCBACABBAAABBBBBBBAACACABBABBCACACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABAAABCAACBABBBCACBACBACABBBCABABCABCBCCABAAACBABABB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACAAAACCAABCACACBCACAACBACCCABCACABBCBBAACCBCCAACCBBCBBACCACCBACBCBACABBAAABBBBBBBAACACABBABBCACACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABAAABCAACBABBBCACBACBACABBBCABABCABCBCCABAAACBABABB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACCABAABBBCAABCBCCBCCCACAACBACCBCAABCACACBCACCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABAAABCAACBABBBCACBACBACABBBCABABCABCBCCABAAACBABABB.exe" start= auto displayName= "UserDataSvc_CAACCABAABBBCAABCBCCBCCCACAACBACCBCAABCACACBCACCCBC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sc create "UserDataSvc_CAACCABAABBBCAABCBCCBCCCACAACBACCBCAABCACACBCACCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABAAABCAACBABBBCACBACBACABBBCABABCABCBCCABAAACBABABB.exe" start= auto displayName= "UserDataSvc_CAACCABAABBBCAABCBCCBCCCACAACBACCBCAABCACACBCACCCBC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAACCABAABBBCAABCBCCBCCCACAACBACCBCAABCACACBCACCCBC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sc start "UserDataSvc_CAACCABAABBBCAABCBCCBCCCACAACBACCBCAABCACACBCACCCBC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBACACBBAAACCCBAAAAACCCCBCCCAABABABBBCCAACAABCABAAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBACACBBAAACCCBAAAAACCCCBCCCAABABABBBCCAACAABCABAAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBCCCCAAAABABBBBBABBACBCCCBCACBCCABBABACACBAABABCBBCBABBBAACCBBCBBAAAAACACBABCBCCCABABCACCCBBACBACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABABBBBACAABCCABAABBCACBACBABBCABCABBCABCBBACCBCCABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBCCCCAAAABABBBBBABBACBCCCBCACBCCABBABACACBAABABCBBCBABBBAACCBBCBBAAAAACACBABCBCCCABABCACCCBBACBACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABABBBBACAABCCABAABBCACBACBABBCABCABBCABCBBACCBCCABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCBCBBACCBBBAAABCABABCBBAACBBABAACBBCAACACCAABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABABBBBACAABCCABAABBCACBACBABBCABCABBCABCBBACCBCCABAC.exe" start= auto displayName= "UserDataSvc_ABBCBCBBACCBBBAAABCABABCBBAACBBABAACBBCAACACCAABCCC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sc create "UserDataSvc_ABBCBCBBACCBBBAAABCABABCBBAACBBABAACBBCAACACCAABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABABBBBACAABCCABAABBCACBACBABBCABCABBCABCBBACCBCCABAC.exe" start= auto displayName= "UserDataSvc_ABBCBCBBACCBBBAAABCABABCBBAACBBABAACBBCAACACCAABCCC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBCBCBBACCBBBAAABCABABCBBAACBBABAACBBCAACACCAABCCC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sc start "UserDataSvc_ABBCBCBBACCBBBAAABCABABCBBAACBBABAACBBCAACACCAABCCC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBACCCCAACAABBAACABABAACCABCCCBAABBCBABBBCACCAAACB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBACCCCAACAABBAACABABAACCABCCCBAABBCBABBBCACCAAACB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAAAAAACACBBCCACAABACCCCCBBBAACCABCBACCBCABBAAACBACACBAACCCBCAAABBBACCABBBBCCBAABACAAABBBBACACBCBBABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBACBBCACABCACCABABBACCCABAAACABACCACBBCBAACBABABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCACCABBBAACCAACCABBBBCACBCCBAACACBACACCCBAAABAABBB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCACCABBBAACCAACCABBBBCACBCCBAACACBACACCCBAAABAABBB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBCBCACABCCBCBABBAACACAABCBACBACABCCACCACAACAAABCCBACBCCBBBBABCBBCABCACBCCBBCCBABCACABBBBCBABBBACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCAABBBACCACAACABACCAACABACAAAAABBBACCABCBBBBCABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACCCBAABCBAABCAABBABCCACCBBCCBBCACAACACBCBBBBCAABA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACCCBAABCBAABCAABBABCCACCBBCCBBCACAACACBCBBBBCAABA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCACCABBBAACCAACCABBBBCACBCCBAACACBACACCCBAAABAABBB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCACCABBBAACCAACCABBBBCACBCCBAACACBACACCCBAAABAABBB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBABABAACAABBBAAACBAABCABAABCCBCBCCAACCBCABABCCCBCBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBABABAACAABBBAAACBAABCABAABCCBCBCCAACCBCABABCCCBCBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBACCCCAACAABBAACABABAACCABCCCBAABBCBABBBCACCAAACB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBACCCCAACAABBAACABABAACCABCCCBAABBCBABBBCACCAAACB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACCCBAABCBAABCAABBABCCACCBBCCBBCACAACACBCBBBBCAABA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACCCBAABCBAABCAABBABCCACCBBCCBBCACAACACBCBBBBCAABA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBCCCCCAACBBCCCABBACABCCABABACBBCBBCAAABBACBCCACABA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBCCCCCAACBBCCCABBACABCCABABACBBCBBCAAABBACBCCACABA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBBCCCABCBACCABCCBCCBCACBABABAAABABCBCCBCCBBACCACAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBBCCCABCBACCABCCBCCBCACBABABAAABABCBCCBCCBBACCACAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACABCCCBACBABABBCCCBBACAACBBCBBCBBACABCCAAAACBABACCBA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACABCCCBACBABABBCCCBBACAACBBCBBCBBACABCCAAAACBABACCBA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBCCCCCAACBBCCCABBACABCCABABACBBCBBCAAABBACBCCACABA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBCCCCCAACBBCCCABBACABCCABABACBBCBBCAAABBACBCCACABA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCBBAACBCBCCABCBCCBBCCCAABBBBABCACCCABCAACABBBCCABC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCBBAACBCBCCABCBCCBBCCCAABBBBABCACCCABCAACABBBCCABC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAAABAACAABCACCCAACBABBACCCCCACCCBABBCBAAAABBCACCCCC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAAABAACAABCACCCAACBABBACCCCCACCCBABBCBAAAABBCACCCCC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBBCCCABCBACCABCCBCCBCACBABABAAABABCBCCBCCBBACCACAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBBCCCABCBACCABCCBCCBCACBABABAAABABCBCCBCCBBACCACAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBABABAACAABBBAAACBAABCABAABCCBCBCCAACCBCABABCCCBCBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBABABAACAABBBAAACBAABCABAABCCBCBCCAACCBCABABCCCBCBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABBCCCACAAABCACAABCBBAACBBACBBABBCACACCCCCAAABBBACC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABBCCCACAAABCACAABCBBAACBBACBBABBCACACCCCCAAABBBACC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCBBAABACCCAABACAABBBAAABABBCACABACABACBBBBABCAABCA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCBBAABACCCAABACAABBBAAABABBCACABACABACBBBBABCAABCA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCAABACCCAACBBCAABACCBCBBBCBCBBBAAAACBCBBBACBBBBACBCACABACBACAACCCBCCAABABABBCCACBABBAAABBACCAAACCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBABCAAABBABCAACAABABCCCBCABCCACCBCABBBABACAAACCACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCAABACCCAACBBCAABACCBCBBBCBCBBBAAAACBCBBBACBBBBACBCACABACBACAACCCBCCAABABABBCCACBABBAAABBACCAAACCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBABCAAABBABCAACAABABCCCBCABCCACCBCABBBABACAAACCACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABBCBCACABCCBCBABBAACACAABCBACBACABCCACCACAACAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBABCAAABBABCAACAABABCCCBCABCCACCBCABBBABACAAACCACBB.exe" start= auto displayName= "UserDataSvc_AAABBCBCACABCCBCBABBAACACAABCBACBACABCCACCACAACAAAB"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBBCBCBCCCBCBAABABCAACBCCBCACAABBABBCACBCBCCBCCCBBBA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBBCBCBCCCBCBAABABCAACBCCBCACAABBABBCACBCBCCBCCCBBBA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBCACCBCBAAACCCBBAABCACACABACABCCCBCCABABACAABBBAACACABBCCABABACABABBBCBCABBBCBCBBABBBCBAAABCBBBCAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBBACCAAABAACACAAABCBCACCAAACACBBCBAABCAACABCACBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBCACCBCBAAACCCBBAABCACACABACABCCCBCCABABACAABBBAACACABBCCABABACABABBBCBCABBBCBCBBABBBCBAAABCBBBCAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBBACCAAABAACACAAABCBCACCAAACACBBCBAABCAACABCACBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAAABAACAABCACCCAACBABBACCCCCACCCBABBCBAAAABBCACCCCC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAAABAACAABCACCCAACBABBACCCCCACCCBABBCBAAAABBCACCCCC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABAABBABCBBAABCBACACCABACCBCACACAABBACACBABBCCCABCAABBABCBACBBABABBBCBCABCCBCBCBCBBCCBABCBBACCBCCAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCAACCABAAABCCBBBCBBCCAACCCCBCBCCABBBBBCCCBBBCBCAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABAABBABCBBAABCBACACCABACCBCACACAABBACACBABBCCCABCAABBABCBACBBABABBBCBCABCCBCBCBCBBCCBABCBBACCBCCAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCAACCABAAABCCBBBCBBCCAACCCCBCBCCABBBBBCCCBBBCBCAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACABCCCBACBABABBCCCBBACAACBBCBBCBBACABCCAAAACBABACCBA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACABCCCBACBABABBCCCBBACAACBBCBBCBBACABCCAAAACBABACCBA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACAACCCACABBACBABBACBAAACBAABACAAABACCACCBACCCABCCABBCACACBCCAACBACCCBABCCBBBCCACCBABBCBCBBBBABABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACACBAABAACCABACACCBCBCCACCBABAABAAABCABCCABABAABABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBBCBCBCCCBCBAABABCAACBCCBCACAABBABBCACBCBCCBCCCBBBA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBBCBCBCCCBCBAABABCAACBCCBCACAABBABBCACBCBCCBCCCBBBA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACACBCACBBAABCCAACAACBBBACCBCCCABCBCACCAACCBABBBACBCCCBBBCCCCCBCBBBBABAABBCBCCACBABACCABCBABCCACCBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCACCACCABCBCABABCBCCACCBCCCCACBBBACABABBBABBCBABBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABABBBBACAABCCABAABBCACBACBABBCABCABBCABCBBACCBCCABAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABABBBBACAABCCABAABBCACBACBABBCABCABBCABCBBACCBCCABAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBBCCACCBACCCBCBCCBABABBAACCCACACCABAAACCACBCBCABAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBBCCACCBACCCBCBCCBABABBAACCCACACCABAAACCACBCBCABAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCCBCABBBCACCBBCCACCCCBACAAAACCACABAAABBACAAAAACBCA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCCBCABBBCACCBBCCACCCCBACAAAACCACABAAABBACAAAAACBCA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCBBACCBBBAAABCABABCBBAACBBABAACBBCAACACCAABCCCABBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCBBACCBBBAAABCABABCBBAACBBABAACBBCAACACCAABCCCABBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABAAABCAACBABBBCACBACBACABBBCABABCABCBCCABAAACBABABB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABAAABCAACBABBBCACBACBACABBBCABABCABCBCCABAAACBABABB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABABBBBACAABCCABAABBCACBACBABBCABCABBCABCBBACCBCCABAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABABBBBACAABCCABAABBCACBACBABBCABCABBCABCBBACCBCCABAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABAAABCAACBABBBCACBACBACABBBCABABCABCBCCABAAACBABABB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABAAABCAACBABBBCACBACBACABBBCABABCABCBCCABAAACBABABB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCACAABBCBBCBABBCBAABBBCBCABCBACAACCABCAAACCACABAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCACAABBCBBCBABBCBAABBBCBCABCBACAACCABCAAACCACABAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACBBBCACAACCCCACBBBCAABBAACCACCBBCCCCCABBAAACABBAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACBBBCACAACCCCACBBBCAABBAACCACCBBCCCCCABBAAACABBAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBAABBBCBCBBBAACBBABAAACACBCBBCCAAAACCBCCCAABBAAAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBAABBBCBCBBBAACBBABAAACACBCBBCCAAAACCBCCCAABBAAAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBABCACABCBBCCBABACBCABBCCBBCCCAACBCCBBCAAACBABBACAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBABCACABCBBCCBABACBCABBCCBBCCCAACBCCBBCAAACBABBACAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCAACCCCABAAAACBCCCCCBCAACABBBBAACACBABACAACCBBCAAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCAACCCCABAAAACBCCCCCBCAACABBBBAACACBABACAACCBBCAAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACBBBCACAACCCCACBBBCAABBAACCACCBBCCCCCABBAAACABBAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACBBBCACAACCCCACBBBCAABBAACCACCBBCCCCCABBAAACABBAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBABCAAABBABCAACAABABCCCBCABCCACCBCABBBABACAAACCACBB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBABCAAABBABCAACAABABCCCBCABCCACCBCABBBABACAAACCACBB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACABABCBCCACBACCCAACBACACCCACCABAAACCCAACCBABCCCABB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACABABCBCCACBACCCAACBACACCCACCABAAACCCAACCBABCCCABB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12308

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        System Services

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1569

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Service Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1569.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1614

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1614.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1aa93ff87a355cd2685e7282e6cbb4c88521ff507e5812251d6aa46e06fa616d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 efffaa27b74d1855d90067dabfb672742bf7f8733cc52e1fe2598f1d2c745bbf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 5a153805bace5a2c256e86ff965f495d50dd6e2932a246db4a393b3ba0fa1e7d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 03a39ca61309db87c3e84f4f0443aa6e1f681259d932b85ecfadc5b9f4398e63
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 464432999fd4e0e324d1bf353fcff7e71bb5aa53e03f2051b4ee7d0081fa10bb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 3a12006f55586df3b02825b1b2a49bed0c8ca82737336f02e4575651ebc2db96
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        svchost_BBCBBCBCAAABBBCBBBCCBBCAABCACBBAABBCABBCCABBCCCBACCABAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCAAABBBCBBBCCBBCAABCACBBAABBCABBCCABBCCCBACCABAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 14.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 ff0a2dd188041748e8fccaa39afd02a667fe39ce92262887e8740b3d1cf33a19
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 58b100e201e06a5c4679ebdf08ef8c2f6cfda27adf40f424eb849a00a438fb74
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 aea28bf9f11de418b710d3f2a5f7bc79da704618626e4d1d185528210adfa7ca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 2bf5625363d16c90901bef3a8119e7cab4b2b95bbdb994280b74908a6b4ab666
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 5c2d9c42f2e1f6df1bb028b13239307a9bc8fbf7875984bbd000bb5d6bf75a87
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 6235a50b27a3e5c8bc40d3775dadc0fb0a38af79aa551db36fda972495779f04
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 09eadc26a46e9449b65f89de19614def40a54abcb3188efa6d094b9a46d59419
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 9KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 2837a32f14a3914eab8a50310a6edf6492041232e9a29d4e70bdf1fdeb186c2c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 e1abc672348bc1210b48d5045206fd78be2d2821b3ac82d664d998132360cfda
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 10KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 3602f749d991dd3264d65d6b80e307e4bb5b943a78a9f4ceed2d35a8b857a4b6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 b39cfe2ef8906eeeefc7acaaa8c7620ecfcf33ab147dcf2af60723682db37c6f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 3958f8c664b3bcfb31cbb3db6efe56ffdd61b4c4507e13bd432d31ce68ffadc2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 13KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 86b5b3176ccf723371f4bdfc1676da02502dac3c4d128e469e2c02e37eaf8d95
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 4296cd4a25e8dc43286d646d914919446aebeeb8d1b0fd798bafa27b92b24455
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 15KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 094fe79201ed7cb23c8583e47ec89ca0df26784512ee718555f2e2e565943c7b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 15KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 fd37bae6ceefe6836590ab8d918146dc50a89f4c2903ce6c39d832e87aa2ab24
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 15KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 922350e9029c53d29dee14223c9af1ff34377724acb1707ac40dd4601172e8a7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 16KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 8df5e1f214d283a7363635a8ce6f3ba97b94054f036ffb8f6a266707228e7558
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 16KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 7acdc0470bfb6a53f448587e77a1eaa0ebbaac04bb3b17d7e7d4eb4659399b93
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 17KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 a8b827aeaeb28388d96e0e171a04c3aaf6358e2d37897a47aa258655a1b314ad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 19743c95975dd9217f707a92b65166aa2479ca06fd2e0a4d7809b785eba2c66b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 a4dbf27fea7fe49e75bf276814ed31ae1a2749f5ee6865bcd9784b55fd0ba3a6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 dce6c8c7080b9b253dbfe8681c3f5dd271d561f5c1c3e413c19c14dc910e1635
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 fbd2f5fa9e8ed69f6eb13f849564327ac05fdd0caad601a91acc53e8a9b6ab48
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 5e1554f9ea43f4534da0d3e15dc4d7599b60a7e8e0e885dd9b4b7f20ca0e18e3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 01ee1fb923fa377eba3a7b6e6e87d07aacc9921cb4572d3fb81d76169a55b70e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 b91018d7afdb72d482d87db38439d8f7431cb479161ef17e8ad53d9e92638ba0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 c65c5aad32866a65b2ea08929641d1cbf08d90b35f7679250b1b270d5d3018a4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 b6a38f564b9c85bdb76afd2a25bccdc040ae6a621b3dc90ae966b18040bbbce0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 24cc7d670d9526d543c36736ca4faee05a8f496c974b54cedd0aca0ef7e0f57b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 06e744e1ca3481c30b8079ed2b06dcf1c176e7b703623ed8d657b8ac500e788f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 b0df81958d9af2790654e8834984cb6d29062c69473544e9b740c12c5fa33b9e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/592-91-0x0000000000E40000-0x0000000000E62000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/752-212-0x0000000000240000-0x0000000000262000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/752-140-0x0000000000240000-0x0000000000262000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1092-705-0x0000000000F40000-0x0000000000F62000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1204-356-0x0000000000540000-0x0000000000562000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1204-570-0x0000000000540000-0x0000000000562000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1232-274-0x0000000000DA0000-0x0000000000DC2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1232-354-0x0000000000DA0000-0x0000000000DC2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1616-569-0x0000000000540000-0x0000000000562000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1616-367-0x0000000000540000-0x0000000000562000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1668-355-0x0000000000DA0000-0x0000000000DC2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1668-275-0x0000000000DA0000-0x0000000000DC2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1736-149-0x0000000000E10000-0x0000000000E32000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1736-213-0x0000000000E10000-0x0000000000E32000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1788-347-0x0000000000140000-0x0000000000162000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1788-240-0x0000000000140000-0x0000000000162000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1964-529-0x00000000001D0000-0x00000000001F2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1964-406-0x00000000001D0000-0x00000000001F2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2008-404-0x0000000000EC0000-0x0000000000EE2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2008-527-0x0000000000EC0000-0x0000000000EE2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2032-403-0x0000000000950000-0x0000000000972000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2032-353-0x0000000000950000-0x0000000000972000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2188-14-0x0000000000900000-0x0000000000922000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2188-45-0x0000000000900000-0x0000000000922000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2256-571-0x0000000000C30000-0x0000000000C52000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2472-572-0x0000000000C30000-0x0000000000C52000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2592-452-0x00000000002B0000-0x00000000002D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2592-380-0x00000000002B0000-0x00000000002D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2640-642-0x0000000000D90000-0x0000000000DB2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2700-643-0x0000000000FA0000-0x0000000000FC2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2736-368-0x0000000000C20000-0x0000000000C42000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2736-589-0x0000000000C20000-0x0000000000C42000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2900-150-0x0000000000440000-0x0000000000462000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3176-369-0x0000000000C20000-0x0000000000C42000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3176-595-0x0000000000C20000-0x0000000000C42000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3248-12-0x0000000000860000-0x0000000000882000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3248-0-0x0000000000860000-0x0000000000882000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3404-929-0x0000000000600000-0x0000000000622000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4104-310-0x0000000000760000-0x0000000000782000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4104-158-0x0000000000760000-0x0000000000782000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4160-451-0x00000000002B0000-0x00000000002D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4160-379-0x00000000002B0000-0x00000000002D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4240-92-0x0000000000E40000-0x0000000000E62000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4272-704-0x0000000000FA0000-0x0000000000FC2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4296-405-0x0000000000EC0000-0x0000000000EE2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4296-528-0x0000000000EC0000-0x0000000000EE2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4376-426-0x00000000006E0000-0x0000000000702000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4376-755-0x00000000006E0000-0x0000000000702000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4448-157-0x0000000000760000-0x0000000000782000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4448-309-0x0000000000760000-0x0000000000782000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4460-151-0x0000000000440000-0x0000000000462000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4616-90-0x0000000000E40000-0x0000000000E62000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5088-156-0x0000000000760000-0x0000000000782000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5088-308-0x0000000000760000-0x0000000000782000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5104-847-0x0000000000D90000-0x0000000000DB2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5668-776-0x0000000000700000-0x0000000000722000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5764-706-0x0000000000F40000-0x0000000000F62000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5884-612-0x0000000000D90000-0x0000000000DB2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/6004-597-0x0000000000C30000-0x0000000000C52000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/6092-44-0x0000000000900000-0x0000000000922000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/6092-13-0x0000000000900000-0x0000000000922000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/6184-930-0x00000000002D0000-0x00000000002F2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/6536-972-0x0000000000B60000-0x0000000000B82000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/7024-973-0x0000000000160000-0x0000000000182000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download