f857a2b99a4ebd63b0b07afa416f09d48bfdad964bea0f62e15b2f0756fa3c67

Analysis

max time kernel
150s
max time network
89s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 12.8MB
Sample260714-efjs5af13t
SHA256 f857a2b99a4ebd63b0b07afa416f09d48bfdad964bea0f62e15b2f0756fa3c67
MD5 5dcbb1125a348fde6e6190673893000c
SHA1 5c0493a86db68d353aa62c222a6a7d20d425c355
SHA512 8c92f9fa09cbd5f17b59c92f708277edba16dce8ea3c2092a81a37c6d6c8542430aec1317b888f512d42de2f66c2dfcd17a9c9e118dd28ebe03577c1299883b0
SSDEEP 98304:B4TS4TS4TS4TS4TS4TS4TS4T6OU/jIEeQfoR/IuOFVjUu54:BppppppphFIF0wum
TLSH
T13ED67C12B6ED016DF0F30B31EE39A266A935FCFE6E12D55E6549740E2672B00C929337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables manipulated with Fody 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c46a-10.dat	INDICATOR_EXE_Packed_Fody
behavioral2/files/0x0002000000019c46-941.dat	INDICATOR_EXE_Packed_Fody

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_ABBABCCBBABCCAAABBCAAABACACCBBBBCBACAAACAAAABACAAABAAAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe

Executes dropped EXE 49 IoCs

pid	Process
4228	svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe
2856	svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe
252	svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe
120	svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe
6000	svchost_CBAACACACCAACACABCBBCBBABACAABBCBACABACABAACABBACBCBAAC.exe
5580	svchost_AABBABACACACABBAACBBBABAAAAAAAAAACBCCCBCBBBBCBCCBBCAACB.exe
4992	svchost_AAAABACCCCAACBBBBACAACCCCCAACCCABCBCACCCCACCABCBBAACCBA.exe
1432	svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe
4528	svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe
3408	svchost_CABCAABACCCACCCBCCCBABCAACBBAAAAABBCCBABAACAAABCCBCBACC.exe
1628	svchost_BABBBCCACCBCCCABACCACBCCCBCBCCBCBABACACACBABAAAACAAACCC.exe
5144	svchost_BCBBBABAACCBCABBACBACCAABCACBACAAACABAABCBCCCBBCACBCACC.exe
1332	svchost_BCBBBABAACCBCABBACBACCAABCACBACAAACABAABCBCCCBBCACBCACC.exe
3284	svchost_AABAAABACCCBABAAAAAAACCBBBACBABBAABCAAAAAAABBCCABAABCAB.exe
2968	svchost_AABAAABACCCBABAAAAAAACCBBBACBABBAABCAAAAAAABBCCABAABCAB.exe
5252	svchost_BBBBCBCBCCCACCABAAACABABACABCCAAABCABAAABBBCAABACAAACCC.exe
2636	svchost_BBBBCBCBCCCACCABAAACABABACABCCAAABCABAAABBBCAABACAAACCC.exe
2724	svchost_BCBBBACBBBBBABCBACACABBCACCBBBBBBBCCABACCBCAAABCAAABBCB.exe
3532	svchost_BCBBBACBBBBBABCBACACABBCACCBBBBBBBCCABACCBCAAABCAAABBCB.exe
1016	svchost_CBCBCCCBCAAACCAABCABACBCCBCCCBAACBCBBBBACACAAACBACCBBBA.exe
2388	svchost_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAAB.exe
4620	svchost_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAAB.exe
4696	svchost_ACCACACCCBAABCAAACABACACCCBBCCAACACCABBBBBBCBACBABAABCB.exe
3612	svchost_BBBACAAACBBBAAACCABACBABABAACCBCBCACCCACACBBCCBCCBBACCB.exe
4900	svchost_ACABABACCBBAABABABBCCBBCABABCBCBCBACCAABCCCACAABABBBCCB.exe
4944	svchost_CACAACAABCBCACAABBAAAABBCBCCBBBABBABACCABBABCAABABACABB.exe
2960	svchost_ACBACCCCCABBACCCBBCBACCBBACCACCCBCCABACACBCCAABBACBACBA.exe
2604	svchost_ACBACCCCCABBACCCBBCBACCBBACCACCCBCCABACACBCCAABBACBACBA.exe
3244	svchost_BCBCCCBCBABCBABBABCBBBBBCAAACABABCAAABBCBBACBBBACCCCBCC.exe
4480	svchost_ABBABCCBBABCCAAABBCAAABACACCBBBBCBACAAACAAAABACAAABAAAA.exe
1928	svchost_ABBCCAAACCCABACCBCCCCCBACCCCCCCACCCCBAABABAAAAACBCCBAAA.exe
2868	svchost_ABBABCCBBABCCAAABBCAAABACACCBBBBCBACAAACAAAABACAAABAAAA.exe
2080	svchost_ABBCCAAACCCABACCBCCCCCBACCCCCCCACCCCBAABABAAAAACBCCBAAA.exe
5908	svchost_BABABCCBCABCBBCABCCCBAAACACBBCCAAABBBABCBBBCCACACACAABB.exe
2064	svchost_BABABCCBCABCBBCABCCCBAAACACBBCCAAABBBABCBBBCCACACACAABB.exe
6348	svchost_BCBBABAABAABAACAABBBBBCAABACCCABAACBCABBCBCABCBABCABCCB.exe
6356	svchost_BCBBABAABAABAACAABBBBBCAABACCCABAACBCABBCBCABCBABCABCCB.exe
6784	svchost_AABAACACBBCCABACABCABBAAABCACABCCCBAACABABABACCABACBAAA.exe
6824	svchost_AABAACACBBCCABACABCABBAAABCACABCCCBAACABABABACCABACBAAA.exe
4372	svchost_CBCCBCCBBAABBBCBABCCCACBAACBAABBBBBCBCCBACCACCCCCACACCC.exe
6524	svchost_CBCBCBCBBCCCBACBACBCBBBBBCBAACABBBBCBABACBBCBBCACCAABBA.exe
6516	svchost_BCBAACBAAACACBCABBCCABAACBBACBBAACABAABAAACCCBBBCCABAAB.exe
6620	svchost_AAABBAACAABACCBAACABCBABCBBBABABCCBACCBACBCBCCBBABBBBCA.exe
2460	svchost_BCBAACBAAACACBCABBCCABAACBBACBBAACABAABAAACCCBBBCCABAAB.exe
6276	svchost_CBCBCBCBBCCCBACBACBCBBBBBCBAACABBBBCBABACBBCBBCACCAABBA.exe
6904	svchost_CBBBABAABAACCACABBCBAABBCBABABBABABACBBCBCCCACABCAABAAB.exe
6280	svchost_AAABBAACAABACCBAACABCBABCBBBABABCCBACCBACBCBCCBBABBBBCA.exe
7124	svchost_BAABBACACABABABBABBCBCCBAABCCACBCACBABAAAAACACBACACAAAC.exe
7240	svchost_BAABBACACABABABBABBCBCCBAABCCACBCACBABAAAAACACBACACAAAC.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACCACBBBCABACCABCBCCBCCCBABACCBCBCBABCCBBAABABBAACBBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBAACBAAACACBCABBCCABAACBBACBBAACABAABAAACCCBBBCCABAAB.exe"	svchost_BCBBABAABAABAACAABBBBBCAABACCCABAACBCABBCBCABCBABCABCCB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACCACBBBCABBCABCBCACBBBACBBCAABBCABCABCCBBACCABABCCBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAACAACCBBCAABACCBABBCCABABABABCBAAAABABCBBBCAABAACBBC.exe"	svchost_BABABCCBCABCBBCABCCCBAAACACBBCCAAABBBABCBBBCCACACACAABB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBAABCCCABBBCCCACCACACBBBCCACCAAABBACACBABBBCCBBABACBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe"	2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBCACCBCCCBCBACBABACBBACBCAAABBCCABBACCCCBAACAACCCAAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe"	svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe"	svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCBCCBBAABBBCBABCCCACBAACBAABBBBBCBCCBACCACCCCCACACCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCBCCBBAABBBCBABCCCACBAACBAABBBBBCBCCBACCACCCCCACACCC.exe"	svchost_ABBABCCBBABCCAAABBCAAABACACCBBBBCBACAAACAAAABACAAABAAAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBCAABBABBBACCCACCABCCCCABACAACCCBBCBCACBCCBCCBBBCABAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABBAACAABACCBAACABCBABCBBBABABCCBACCBACBCBCCBBABBBBCA.exe"	svchost_ABBCCAAACCCABACCBCCCCCBACCCCCCCACCCCBAABABAAAAACBCCBAAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAAAACBCCCCBAABCAAAABCABBCBCBBCBACABBACBBBCACACCBACBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBBACBBBBBABCBACACABBCACCBBBBBBBCCABACCBCAAABCAAABBCB.exe"	svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAAB.exe"	svchost_BCBBBABAACCBCABBACBACCAABCACBACAAACABAABCBCCCBBCACBCACC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACABABACCBBAABABABBCCBBCABABCBCBCBACCAABCCCACAABABBBCCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABABACCBBAABABABBCCBBCABABCBCBCBACCAABCCCACAABABBBCCB.exe"	svchost_AABAAABACCCBABAAAAAAACCBBBACBABBAABCAAAAAAABBCCABAABCAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCACCABACBBCAACBABCBBAABCACAAACCABCBCACCBACACBBABBBBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCCCBCBABCBABBABCBBBBBCAAACABABCAAABBCBBACBBBACCCCBCC.exe"	svchost_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBBBAACAACABCBAABBAACAAABBCBABBBBBBBBCABAACBBBABABCBAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCCAAACCCABACCBCCCCCBACCCCCCCACCCCBAABABAAAAACBCCBAAA.exe"	svchost_BBBBCBCBCCCACCABAAACABABACABCCAAABCABAAABBBCAABACAAACCC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABAACACBBCCABACABCABBAAABCACABCCCBAACABABABACCABACBAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABAACACBBCCABACABCABBAAABCACABCCCBAACABABABACCABACBAAA.exe"	svchost_BCBBBACBBBBBABCBACACABBCACCBBBBBBBCCABACCBCAAABCAAABBCB.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2644	sc.exe
8720	sc.exe
4328	sc.exe
1560	sc.exe
3492	sc.exe
3148	sc.exe
5416	sc.exe
7136	sc.exe
800	sc.exe
5996	sc.exe
9392	sc.exe
924	sc.exe
4908	sc.exe
4596	sc.exe
7420	sc.exe
9456	sc.exe
11328	sc.exe
1796	sc.exe
12656	sc.exe
3024	sc.exe
7876	sc.exe
9416	sc.exe
12712	sc.exe
2676	sc.exe
6264	sc.exe
4112	sc.exe
568	sc.exe
4600	sc.exe
5860	sc.exe
7200	sc.exe
6640	sc.exe
7204	sc.exe
7328	sc.exe
4044	sc.exe
11728	sc.exe
12556	sc.exe
7488	sc.exe
7712	sc.exe
4940	sc.exe
7512	sc.exe
916	sc.exe
3868	sc.exe
11612	sc.exe
11852	sc.exe
2732	sc.exe
9244	sc.exe
12032	sc.exe
12252	sc.exe
12692	sc.exe
5036	sc.exe
4792	sc.exe
4044	sc.exe
1232	sc.exe
8564	sc.exe
6692	sc.exe
9444	sc.exe
9256	sc.exe
1368	sc.exe
12244	sc.exe
5248	sc.exe
4580	sc.exe
7452	sc.exe
4196	sc.exe
9448	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBABAABAACCACABBCBAABBCBABABBABABACBBCBCCCACABCAABAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCBCCBBAABBBCBABCCCACBAACBAABBBBBCBCCBACCACCCCCACACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCACACCCBAABCAAACABACACCCBBCCAACACCABBBBBBCBACBABAABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAABACCCCAACBBBBACAACCCCCAACCCABCBCACCCCACCABCBBAACCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBACAAACBBBAAACCABACBABABAACCBCBCACCCACACBBCCBCCBBACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBABACACACABBAACBBBABAAAAAAAAAACBCCCBCBBBBCBCCBBCAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBBABAACCBCABBACBACCAABCACBACAAACABAABCBCCCBBCACBCACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBAACBAAACACBCABBCCABAACBBACBBAACABAABAAACCCBBBCCABAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
11632	schtasks.exe
4112	schtasks.exe
8432	schtasks.exe
8952	schtasks.exe
9440	schtasks.exe
6568	schtasks.exe
1420	schtasks.exe
6140	schtasks.exe
8488	schtasks.exe
9104	schtasks.exe
9512	schtasks.exe
6540	schtasks.exe
4844	schtasks.exe
2860	schtasks.exe
4280	schtasks.exe
4696	schtasks.exe
6648	schtasks.exe
9968	schtasks.exe
2952	schtasks.exe
9284	schtasks.exe
1924	schtasks.exe
1080	schtasks.exe
1248	schtasks.exe
6872	schtasks.exe
6616	schtasks.exe
6028	schtasks.exe
8804	schtasks.exe
13028	schtasks.exe
1408	schtasks.exe
3272	schtasks.exe
6932	schtasks.exe
4612	schtasks.exe
11192	schtasks.exe
4204	schtasks.exe
5828	schtasks.exe
4248	schtasks.exe
6864	schtasks.exe
5808	schtasks.exe
2268	schtasks.exe
8140	schtasks.exe
2628	schtasks.exe
2624	schtasks.exe
3564	schtasks.exe
4364	schtasks.exe
12836	schtasks.exe
4044	schtasks.exe
2880	schtasks.exe
3740	schtasks.exe
4820	schtasks.exe
7844	schtasks.exe
1680	schtasks.exe
9452	schtasks.exe
10396	schtasks.exe
8352	schtasks.exe
9072	schtasks.exe
9112	schtasks.exe
6912	schtasks.exe
4412	schtasks.exe
3216	schtasks.exe
7160	schtasks.exe
4612	schtasks.exe
3152	schtasks.exe
8084	schtasks.exe
4072	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3700	2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3700	2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4228	svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe
4228	svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe
2856	svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe
2856	svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe
6000	svchost_CBAACACACCAACACABCBBCBBABACAABBCBACABACABAACABBACBCBAAC.exe
6000	svchost_CBAACACACCAACACABCBBCBBABACAABBCBACABACABAACABBACBCBAAC.exe
3700	2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3700	2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
252	svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe
252	svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe
120	svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe
120	svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe
5580	svchost_AABBABACACACABBAACBBBABAAAAAAAAAACBCCCBCBBBBCBCCBBCAACB.exe
5580	svchost_AABBABACACACABBAACBBBABAAAAAAAAAACBCCCBCBBBBCBCCBBCAACB.exe
4228	svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe
4228	svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe
4528	svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe
4528	svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe
3408	svchost_CABCAABACCCACCCBCCCBABCAACBBAAAAABBCCBABAACAAABCCBCBACC.exe
3408	svchost_CABCAABACCCACCCBCCCBABCAACBBAAAAABBCCBABAACAAABCCBCBACC.exe
1628	svchost_BABBBCCACCBCCCABACCACBCCCBCBCCBCBABACACACBABAAAACAAACCC.exe
1628	svchost_BABBBCCACCBCCCABACCACBCCCBCBCCBCBABACACACBABAAAACAAACCC.exe
4992	svchost_AAAABACCCCAACBBBBACAACCCCCAACCCABCBCACCCCACCABCBBAACCBA.exe
4992	svchost_AAAABACCCCAACBBBBACAACCCCCAACCCABCBCACCCCACCABCBBAACCBA.exe
1432	svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe
1432	svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe
120	svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe
120	svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe
5144	svchost_BCBBBABAACCBCABBACBACCAABCACBACAAACABAABCBCCCBBCACBCACC.exe
1332	svchost_BCBBBABAACCBCABBACBACCAABCACBACAAACABAABCBCCCBBCACBCACC.exe
5144	svchost_BCBBBABAACCBCABBACBACCAABCACBACAAACABAABCBCCCBBCACBCACC.exe
1332	svchost_BCBBBABAACCBCABBACBACCAABCACBACAAACABAABCBCCCBBCACBCACC.exe
3532	svchost_BCBBBACBBBBBABCBACACABBCACCBBBBBBBCCABACCBCAAABCAAABBCB.exe
3532	svchost_BCBBBACBBBBBABCBACACABBCACCBBBBBBBCCABACCBCAAABCAAABBCB.exe
3284	svchost_AABAAABACCCBABAAAAAAACCBBBACBABBAABCAAAAAAABBCCABAABCAB.exe
3284	svchost_AABAAABACCCBABAAAAAAACCBBBACBABBAABCAAAAAAABBCCABAABCAB.exe
2968	svchost_AABAAABACCCBABAAAAAAACCBBBACBABBAABCAAAAAAABBCCABAABCAB.exe
2968	svchost_AABAAABACCCBABAAAAAAACCBBBACBABBAABCAAAAAAABBCCABAABCAB.exe
1016	svchost_CBCBCCCBCAAACCAABCABACBCCBCCCBAACBCBBBBACACAAACBACCBBBA.exe
1016	svchost_CBCBCCCBCAAACCAABCABACBCCBCCCBAACBCBBBBACACAAACBACCBBBA.exe
2388	svchost_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAAB.exe
2388	svchost_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAAB.exe
4620	svchost_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAAB.exe
4620	svchost_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAAB.exe
5252	svchost_BBBBCBCBCCCACCABAAACABABACABCCAAABCABAAABBBCAABACAAACCC.exe
5252	svchost_BBBBCBCBCCCACCABAAACABABACABCCAAABCABAAABBBCAABACAAACCC.exe
2636	svchost_BBBBCBCBCCCACCABAAACABABACABCCAAABCABAAABBBCAABACAAACCC.exe
2636	svchost_BBBBCBCBCCCACCABAAACABABACABCCAAABCABAAABBBCAABACAAACCC.exe
3612	svchost_BBBACAAACBBBAAACCABACBABABAACCBCBCACCCACACBBCCBCCBBACCB.exe
3612	svchost_BBBACAAACBBBAAACCABACBABABAACCBCBCACCCACACBBCCBCCBBACCB.exe
4900	svchost_ACABABACCBBAABABABBCCBBCABABCBCBCBACCAABCCCACAABABBBCCB.exe
4900	svchost_ACABABACCBBAABABABBCCBBCABABCBCBCBACCAABCCCACAABABBBCCB.exe
2724	svchost_BCBBBACBBBBBABCBACACABBCACCBBBBBBBCCABACCBCAAABCAAABBCB.exe
2724	svchost_BCBBBACBBBBBABCBACACABBCACCBBBBBBBCCABACCBCAAABCAAABBCB.exe
6356	svchost_BCBBABAABAABAACAABBBBBCAABACCCABAACBCABBCBCABCBABCABCCB.exe
6356	svchost_BCBBABAABAABAACAABBBBBCAABACCCABAACBCABBCBCABCBABCABCCB.exe
6348	svchost_BCBBABAABAABAACAABBBBBCAABACCCABAACBCABBCBCABCBABCABCCB.exe
6348	svchost_BCBBABAABAABAACAABBBBBCAABACCCABAACBCABBCBCABCBABCABCCB.exe
4480	svchost_ABBABCCBBABCCAAABBCAAABACACCBBBBCBACAAACAAAABACAAABAAAA.exe
4480	svchost_ABBABCCBBABCCAAABBCAAABACACCBBBBCBACAAACAAAABACAAABAAAA.exe
1928	svchost_ABBCCAAACCCABACCBCCCCCBACCCCCCCACCCCBAABABAAAAACBCCBAAA.exe
1928	svchost_ABBCCAAACCCABACCBCCCCCBACCCCCCCACCCCBAABABAAAAACBCCBAAA.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	3700	2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4228	svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe
Token: SeDebugPrivilege	2856	svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe
Token: SeDebugPrivilege	6000	svchost_CBAACACACCAACACABCBBCBBABACAABBCBACABACABAACABBACBCBAAC.exe
Token: SeDebugPrivilege	252	svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe
Token: SeDebugPrivilege	120	svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe
Token: SeDebugPrivilege	5580	svchost_AABBABACACACABBAACBBBABAAAAAAAAAACBCCCBCBBBBCBCCBBCAACB.exe
Token: SeDebugPrivilege	4528	svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe
Token: SeDebugPrivilege	3408	svchost_CABCAABACCCACCCBCCCBABCAACBBAAAAABBCCBABAACAAABCCBCBACC.exe
Token: SeDebugPrivilege	1628	svchost_BABBBCCACCBCCCABACCACBCCCBCBCCBCBABACACACBABAAAACAAACCC.exe
Token: SeDebugPrivilege	4992	svchost_AAAABACCCCAACBBBBACAACCCCCAACCCABCBCACCCCACCABCBBAACCBA.exe
Token: SeDebugPrivilege	1432	svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe
Token: SeDebugPrivilege	1332	svchost_BCBBBABAACCBCABBACBACCAABCACBACAAACABAABCBCCCBBCACBCACC.exe
Token: SeDebugPrivilege	5144	svchost_BCBBBABAACCBCABBACBACCAABCACBACAAACABAABCBCCCBBCACBCACC.exe
Token: SeDebugPrivilege	3532	svchost_BCBBBACBBBBBABCBACACABBCACCBBBBBBBCCABACCBCAAABCAAABBCB.exe
Token: SeDebugPrivilege	3284	svchost_AABAAABACCCBABAAAAAAACCBBBACBABBAABCAAAAAAABBCCABAABCAB.exe
Token: SeDebugPrivilege	2968	svchost_AABAAABACCCBABAAAAAAACCBBBACBABBAABCAAAAAAABBCCABAABCAB.exe
Token: SeDebugPrivilege	1016	svchost_CBCBCCCBCAAACCAABCABACBCCBCCCBAACBCBBBBACACAAACBACCBBBA.exe
Token: SeDebugPrivilege	2388	svchost_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAAB.exe
Token: SeDebugPrivilege	4620	svchost_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAAB.exe
Token: SeDebugPrivilege	5252	svchost_BBBBCBCBCCCACCABAAACABABACABCCAAABCABAAABBBCAABACAAACCC.exe
Token: SeDebugPrivilege	2636	svchost_BBBBCBCBCCCACCABAAACABABACABCCAAABCABAAABBBCAABACAAACCC.exe
Token: SeDebugPrivilege	3612	svchost_BBBACAAACBBBAAACCABACBABABAACCBCBCACCCACACBBCCBCCBBACCB.exe
Token: SeDebugPrivilege	4900	svchost_ACABABACCBBAABABABBCCBBCABABCBCBCBACCAABCCCACAABABBBCCB.exe
Token: SeDebugPrivilege	2724	svchost_BCBBBACBBBBBABCBACACABBCACCBBBBBBBCCABACCBCAAABCAAABBCB.exe
Token: SeDebugPrivilege	6356	svchost_BCBBABAABAABAACAABBBBBCAABACCCABAACBCABBCBCABCBABCABCCB.exe
Token: SeDebugPrivilege	6348	svchost_BCBBABAABAABAACAABBBBBCAABACCCABAACBCABBCBCABCBABCABCCB.exe
Token: SeDebugPrivilege	4480	svchost_ABBABCCBBABCCAAABBCAAABACACCBBBBCBACAAACAAAABACAAABAAAA.exe
Token: SeDebugPrivilege	1928	svchost_ABBCCAAACCCABACCBCCCCCBACCCCCCCACCCCBAABABAAAAACBCCBAAA.exe
Token: SeDebugPrivilege	2868	svchost_ABBABCCBBABCCAAABBCAAABACACCBBBBCBACAAACAAAABACAAABAAAA.exe
Token: SeDebugPrivilege	2080	svchost_ABBCCAAACCCABACCBCCCCCBACCCCCCCACCCCBAABABAAAAACBCCBAAA.exe
Token: SeDebugPrivilege	5908	svchost_BABABCCBCABCBBCABCCCBAAACACBBCCAAABBBABCBBBCCACACACAABB.exe
Token: SeDebugPrivilege	4696	svchost_ACCACACCCBAABCAAACABACACCCBBCCAACACCABBBBBBCBACBABAABCB.exe
Token: SeDebugPrivilege	2064	svchost_BABABCCBCABCBBCABCCCBAAACACBBCCAAABBBABCBBBCCACACACAABB.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 4500	3700	2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	87
PID 4500 wrote to memory of 4280	4500	cmd.exe	89
PID 3700 wrote to memory of 2572	3700	2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	91
PID 2572 wrote to memory of 5136	2572	cmd.exe	93
PID 3700 wrote to memory of 5544	3700	2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	94
PID 5544 wrote to memory of 704	5544	cmd.exe	97
PID 4228 wrote to memory of 5468	4228	svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe	100
PID 5468 wrote to memory of 1924	5468	cmd.exe	102
PID 4228 wrote to memory of 1832	4228	svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe	103
PID 1832 wrote to memory of 4112	1832	cmd.exe	105
PID 4228 wrote to memory of 1528	4228	svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe	106
PID 1528 wrote to memory of 5248	1528	cmd.exe	108
PID 2856 wrote to memory of 4136	2856	svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe	112
PID 4136 wrote to memory of 3740	4136	cmd.exe	114
PID 2856 wrote to memory of 1520	2856	svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe	115
PID 1520 wrote to memory of 3804	1520	cmd.exe	117
PID 2856 wrote to memory of 1424	2856	svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe	118
PID 1424 wrote to memory of 924	1424	cmd.exe	120
PID 6000 wrote to memory of 1388	6000	svchost_CBAACACACCAACACABCBBCBBABACAABBCBACABACABAACABBACBCBAAC.exe	122
PID 1388 wrote to memory of 1420	1388	cmd.exe	124
PID 6000 wrote to memory of 3512	6000	svchost_CBAACACACCAACACABCBBCBBABACAABBCBACABACABAACABBACBCBAAC.exe	125
PID 3512 wrote to memory of 3024	3512	cmd.exe	127
PID 6000 wrote to memory of 1148	6000	svchost_CBAACACACCAACACABCBBCBBABACAABBCBACABACABAACABBACBCBAAC.exe	128
PID 1148 wrote to memory of 4908	1148	cmd.exe	130
PID 252 wrote to memory of 680	252	svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe	132
PID 120 wrote to memory of 5924	120	svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe	134
PID 680 wrote to memory of 2628	680	cmd.exe	136
PID 5924 wrote to memory of 2000	5924	cmd.exe	137
PID 252 wrote to memory of 2512	252	svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe	138
PID 120 wrote to memory of 5020	120	svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe	140
PID 2512 wrote to memory of 2732	2512	cmd.exe	142
PID 252 wrote to memory of 560	252	svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe	143
PID 5020 wrote to memory of 5036	5020	cmd.exe	145
PID 560 wrote to memory of 5964	560	cmd.exe	146
PID 120 wrote to memory of 3864	120	svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe	147
PID 3864 wrote to memory of 1560	3864	cmd.exe	152
PID 5580 wrote to memory of 5760	5580	svchost_AABBABACACACABBAACBBBABAAAAAAAAAACBCCCBCBBBBCBCCBBCAACB.exe	155
PID 5760 wrote to memory of 5808	5760	cmd.exe	157
PID 5580 wrote to memory of 5640	5580	svchost_AABBABACACACABBAACBBBABAAAAAAAAAACBCCCBCBBBBCBCCBBCAACB.exe	158
PID 5640 wrote to memory of 3220	5640	cmd.exe	160
PID 5580 wrote to memory of 4628	5580	svchost_AABBABACACACABBAACBBBABAAAAAAAAAACBCCCBCBBBBCBCCBBCAACB.exe	161
PID 4628 wrote to memory of 2088	4628	cmd.exe	163
PID 4528 wrote to memory of 5548	4528	svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe	166
PID 5548 wrote to memory of 4044	5548	cmd.exe	168
PID 4528 wrote to memory of 1304	4528	svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe	169
PID 1304 wrote to memory of 4600	1304	cmd.exe	171
PID 4528 wrote to memory of 1320	4528	svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe	172
PID 1320 wrote to memory of 5400	1320	cmd.exe	174
PID 3408 wrote to memory of 2776	3408	svchost_CABCAABACCCACCCBCCCBABCAACBBAAAAABBCCBABAACAAABCCBCBACC.exe	176
PID 2776 wrote to memory of 4248	2776	cmd.exe	178
PID 3408 wrote to memory of 3352	3408	svchost_CABCAABACCCACCCBCCCBABCAACBBAAAAABBCCBABAACAAABCCBCBACC.exe	179
PID 3352 wrote to memory of 3492	3352	cmd.exe	182
PID 3408 wrote to memory of 3392	3408	svchost_CABCAABACCCACCCBCCCBABCAACBBAAAAABBCCBABAACAAABCCBCBACC.exe	183
PID 3392 wrote to memory of 2896	3392	cmd.exe	185
PID 1628 wrote to memory of 4052	1628	svchost_BABBBCCACCBCCCABACCACBCCCBCBCCBCBABACACACBABAAAACAAACCC.exe	188
PID 4052 wrote to memory of 1080	4052	cmd.exe	190
PID 1628 wrote to memory of 4116	1628	svchost_BABBBCCACCBCCCABACCACBCCCBCBCCBCBABACACACBABAAAACAAACCC.exe	191
PID 4116 wrote to memory of 3612	4116	cmd.exe	193
PID 1628 wrote to memory of 900	1628	svchost_BABBBCCACCBCCCABACCACBCCCBCBCCBCBABACACACBABAAAACAAACCC.exe	194
PID 900 wrote to memory of 2796	900	cmd.exe	196
PID 4992 wrote to memory of 1132	4992	svchost_AAAABACCCCAACBBBBACAACCCCCAACCCABCBCACCCCACCABCBBAACCBA.exe	200
PID 1132 wrote to memory of 4612	1132	cmd.exe	202
PID 4992 wrote to memory of 2420	4992	svchost_AAAABACCCCAACBBBBACAACCCCCAACCCABCBCACCCCACCABCBBAACCBA.exe	204
PID 2420 wrote to memory of 2644	2420	cmd.exe	206

C:\Users\Admin\AppData\Local\Temp\2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_5dcbb1125a348fde6e6190673893000c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAABCCCABBBCCCACCACACBBBCCACCAAABBACACBABBBCCBBABACBBAACACCCBBAABBBBCCBBACBCBBBAABCACCABABAACAAAAABABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAABCCCABBBCCCACCACACBBBCCACCAAABBACACBABBBCCBBABACBBAACACCCBBAABBBBCCBBACBCBBBAABCACCABABAACAAAAABABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCABABCBCBBBBBBCACAABBAABABACCCCBCBBBBBBBCCBAACBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe" start= auto displayName= "UserDataSvc_CCCABABCBCBBBBBBCACAABBAABABACCCCBCBBBBBBBCCBAACBCC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCABABCBCBBBBBBCACAABBAABABACCCCBCBBBBBBBCCBAACBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe" start= auto displayName= "UserDataSvc_CCCABABCBCBBBBBBCACAABBAABABACCCCBCBBBBBBBCCBAACBCC"
    3⤵
    PID:5136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCABABCBCBBBBBBCACAABBAABABACCCCBCBBBBBBBCCBAACBCC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5544
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCABABCBCBBBBBBCACAABBAABABACCCCBCBBBBBBBCCBAACBCC"
    3⤵
    PID:704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCACCBCCCBCBACBABACBBACBCAAABBCCABBACCCCBAACAACCCAAABBBBBBBCBAAACBABBBAAABBBCABAACABBAABACABCBACCBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCACCBCCCBCBACBABACBBACBCAAABBCCABBACCCCBAACAACCCAAABBBBBBBCBAAACBABBBAAABBBCABAACABBAABACABCBACCBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABAABACAABBAABCBAABAAACCBBBCCABCACAACCACBCBBCACCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe" start= auto displayName= "UserDataSvc_BABAABACAABBAABCBAABAAACCBBBCCABCACAACCACBCBBCACCCA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABAABACAABBAABCBAABAAACCBBBCCABCACAACCACBCBBCACCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe" start= auto displayName= "UserDataSvc_BABAABACAABBAABCBAABAAACCBBBCCABCACAACCACBCBBCACCCA"
    3⤵
    - Launches sc.exe
    PID:4112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABAABACAABBAABCBAABAAACCBBBCCABCACAACCACBCBBCACCCA"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABAABACAABBAABCBAABAAACCBBBCCABCACAACCACBCBBCACCCA"
    3⤵
    - Launches sc.exe
    PID:5248

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBBACCAAAACBBABCABAABBACABABBBCBBCCCCBCCAABCAABCCBACCCBACABAABBABCAABCACCBBABCCBBABBBBCBBCAABACBBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACACACCAACACABCBBCBBABACAABBCBACABACABAACABBACBCBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBBACCAAAACBBABCABAABBACABABBBCBBCCCCBCCAABCAABCCBACCCBACABAABBABCAABCACCBBABCCBBABBBBCBBCAABACBBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACACACCAACACABCBBCBBABACAABBCBACABACABAACABBACBCBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABCCABCCACACAABCCABCACCAAABBBCABCBAACBCBBAAAACABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACACACCAACACABCBBCBBABACAABBCBACABACABAACABBACBCBAAC.exe" start= auto displayName= "UserDataSvc_ACABCCABCCACACAABCCABCACCAAABBBCABCBAACBCBBAAAACABC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABCCABCCACACAABCCABCACCAAABBBCABCBAACBCBBAAAACABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACACACCAACACABCBBCBBABACAABBCBACABACABAACABBACBCBAAC.exe" start= auto displayName= "UserDataSvc_ACABCCABCCACACAABCCABCACCAAABBBCABCBAACBCBBAAAACABC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABCCABCCACACAABCCABCACCAAABBBCABCBAACBCBBAAAACABC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABCCABCCACACAABCCABCACCAAABBBCABCBAACBCBBAAAACABC"
    3⤵
    - Launches sc.exe
    PID:924

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBCBAACCBACBCBCCBBAABCBBBCABCAAAACBCBABCAACBCACCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBCBAACCBACBCBCCBBAABCBBBCABCAAAACBCBABCAACBCACCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:2000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCCAACCABCABBACCCABABBACBBCBBAABACBAABCBABACABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe" start= auto displayName= "UserDataSvc_CACCCAACCABCABBACCCABABBACBBCBBAABACBAABCBABACABABB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCCAACCABCABBACCCABABBACBBCBBAABACBAABCBABACABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe" start= auto displayName= "UserDataSvc_CACCCAACCABCABBACCCABABBACBBCBBAABACBAABCBABACABABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCCAACCABCABBACCCABABBACBBCBBAABACBAABCBABACABABB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACCCAACCABCABBACCCABABBACBBCBBAABACBAABCBABACABABB"
    3⤵
    - Launches sc.exe
    PID:1560

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABAABBBCABBBBCCACABAAABAAABACBCBBAABBBBCBABCACBABBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABACCCCAACBBBBACAACCCCCAACCCABCBCACCCCACCABCBBAACCBACACBACCCCCCBABBCABCAACAAABCBBBABABCABBACCCCBABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACCCCAACBBBBACAACCCCCAACCCABCBCACCCCACCABCBBAACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABACCCCAACBBBBACAACCCCCAACCCABCBCACCCCACCABCBBAACCBACACBACCCCCCBABBCABCAACAAABCBBBABABCABBACCCCBABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACCCCAACBBBBACAACCCCCAACCCABCBCACCCCACCABCBBAACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAACABABCBACBACCCBCBBCCCCAACABBAACCCBCCABACCBCACBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACCCCAACBBBBACAACCCCCAACCCABCBCACCCCACCABCBBAACCBA.exe" start= auto displayName= "UserDataSvc_AAACABABCBACBACCCBCBBCCCCAACABBAACCCBCCABACCBCACBAC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAACABABCBACBACCCBCBBCCCCAACABBAACCCBCCABACCBCACBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACCCCAACBBBBACAACCCCCAACCCABCBCACCCCACCABCBBAACCBA.exe" start= auto displayName= "UserDataSvc_AAACABABCBACBACCCBCBBCCCCAACABBAACCCBCCABACCBCACBAC"
    3⤵
    - Launches sc.exe
    PID:2732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAACABABCBACBACCCBCBBCCCCAACABBAACCCBCCABACCBCACBAC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAACABABCBACBACCCBCBBCCCCAACABBAACCCBCCABACCBCACBAC"
    3⤵
    PID:5964

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACACACCAACACABCBBCBBABACAABBCBACABACABAACABBACBCBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACACACCAACACABCBBCBBABACAABBCBACABACABAACABBACBCBAAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACBBCBBBABCCABBBCCACCCCBAACAACBACCBCCCAABCCBABCBCCABACAABCACCCCBAACBCBACBABCCBCACABCACACCBACAAACBCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABACACACABBAACBBBABAAAAAAAAAACBCCCBCBBBBCBCCBBCAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACBBCBBBABCCABBBCCACCCCBAACAACBACCBCCCAABCCBABCBCCABACAABCACCCCBAACBCBACBABCCBCACABCACACCBACAAACBCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABACACACABBAACBBBABAAAAAAAAAACBCCCBCBBBBCBCCBBCAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBACAACBABCBCBCAAACABACBCACACCAABBCBACAABABABCABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABACACACABBAACBBBABAAAAAAAAAACBCCCBCBBBBCBCCBBCAACB.exe" start= auto displayName= "UserDataSvc_CBBACAACBABCBCBCAAACABACBCACACCAABBCBACAABABABCABBC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBACAACBABCBCBCAAACABACBCACACCAABBCBACAABABABCABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABACACACABBAACBBBABAAAAAAAAAACBCCCBCBBBBCBCCBBCAACB.exe" start= auto displayName= "UserDataSvc_CBBACAACBABCBCBCAAACABACBCACACCAABBCBACAABABABCABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBACAACBABCBCBCAAACABACBCACACCAABBCBACAABABABCABBC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBACAACBABCBCBCAAACABACBCACACCAABBCBACAABABABCABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABACACACABBAACBBBABAAAAAAAAAACBCCCBCBBBBCBCCBBCAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABACACACABBAACBBBABAAAAAAAAAACBCCCBCBBBBCBCCBBCAACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCAABACCCACCCBCCCBABCAACBBAAAAABBCCBABAACAAABCCBCBACCBAABCACACCCCBBACCBCBACBCACAABABABBCCCABCCAAAAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABACCCACCCBCCCBABCAACBBAAAAABBCCBABAACAAABCCBCBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCAABACCCACCCBCCCBABCAACBBAAAAABBCCBABAACAAABCCBCBACCBAABCACACCCCBBACCBCBACBCACAABABABBCCCABCCAAAAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABACCCACCCBCCCBABCAACBBAAAAABBCCBABAACAAABCCBCBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCAABACBAAAABAACBCBCACBCCBABCBAAABCBCBAABCABACABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABACCCACCCBCCCBABCAACBBAAAAABBCCBABAACAAABCCBCBACC.exe" start= auto displayName= "UserDataSvc_BBCCAABACBAAAABAACBCBCACBCCBABCBAAABCBCBAABCABACABA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5640
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCAABACBAAAABAACBCBCACBCCBABCBAAABCBCBAABCABACABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABACCCACCCBCCCBABCAACBBAAAAABBCCBABAACAAABCCBCBACC.exe" start= auto displayName= "UserDataSvc_BBCCAABACBAAAABAACBCBCACBCCBABCBAAABCBCBAABCABACABA"
    3⤵
    PID:3220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCAABACBAAAABAACBCBCACBCCBABCBAAABCBCBAABCABACABA"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCAABACBAAAABAACBCBCACBCCBABCBAAABCBCBAABCABACABA"
    3⤵
    PID:2088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACCCCAACBBBBACAACCCCCAACCCABCBCACCCCACCABCBBAACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACCCCAACBBBBACAACCCCCAACCCABCBCACCCCACCABCBBAACCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACBCABACBBACBBCBBCCCCCBAABBBCABACBBABBABCCACBBABAABCBCBBBACBBCBCCCCCCCBABBCBAABBBCBABAABBBABBAABCCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCBCCCACCABAAACABABACABCCAAABCABAAABBBCAABACAAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACBCABACBBACBBCBBCCCCCBAABBBCABACBBABBABCCACBBABAABCBCBBBACBBCBCCCCCCCBABBCBAABBBCBABAABBBABBAABCCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCBCCCACCABAAACABABACABCCAAABCABAAABBBCAABACAAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAABAACBBBCACCACACBCBABCCCBCBBBBBCAACAACABBCABABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCBCCCACCABAAACABABACABCCAAABCABAAABBBCAABACAAACCC.exe" start= auto displayName= "UserDataSvc_CCAABAACBBBCACCACACBCBABCCCBCBBBBBCAACAACABBCABABCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAABAACBBBCACCACACBCBABCCCBCBBBBBCAACAACABBCABABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCBCCCACCABAAACABABACABCCAAABCABAAABBBCAABACAAACCC.exe" start= auto displayName= "UserDataSvc_CCAABAACBBBCACCACACBCBABCCCBCBBBBBCAACAACABBCABABCB"
    3⤵
    - Launches sc.exe
    PID:2644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAABAACBBBCACCACACBCBABCCCBCBBBBBCAACAACABBCABABCB"
  2⤵
  PID:2500
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCAABAACBBBCACCACACBCBABCCCBCBBBBBCAACAACABBCABABCB"
    3⤵
    PID:4560

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCABBAAABACBCBBABAABCBCBCABACCAAABCCAAAAACCBACACACAACABBCBCBCBBABACCABBBABBACCBBBACAACBBACCABACBAABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCCACCBCCCABACCACBCCCBCBCCBCBABACACACBABAAAACAAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCABBAAABACBCBBABAABCBCBCABACCAAABCCAAAAACCBACACACAACABBCBCBCBBABACCABBBABBACCBBBACAACBBACCABACBAABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCCACCBCCCABACCACBCCCBCBCCBCBABACACACBABAAAACAAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:4044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABBBCAAABABAAAAABBACABCCABCACBCCBBACACBBACBBABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCCACCBCCCABACCACBCCCBCBCCBCBABACACACBABAAAACAAACCC.exe" start= auto displayName= "UserDataSvc_BAABBBCAAABABAAAAABBACABCCABCACBCCBBACACBBACBBABAAC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABBBCAAABABAAAAABBACABCCABCACBCCBBACACBBACBBABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCCACCBCCCABACCACBCCCBCBCCBCBABACACACBABAAAACAAACCC.exe" start= auto displayName= "UserDataSvc_BAABBBCAAABABAAAAABBACABCCABCACBCCBBACACBBACBBABAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABBBCAAABABAAAAABBACABCCABCACBCCBBACACBBACBBABAAC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABBBCAAABABAAAAABBACABCCABCACBCCBBACACBBACBBABAAC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5400

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCBBCABBBBCABABBBCCCABACBBBBBBACCCBAAABABCCCACBACBC.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAAACBCCCCBAABCAAAABCABBCBCBBCBACABBACBBBCACACCBACBACBABBCAACCCBCBACBBAABABAACACACABABBBACBAABCCACCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBACBBBBBABCBACACABBCACCBBBBBBBCCABACCBCAAABCAAABBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAAACBCCCCBAABCAAAABCABBCBCBBCBACABBACBBBCACACCBACBACBABBCAACCCBCBACBBAABABAACACACABABBBACBAABCCACCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBACBBBBBABCBACACABBCACCBBBBBBBCCABACCBCAAABCAAABBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBCBCAACAACCBCBCAACBBBABAAABCABBABCACCBCAAAACBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBACBBBBBABCBACACABBCACCBBBBBBBCCABACCBCAAABCAAABBCB.exe" start= auto displayName= "UserDataSvc_CBCBCBCAACAACCBCBCAACBBBABAAABCABBABCACCBCAAAACBBBB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3052
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBCBCAACAACCBCBCAACBBBABAAABCABBABCACCBCAAAACBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBACBBBBBABCBACACABBCACCBBBBBBBCCABACCBCAAABCAAABBCB.exe" start= auto displayName= "UserDataSvc_CBCBCBCAACAACCBCBCAACBBBABAAABCABBABCACCBCAAAACBBBB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBCBCAACAACCBCBCAACBBBABAAABCABBABCACCBCAAAACBBBB"
  2⤵
  PID:1472
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBCBCAACAACCBCBCAACBBBABAAABCABBABCACCBCAAAACBBBB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4196

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABACCCACCCBCCCBABCAACBBAAAAABBCCBABAACAAABCCBCBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABACCCACCCBCCCBABCAACBBAAAAABBCCBABAACAAABCCBCBACC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBABAACCBCABBACBACCAABCACBACAAACABAABCBCCCBBCACBCACCBCACACABBBAACAABACAAAAAAABBBACACBCAAAABAABBBCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBABAACCBCABBACBACCAABCACBACAAACABAABCBCCCBBCACBCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBABAACCBCABBACBACCAABCACBACAAACABAABCBCCCBBCACBCACCBCACACABBBAACAABACAAAAAAABBBACACBCAAAABAABBBCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBABAACCBCABBACBACCAABCACBACAAACABAABCBCCCBBCACBCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:4248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACAAACBACACBBCACABCABCBBBBACBACABABAACAABBCBACAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBABAACCBCABBACBACCAABCACBACAAACABAABCBCCCBBCACBCACC.exe" start= auto displayName= "UserDataSvc_CBACAAACBACACBBCACABCABCBBBBACBACABABAACAABBCBACAAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACAAACBACACBBCACABCABCBBBBACBACABABAACAABBCBACAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBABAACCBCABBACBACCAABCACBACAAACABAABCBCCCBBCACBCACC.exe" start= auto displayName= "UserDataSvc_CBACAAACBACACBBCACABCABCBBBBACBACABABAACAABBCBACAAB"
    3⤵
    - Launches sc.exe
    PID:3492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACAAACBACACBBCACABCABCBBBBACBACABABAACAABBCBACAAB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACAAACBACACBBCACABCABCBBBBACBACABABAACAABBCBACAAB"
    3⤵
    PID:2896

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCCACCBCCCABACCACBCCCBCBCCBCBABACACACBABAAAACAAACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCCACCBCCCABACCACBCCCBCBCCBCBABACACACBABAAAACAAACCC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAAABACCCBABAAAAAAACCBBBACBABBAABCAAAAAAABBCCABAABCABABBCAAAAAAABCCABCAAACCCACCBABBBAABBABACCABBABCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABACCCBABAAAAAAACCBBBACBABBAABCAAAAAAABBCCABAABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAAABACCCBABAAAAAAACCBBBACBABBAABCAAAAAAABBCCABAABCABABBCAAAAAAABCCABCAAACCCACCBABBBAABBABACCABBABCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABACCCBABAAAAAAACCBBBACBABBAABCAAAAAAABBCCABAABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABCBBAACCBABCABACBAAACBCCACAABCBCCBCACCCBCBAACCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABACCCBABAAAAAAACCBBBACBABBAABCAAAAAAABBCCABAABCAB.exe" start= auto displayName= "UserDataSvc_BBABCBBAACCBABCABACBAAACBCCACAABCBCCBCACCCBCBAACCAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBABCBBAACCBABCABACBAAACBCCACAABCBCCBCACCCBCBAACCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABACCCBABAAAAAAACCBBBACBABBAABCAAAAAAABBCCABAABCAB.exe" start= auto displayName= "UserDataSvc_BBABCBBAACCBABCABACBAAACBCCACAABCBCCBCACCCBCBAACCAB"
    3⤵
    PID:3612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABCBBAACCBABCABACBAAACBCCACAABCBCCBCACCCBCBAACCAB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBABCBBAACCBABCABACBAAACBCCACAABCBCCBCACCCBCBAACCAB"
    3⤵
    PID:2796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBABAACCBCABBACBACCAABCACBACAAACABAABCBCCCBBCACBCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBABAACCBCABBACBACCAABCACBACAAACABAABCBCCCBBCACBCACC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCABCABCCAAABBCACCBACABACCAACACCABAAABBCACBCCBBCCAABAABAABABCABCBAABCBCACBBABCABBCBBBCBACBAAAABABAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCBCAAACCAABCABACBCCBCCCBAACBCBBBBACACAAACBACCBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCABCABCCAAABBCACCBACABACCAACACCABAAABBCACBCCBBCCAABAABAABABCABCBAABCBCACBBABCABBCBBBCBACBAAAABABAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCBCAAACCAABCABACBCCBCCCBAACBCBBBBACACAAACBACCBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACAAABBCBABCCCBABABBAAAACACCBAAAABACACABCCCAACACABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCBCAAACCAABCABACBCCBCCCBAACBCBBBBACACAAACBACCBBBA.exe" start= auto displayName= "UserDataSvc_ACAAABBCBABCCCBABABBAAAACACCBAAAABACACABCCCAACACABC"
  2⤵
  PID:2456
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACAAABBCBABCCCBABABBAAAACACCBAAAABACACABCCCAACACABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCBCAAACCAABCABACBCCBCCCBAACBCBBBBACACAAACBACCBBBA.exe" start= auto displayName= "UserDataSvc_ACAAABBCBABCCCBABABBAAAACACCBAAAABACACABCCCAACACABC"
    3⤵
    - Launches sc.exe
    PID:568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACAAABBCBABCCCBABABBAAAACACCBAAAABACACABCCCAACACABC"
  2⤵
  PID:764
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACAAABBCBABCCCBABABBAAAACACCBAAAABACACABCCCAACACABC"
    3⤵
    PID:4464

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBABAACCBCABBACBACCAABCACBACAAACABAABCBCCCBBCACBCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBABAACCBCABBACBACCAABCACBACAAACABAABCBCCCBBCACBCACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAABAACAABABACAACBAABAAACCCBBCCAAAABACBCBCBBCABCACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAABAACAABABACAACBAABAAACCCBBCCAAAABACBCBCBBCABCACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCBBCBABCBABBCCACCACCBCAACCBCCBABCBCABABBAAACAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAAB.exe" start= auto displayName= "UserDataSvc_CABCBBCBABCBABBCCACCACCBCAACCBCCBABCBCABABBAAACAACC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3540
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCBBCBABCBABBCCACCACCBCAACCBCCBABCBCABABBAAACAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAAB.exe" start= auto displayName= "UserDataSvc_CABCBBCBABCBABBCCACCACCBCAACCBCCBABCBCABABBAAACAACC"
    3⤵
    PID:2392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCBBCBABCBABBCCACCACCBCAACCBCCBABCBCABABBAAACAACC"
  2⤵
  PID:5432
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCBBCBABCBABBCCACCACCBCAACCBCCBABCBCABABBAAACAACC"
    3⤵
    - Launches sc.exe
    PID:5860

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABACCCBABAAAAAAACCBBBACBABBAABCAAAAAAABBCCABAABCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABACCCBABAAAAAAACCBBBACBABBAABCAAAAAAABBCCABAABCAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCAAAAAABCAAACAACCBCACCBBACACACBABCAACBBBAABACCBCBABBBBABBBBACCCAACCACBCCBCABBCAABBCBBAABBAAABBAABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACAAACBBBAAACCABACBABABAACCBCBCACCCACACBBCCBCCBBACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCAAAAAABCAAACAACCBCACCBBACACACBABCAACBBBAABACCBCBABBBBABBBBACCCAACCACBCCBCABBCAABBCBBAABBAAABBAABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACAAACBBBAAACCABACBABABAACCBCBCACCCACACBBCCBCCBBACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAAAAACCAAACCACCCBBCBCCACCCBABACAACAABBCBBBCBCBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACAAACBBBAAACCABACBABABAACCBCBCACCCACACBBCCBCCBBACCB.exe" start= auto displayName= "UserDataSvc_BCAAAAACCAAACCACCCBBCBCCACCCBABACAACAABBCBBBCBCBCAC"
  2⤵
  PID:3416
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCAAAAACCAAACCACCCBBCBCCACCCBABACAACAABBCBBBCBCBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACAAACBBBAAACCABACBABABAACCBCBCACCCACACBBCCBCCBBACCB.exe" start= auto displayName= "UserDataSvc_BCAAAAACCAAACCACCCBBCBCCACCCBABACAACAABBCBBBCBCBCAC"
    3⤵
    - Launches sc.exe
    PID:2676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAAAAACCAAACCACCCBBCBCCACCCBABACAACAABBCBBBCBCBCAC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6080
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCAAAAACCAAACCACCCBBCBCCACCCBABACAACAABBCBBBCBCBCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABACCCBABAAAAAAACCBBBACBABBAABCAAAAAAABBCCABAABCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAABACCCBABAAAAAAACCBBBACBABBAABCAAAAAAABBCCABAABCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABABACCBBAABABABBCCBBCABABCBCBCBACCAABCCCACAABABBBCCBABBCBCCABCBBABCACBABCABCACCACAABBCCBABCBCBCCBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABACCBBAABABABBCCBBCABABCBCBCBACCAABCCCACAABABBBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABABACCBBAABABABBCCBBCABABCBCBCBACCAABCCCACAABABBBCCBABBCBCCABCBBABCACBABCABCACCACAABBCCBABCBCBCCBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABACCBBAABABABBCCBBCABABCBCBCBACCAABCCCACAABABBBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACCBCCBCBBCCAACCCCABAABBBCBBBCBCACBBCCCAACCBBABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABACCBBAABABABBCCBBCABABCBCBCBACCAABCCCACAABABBBCCB.exe" start= auto displayName= "UserDataSvc_CAACCBCCBCBBCCAACCCCABAABBBCBBBCBCACBBCCCAACCBBABCC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2400
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAACCBCCBCBBCCAACCCCABAABBBCBBBCBCACBBCCCAACCBBABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABACCBBAABABABBCCBBCABABCBCBCBACCAABCCCACAABABBBCCB.exe" start= auto displayName= "UserDataSvc_CAACCBCCBCBBCCAACCCCABAABBBCBBBCBCACBBCCCAACCBBABCC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAACCBCCBCBBCCAACCCCABAABBBCBBBCBCACBBCCCAACCBBABCC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3276
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAACCBCCBCBBCCAACCCCABAABBBCBBBCBCACBBCCCAACCBBABCC"
    3⤵
    PID:4816

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCBCCCACCABAAACABABACABCCAAABCABAAABBBCAABACAAACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCBCCCACCABAAACABABACABCCAAABCABAAABBBCAABACAAACCC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABACCCBCACBBAAABCAABAAABCCCCBBAAABABABAABBAACAABBABCCCCBBBCABBCBACCAACCACBBCBCCBCBABBBBBBCACACACBCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCCBBABCCAAABBCAAABACACCBBBBCBACAAACAAAABACAAABAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABACCCBCACBBAAABCAABAAABCCCCBBAAABABABAABBAACAABBABCCCCBBBCABBCBACCAACCACBBCBCCBCBABBBBBBCACACACBCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCCBBABCCAAABBCAAABACACCBBBBCBACAAACAAAABACAAABAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAAABCBACBABAACAABABBCABCAABACCCBAAACAAABBCCCAABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCCBBABCCAAABBCAAABACACCBBBBCBACAAACAAAABACAAABAAAA.exe" start= auto displayName= "UserDataSvc_BAAAABCBACBABAACAABABBCABCAABACCCBAAACAAABBCCCAABAA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3568
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAAAABCBACBABAACAABABBCABCAABACCCBAAACAAABBCCCAABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCCBBABCCAAABBCAAABACACCBBBBCBACAAACAAAABACAAABAAAA.exe" start= auto displayName= "UserDataSvc_BAAAABCBACBABAACAABABBCABCAABACCCBAAACAAABBCCCAABAA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAAABCBACBABAACAABABBCABCAABACCCBAAACAAABBCCCAABAA"
  2⤵
  PID:4812
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAAAABCBACBABAACAABABBCABCAABACCCBAAACAAABBCCCAABAA"
    3⤵
    PID:4028

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCBCCCACCABAAACABABACABCCAAABCABAAABBBCAABACAAACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCBCCCACCABAAACABABACABCCAAABCABAAABBBCAABACAAACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBAACAACABCBAABBAACAAABBCBABBBBBBBBCABAACBBBABABCBAACBACBAACCAABACCBCCAABBCBAACACABABBABCCCCBBACBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCAAACCCABACCBCCCCCBACCCCCCCACCCCBAABABAAAAACBCCBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBAACAACABCBAABBAACAAABBCBABBBBBBBBCABAACBBBABABCBAACBACBAACCAABACCBCCAABBCBAACACABABBABCCCCBBACBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCAAACCCABACCBCCCCCBACCCCCCCACCCCBAABABAAAAACBCCBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBCCBABCBACCAACABBCBCACBBBABAAAAABACBBBACBBACACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCAAACCCABACCBCCCCCBACCCCCCCACCCCBAABABAAAAACBCCBAAA.exe" start= auto displayName= "UserDataSvc_ABCBCCBABCBACCAACABBCBCACBBBABAAAAABACBBBACBBACACCC"
  2⤵
  PID:1008
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBCCBABCBACCAACABBCBCACBBBABAAAAABACBBBACBBACACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCAAACCCABACCBCCCCCBACCCCCCCACCCCBAABABAAAAACBCCBAAA.exe" start= auto displayName= "UserDataSvc_ABCBCCBABCBACCAACABBCBCACBBBABAAAAABACBBBACBBACACCC"
    3⤵
    PID:5188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBCCBABCBACCAACABBCBCACBBBABAAAAABACBBBACBBACACCC"
  2⤵
  PID:5112
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBCCBABCBACCAACABBCBCACBBBABAAAAABACBBBACBBACACCC"
    3⤵
    PID:1504

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBACBBBBBABCBACACABBCACCBBBBBBBCCABACCBCAAABCAAABBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBACBBBBBABCBACACABBCACCBBBBBBBCCABACCBCAAABCAAABBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAACACBBCCABACABCABBAAABCACABCCCBAACABABABACCABACBAAAAABABBBBBBABABBAABCAACBBBCCBAABABCABCAABCBBCCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACACBBCCABACABCABBAAABCACABCCCBAACABABABACCABACBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAACACBBCCABACABCABBAAABCACABCCCBAACABABABACCABACBAAAAABABBBBBBABABBAABCAACBBBCCBAABABCABCAABCBBCCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACACBBCCABACABCABBAAABCACABCCCBAACABABABACCABACBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAABBCBACCABCAACBBACCCCACBBCBBBBCBBACCBCCBCABBABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACACBBCCABACABCABBAAABCACABCCCBAACABABABACCABACBAAA.exe" start= auto displayName= "UserDataSvc_CBAABBCBACCABCAACBBACCCCACBBCBBBBCBBACCBCCBCABBABBA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6884
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAABBCBACCABCAACBBACCCCACBBCBBBBCBBACCBCCBCABBABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACACBBCCABACABCABBAAABCACABCCCBAACABABABACCABACBAAA.exe" start= auto displayName= "UserDataSvc_CBAABBCBACCABCAACBBACCCCACBBCBBBBCBBACCBCCBCABBABBA"
    3⤵
    PID:7128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAABBCBACCABCAACBBACCCCACBBCBBBBCBBACCBCCBCABBABBA"
  2⤵
  PID:4724
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAABBCBACCABCAACBBACCCCACBBCBBBBCBBACCBCCBCABBABBA"
    3⤵
    PID:6992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBACBBBBBABCBACACABBCACCBBBBBBBCCABACCBCAAABCAAABBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBACBBBBBABCBACACABBCACCBBBBBBBCCABACCBCAAABCAAABBCB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACACCCBAABCAAACABACACCCBBCCAACACCABBBBBBCBACBABAABCBCBBAAABAAAACBAACCAACACCABBABBBBABBCABAAAABACCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACACCCBAABCAAACABACACCCBBCCAACACCABBBBBBCBACBABAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACACCCBAABCAAACABACACCCBBCCAACACCABBBBBBCBACBABAABCBCBBAAABAAAACBAACCAACACCABBABBBBABBCABAAAABACCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACACCCBAABCAAACABACACCCBBCCAACACCABBBBBBCBACBABAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAACABCBACCABBACAAACCBCCAABCCACAACCAABBACAAACCABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACACCCBAABCAAACABACACCCBBCCAACACCABBBBBBCBACBABAABCB.exe" start= auto displayName= "UserDataSvc_BCAACABCBACCABBACAAACCBCCAABCCACAACCAABBACAAACCABCC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5484
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCAACABCBACCABBACAAACCBCCAABCCACAACCAABBACAAACCABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACACCCBAABCAAACABACACCCBBCCAACACCABBBBBBCBACBABAABCB.exe" start= auto displayName= "UserDataSvc_BCAACABCBACCABBACAAACCBCCAABCCACAACCAABBACAAACCABCC"
    3⤵
    PID:4608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAACABCBACCABBACAAACCBCCAABCCACAACCAABBACAAACCABCC"
  2⤵
  PID:4212
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCAACABCBACCABBACAAACCBCCAABCCACAACCAABBACAAACCABCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4596

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCBCAAACCAABCABACBCCBCCCBAACBCBBBBACACAAACBACCBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCBCAAACCAABCABACBCCBCCCBAACBCBBBBACACAAACBACCBBBA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCAABCABBBBAAABCBBCBCCBABCBBCCAACBCBCCCCACCAABCABABBCCCCCAAAABCCCBACABCCAACBCACABACBBCABBAACBABACBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAACAABCBCACAABBAAAABBCBCCBBBABBABACCABBABCAABABACABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCAABCABBBBAAABCBBCBCCBABCBBCCAACBCBCCCCACCAABCABABBCCCCCAAAABCCCBACABCCAACBCACABACBBCABBAACBABACBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAACAABCBCACAABBAAAABBCBCCBBBABBABACCABBABCAABABACABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABBCBAACBCABCBBCBCACBBBBABCBABCCCABBCCABABAAAABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAACAABCBCACAABBAAAABBCBCCBBBABBABACCABBABCAABABACABB.exe" start= auto displayName= "UserDataSvc_BAABBCBAACBCABCBBCBCACBBBBABCBABCCCABBCCABABAAAABAA"
  2⤵
  PID:5420
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABBCBAACBCABCBBCBCACBBBBABCBABCCCABBCCABABAAAABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAACAABCBCACAABBAAAABBCBCCBBBABBABACCABBABCAABABACABB.exe" start= auto displayName= "UserDataSvc_BAABBCBAACBCABCBBCBCACBBBBABCBABCCCABBCCABABAAAABAA"
    3⤵
    - Launches sc.exe
    PID:4580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABBCBAACBCABCBBCBCACBBBBABCBABCCCABBCCABABAAAABAA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2284
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABBCBAACBCABCBBCBCACBBBBABCBABCCCABBCCABABAAAABAA"
    3⤵
    PID:3804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCCAAABCCBABAACBBCBCBBBACACCCABAAABCACBBCCAACCABAACCACCACACCCCBBCBACACAABBABBACAAABCCCBACBBCCBBCBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCCCCABBACCCBBCBACCBBACCACCCBCCABACACBCCAABBACBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCCAAABCCBABAACBBCBCBBBACACCCABAAABCACBBCCAACCABAACCACCACACCCCBBCBACACAABBABBACAAABCCCBACBBCCBBCBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCCCCABBACCCBBCBACCBBACCACCCBCCABACACBCCAABBACBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCAAABAAABBCBBAACCCACBCBCBCABBAAABCBAAABBCCCCCCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCCCCABBACCCBBCBACCBBACCACCCBCCABACACBCCAABBACBACBA.exe" start= auto displayName= "UserDataSvc_ACCAAABAAABBCBBAACCCACBCBCBCABBAAABCBAAABBCCCCCCCAA"
  2⤵
  PID:5288
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCAAABAAABBCBBAACCCACBCBCBCABBAAABCBAAABBCCCCCCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCCCCABBACCCBBCBACCBBACCACCCBCCABACACBCCAABBACBACBA.exe" start= auto displayName= "UserDataSvc_ACCAAABAAABBCBBAACCCACBCBCBCABBAAABCBAAABBCCCCCCCAA"
    3⤵
    PID:6128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCAAABAAABBCBBAACCCACBCBCBCABBAAABCBAAABBCCCCCCCAA"
  2⤵
  PID:1092
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCAAABAAABBCBBAACCCACBCBCBCABBAAABCBAAABBCCCCCCCAA"
    3⤵
    - Launches sc.exe
    PID:3148

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCCCAABABABABCCBAACCBCCBAACCACCABAACAABCBCCCABBBAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACCABACBBCAACBABCBBAABCACAAACCABCBCACCBACACBBABBBBABAABCAABCBCBBBBAAAABCCAACBCBCBABAABCAABCCCAAABCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCCBCBABCBABBABCBBBBBCAAACABABCAAABBCBBACBBBACCCCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACCABACBBCAACBABCBBAABCACAAACCABCBCACCBACACBBABBBBABAABCAABCBCBBBBAAAABCCAACBCBCBABAABCAABCCCAAABCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCCBCBABCBABBABCBBBBBCAAACABABCAAABBCBBACBBBACCCCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACABBBAACBCAAAAAAABABACBCABACBABCCBBCACCBBBBACCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCCBCBABCBABBABCBBBBBCAAACABABCAAABBCBBACBBBACCCCBCC.exe" start= auto displayName= "UserDataSvc_BACABBBAACBCAAAAAAABABACBCABACBABCCBBCACCBBBBACCACB"
  2⤵
  PID:4272
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACABBBAACBCAAAAAAABABACBCABACBABCCBBCACCBBBBACCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCCBCBABCBABBABCBBBBBCAAACABABCAAABBCBBACBBBACCCCBCC.exe" start= auto displayName= "UserDataSvc_BACABBBAACBCAAAAAAABABACBCABACBABCCBBCACCBBBBACCACB"
    3⤵
    PID:408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACABBBAACBCAAAAAAABABACBCABACBABCCBBCACCBBBBACCACB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1740
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACABBBAACBCAAAAAAABABACBCABACBABCCBBCACCBBBBACCACB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4580

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACACCCBAABCAAACABACACCCBBCCAACACCABBBBBBCBACBABAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACACCCBAABCAAACABACACCCBBCCAACACCABBBBBBCBACBABAABCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACAAAAAACAACBCBBACBCACCCCBBACCACABCCCACACCACCBCABCABAACCCBBACBAAABBBCAABBCBACBCCCABAACABCBCCCABCCCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCCABCACBBAAABCAABCAABBCBBCABABACAACCABCAAACAABCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACAAAAAACAACBCBBACBCACCCCBBACCACABCCCACACCACCBCABCABAACCCBBACBAAABBBCAABBCBACBCCCABAACABCBCCCABCCCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCCABCACBBAAABCAABCAABBCBBCABABACAACCABCAAACAABCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABAAACCCAACCBCCAABBCACBBAACBCBBABBBCAAABBCBCBCCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCCABCACBBAAABCAABCAABBCBBCABABACAACCABCAAACAABCBBC.exe" start= auto displayName= "UserDataSvc_BABAAACCCAACCBCCAABBCACBBAACBCBBABBBCAAABBCBCBCCACA"
  2⤵
  PID:7292
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABAAACCCAACCBCCAABBCACBBAACBCBBABBBCAAABBCBCBCCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCCABCACBBAAABCAABCAABBCBBCABABACAACCABCAAACAABCBBC.exe" start= auto displayName= "UserDataSvc_BABAAACCCAACCBCCAABBCACBBAACBCBBABBBCAAABBCBCBCCACA"
    3⤵
    - Launches sc.exe
    PID:7452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABAAACCCAACCBCCAABBCACBBAACBCBBABBBCAAABBCBCBCCACA"
  2⤵
  PID:7584
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABAAACCCAACCBCCAABBCACBBAACBCBBABBBCAAABBCBCBCCACA"
    3⤵
    - Launches sc.exe
    PID:7712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACAAACBBBAAACCABACBABABAACCBCBCACCCACACBBCCBCCBBACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACAAACBBBAAACCABACBABABAACCBCBCACCCACACBBCCBCCBBACCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCABBAAACACCCABAAACCAAAAAACCCBCAACCBAABBAABACABCBBAACBCCBABCCCBACACAAABCABABCACCABCCCACCBACBABABBAAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCCBCABCBBCABCCCBAAACACBBCCAAABBBABCBBBCCACACACAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCABBAAACACCCABAAACCAAAAAACCCBCAACCBAABBAABACABCBBAACBCCBABCCCBACACAAABCABABCACCABCCCACCBACBABABBAAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCCBCABCBBCABCCCBAAACACBBCCAAABBBABCBBBCCACACACAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABACCCCABCBCBBCBCCABBAACBBCBBBAACABCBBBBCBACBBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCCBCABCBBCABCCCBAAACACBBCCAAABBBABCBBBCCACACACAABB.exe" start= auto displayName= "UserDataSvc_ACABACCCCABCBCBBCBCCABBAACBBCBBBAACABCBBBBCBACBBACB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3580
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABACCCCABCBCBBCBCCABBAACBBCBBBAACABCBBBBCBACBBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCCBCABCBBCABCCCBAAACACBBCCAAABBBABCBBBCCACACACAABB.exe" start= auto displayName= "UserDataSvc_ACABACCCCABCBCBBCBCCABBAACBBCBBBAACABCBBBBCBACBBACB"
    3⤵
    - Launches sc.exe
    PID:4044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABACCCCABCBCBBCBCCABBAACBBCBBBAACABCBBBBCBACBBACB"
  2⤵
  PID:1524
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABACCCCABCBCBBCBCCABBAACBBCBBBAACABCBBBBCBACBBACB"
    3⤵
    - Launches sc.exe
    PID:5416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABACCBBAABABABBCCBBCABABCBCBCBACCAABCCCACAABABBBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABACCBBAABABABBCCBBCABABCBCBCBACCAABCCCACAABABBBCCB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBABAABAABAACAABBBBBCAABACCCABAACBCABBCBCABCBABCABCCBBAACBACABBCCBABCBBACCAABABCBBBCAACAABCACCBCCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABAABAABAACAABBBBBCAABACCCABAACBCABBCBCABCBABCABCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBABAABAABAACAABBBBBCAABACCCABAACBCABBCBCABCBABCABCCBBAACBACABBCCBABCBBACCAABABCBBBCAACAABCACCBCCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABAABAABAACAABBBBBCAABACCCABAACBCABBCBCABCBABCABCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCCCAABBACAACCCCBBAAAAACBCBCCBABBACCABAABACCCCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABAABAABAACAABBBBBCAABACCCABAACBCABBCBCABCBABCABCCB.exe" start= auto displayName= "UserDataSvc_ABCCCCAABBACAACCCCBBAAAAACBCBCCBABBACCABAABACCCCBBA"
  2⤵
  PID:6212
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCCCCAABBACAACCCCBBAAAAACBCBCCBABBACCABAABACCCCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABAABAABAACAABBBBBCAABACCCABAACBCABBCBCABCBABCABCCB.exe" start= auto displayName= "UserDataSvc_ABCCCCAABBACAACCCCBBAAAAACBCBCCBABBACCABAABACCCCBBA"
    3⤵
    - Launches sc.exe
    PID:6264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCCCCAABBACAACCCCBBAAAAACBCBCCBABBACCABAABACCCCBBA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6288
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCCCCAABBACAACCCCBBAAAAACBCBCCBABBACCABAABACCCCBBA"
    3⤵
    PID:6332

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAACAABCBCACAABBAAAABBCBCCBBBABBABACCABBABCAABABACABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAACAABCBCACAABBAAAABBCBCCBBBABBABACCABBABCAABABACABB.exe
1⤵
- Executes dropped EXE
PID:4944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBABBBBCCCCACBCCABBBBCABAACABBAACACBAACACBBBBAABACCCBCCAACCAAACAAAABBBCBCCBBBBACCBACACCCBCACCCAABABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCBAAABAACBCCBCBBCACBCAABAABBCCACBBCAABABABACBBBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBABBBBCCCCACBCCABBBBCABAACABBAACACBAACACBBBBAABACCCBCCAACCAAACAAAABBBCBCCBBBBACCBACACCCBCACCCAABABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCBAAABAACBCCBCBBCACBCAABAABBCCACBBCAABABABACBBBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCCBAACAACBBBCACCCCCABCAABCABABCCBABACBCCBCCCBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCBAAABAACBCCBCBBCACBCAABAABBCCACBBCAABABABACBBBCCA.exe" start= auto displayName= "UserDataSvc_CBBCCBAACAACBBBCACCCCCABCAABCABABCCBABACBCCBCCCBCBA"
  2⤵
  PID:8104
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCCBAACAACBBBCACCCCCABCAABCABABCCBABACBCCBCCCBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCBAAABAACBCCBCBBCACBCAABAABBCCACBBCAABABABACBBBCCA.exe" start= auto displayName= "UserDataSvc_CBBCCBAACAACBBBCACCCCCABCAABCABABCCBABACBCCBCCCBCBA"
    3⤵
    PID:8144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCCBAACAACBBBCACCCCCABCAABCABABCCBABACBCCBCCCBCBA"
  2⤵
  PID:8160
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCCBAACAACBBBCACCCCCABCAABCABABCCBABACBCCBCCCBCBA"
    3⤵
    - Launches sc.exe
    PID:4196

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCCCCABBACCCBBCBACCBBACCACCCBCCABACACBCCAABBACBACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCCCCABBACCCBBCBACCBBACCACCCBCCABACACBCCAABBACBACBA.exe
1⤵
- Executes dropped EXE
PID:2960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABABABACCABABABABCCBBCACCBCBAAABCBBACBCBAACCBABBBACCBAACABBCAAACABBCBBCABCABBBABCCBABCCCCACACACBBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACCCBBCBBBBACCBAACAACCCABBACCBABBCAACCABCCBCCCCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABABABACCABABABABCCBBCACCBCBAAABCBBACBCBAACCBABBBACCBAACABBCAAACABBCBBCABCABBBABCCBABCCCCACACACBBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACCCBBCBBBBACCBAACAACCCABBACCBABBCAACCABCCBCCCCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCBBCCCAAABABCCCCACCCAAABACAABCCBBABCABCCAABBBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACCCBBCBBBBACCBAACAACCCABBACCBABBCAACCABCCBCCCCACB.exe" start= auto displayName= "UserDataSvc_CBBCBBCCCAAABABCCCCACCCAAABACAABCCBBABCABCCAABBBCBA"
  2⤵
  PID:3892
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCBBCCCAAABABCCCCACCCAAABACAABCCBBABCABCCAABBBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACCCBBCBBBBACCBAACAACCCABBACCBABBCAACCABCCBCCCCACB.exe" start= auto displayName= "UserDataSvc_CBBCBBCCCAAABABCCCCACCCAAABACAABCCBBABCABCCAABBBCBA"
    3⤵
    - Launches sc.exe
    PID:7512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCBBCCCAAABABCCCCACCCAAABACAABCCBBABCABCCAABBBCBA"
  2⤵
  PID:6028
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCBBCCCAAABABCCCCACCCAAABACAABCCBBABCABCCAABBBCBA"
    3⤵
    PID:2052

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCCCCABBACCCBBCBACCBBACCACCCBCCABACACBCCAABBACBACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCCCCABBACCCBBCBACCBBACCACCCBCCABACACBCCAABBACBACBA.exe
1⤵
- Executes dropped EXE
PID:2604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCACBBBCBCBCBCACBBAAAAAABBCABACAACCCBACABCCCACCBCBCCBBCACBBAACCBACCABCABBACBCCACABBABCBBAAAAAACABBACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBBBCBCBCBCACBBAAAAAABBCABACAACCCBACABCCCACCBCBCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCACBBBCBCBCBCACBBAAAAAABBCABACAACCCBACABCCCACCBCBCCBBCACBBAACCBACCABCABBACBCCACABBABCBBAAAAAACABBACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBBBCBCBCBCACBBAAAAAABBCABACAACCCBACABCCCACCBCBCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBBBBCBCBACCCCCBCABCCBACABAAAAACCABAACCAAABCAACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBBBCBCBCBCACBBAAAAAABBCABACAACCCBACABCCCACCBCBCCBB.exe" start= auto displayName= "UserDataSvc_CBCBBBBCBCBACCCCCBCABCCBACABAAAAACCABAACCAAABCAACCC"
  2⤵
  PID:5804
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBBBBCBCBACCCCCBCABCCBACABAAAAACCABAACCAAABCAACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBBBCBCBCBCACBBAAAAAABBCABACAACCCBACABCCCACCBCBCCBB.exe" start= auto displayName= "UserDataSvc_CBCBBBBCBCBACCCCCBCABCCBACABAAAAACCABAACCAAABCAACCC"
    3⤵
    PID:3884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBBBBCBCBACCCCCBCABCCBACABAAAAACCABAACCAAABCAACCC"
  2⤵
  PID:8340
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBBBBCBCBACCCCCBCABCCBACABAAAAACCABAACCAAABCAACCC"
    3⤵
    PID:8608

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCCBCBABCBABBABCBBBBBCAAACABABCAAABBCBBACBBBACCCCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCCBCBABCBABBABCBBBBBCAAACABABCAAABBCBBACBBBACCCCBCC.exe
1⤵
- Executes dropped EXE
PID:3244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCCBBBBACBCACBCCBACCCABCABCACABAABCBCCBBCCCCCCACCBCCBBCABCAABCBBAACABACCBCCCACCABBABAACAABABBCCBBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACACBABCACCCCBABABAACBBBCCABBBAABBCCAAACCCCCCABCCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCCBBBBACBCACBCCBACCCABCABCACABAABCBCCBBCCCCCCACCBCCBBCABCAABCBBAACABACCBCCCACCABBABAACAABABBCCBBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACACBABCACCCCBABABAACBBBCCABBBAABBCCAAACCCCCCABCCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACAABBAABBCCBBCBAACBACABCABBCCBBBACCBCABCBABBAABAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACACBABCACCCCBABABAACBBBCCABBBAABBCCAAACCCCCCABCCACB.exe" start= auto displayName= "UserDataSvc_ACAABBAABBCCBBCBAACBACABCABBCCBBBACCBCABCBABBAABAAB"
  2⤵
  PID:9668
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACAABBAABBCCBBCBAACBACABCABBCCBBBACCBCABCBABBAABAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACACBABCACCCCBABABAACBBBCCABBBAABBCCAAACCCCCCABCCACB.exe" start= auto displayName= "UserDataSvc_ACAABBAABBCCBBCBAACBACABCABBCCBBBACCBCABCBABBAABAAB"
    3⤵
    - Launches sc.exe
    PID:9392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCCBBABCCAAABBCAAABACACCBBBBCBACAAACAAAABACAAABAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCCBBABCCAAABBCAAABACACCBBBBCBACAAACAAAABACAAABAAAA.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCBCCBBAABBBCBABCCCACBAACBAABBBBBCBCCBACCACCCCCACACCCBAABCAAAABCBBCACCACAABBCBABACCBCAABCBBBCBBCCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCCBBAABBBCBABCCCACBAACBAABBBBBCBCCBACCACCCCCACACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCBCCBBAABBBCBABCCCACBAACBAABBBBBCBCCBACCACCCCCACACCCBAABCAAAABCBBCACCACAABBCBABACCBCAABCBBBCBBCCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCCBBAABBBCBABCCCACBAACBAABBBBBCBCCBACCACCCCCACACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCBBACBAABAACBBACAACCCCBABBCBBBBBBACCBBAACCBBBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCCBBAABBBCBABCCCACBAACBAABBBBBCBCCBACCACCCCCACACCC.exe" start= auto displayName= "UserDataSvc_CBBCBBACBAABAACBBACAACCCCBABBCBBBBBBACCBBAACCBBBABB"
  2⤵
  PID:7008
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCBBACBAABAACBBACAACCCCBABBCBBBBBBACCBBAACCBBBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCCBBAABBBCBABCCCACBAACBAABBBBBCBCCBACCACCCCCACACCC.exe" start= auto displayName= "UserDataSvc_CBBCBBACBAABAACBBACAACCCCBABBCBBBBBBACCBBAACCBBBABB"
    3⤵
    - Launches sc.exe
    PID:6640

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCAAACCCABACCBCCCCCBACCCCCCCACCCCBAABABAAAAACBCCBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCAAACCCABACCBCCCCCBACCCCCCCACCCCBAABABAAAAACBCCBAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBCAABBABBBACCCACCABCCCCABACAACCCBBCBCACBCCBCCBBBCABABACBCACBBBABBCACCBCCABCCBCBAAAABBACAACBAAABBBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAACAABACCBAACABCBABCBBBABABCCBACCBACBCBCCBBABBBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBCAABBABBBACCCACCABCCCCABACAACCCBBCBCACBCCBCCBBBCABABACBCACBBBABBCACCBCCABCCBCBAAAABBACAACBAAABBBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAACAABACCBAACABCBABCBBBABABCCBACCBACBCBCCBBABBBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCBBCABBBCAAACAAACAAACCCACABAACCCCBCAACAAACCBBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAACAABACCBAACABCBABCBBBABABCCBACCBACBCBCCBBABBBBCA.exe" start= auto displayName= "UserDataSvc_CACCBBCABBBCAAACAAACAAACCCACABAACCCCBCAACAAACCBBCCB"
  2⤵
  PID:6732
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCBBCABBBCAAACAAACAAACCCACABAACCCCBCAACAAACCBBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAACAABACCBAACABCBABCBBBABABCCBACCBACBCBCCBBABBBBCA.exe" start= auto displayName= "UserDataSvc_CACCBBCABBBCAAACAAACAAACCCACABAACCCCBCAACAAACCBBCCB"
    3⤵
    - Launches sc.exe
    PID:6692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCBBCABBBCAAACAAACAAACCCACABAACCCCBCAACAAACCBBCCB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6788
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACCBBCABBBCAAACAAACAAACCCACABAACCCCBCAACAAACCBBCCB"
    3⤵
    PID:7092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCCBBABCCAAABBCAAABACACCBBBBCBACAAACAAAABACAAABAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCCBBABCCAAABBCAAABACACCBBBBCBACAAACAAAABACAAABAAAA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCBBBCCCCCCBCCACACCCABABCBBCCACCCCCBBCCCCCCABACBCBACBAAACABCCBBCCAABAACCBBAAACCCBBACBCBCABCABCBCBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBACACABABABBABBCBCCBAABCCACBCACBABAAAAACACBACACAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCBBBCCCCCCBCCACACCCABABCBBCCACCCCCBBCCCCCCABACBCBACBAAACABCCBBCCAABAACCBBAAACCCBBACBCBCABCABCBCBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBACACABABABBABBCBCCBAABCCACBCACBABAAAAACACBACACAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCBCACCBBACAACCABABABAACABBACACAAABBAACBBCBABACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBACACABABABBABBCBCCBAABCCACBCACBABAAAAACACBACACAAAC.exe" start= auto displayName= "UserDataSvc_BACCBCACCBBACAACCABABABAACABBACACAAABBAACBBCBABACCA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6900
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCBCACCBBACAACCABABABAACABBACACAAABBAACBBCBABACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBACACABABABBABBCBCCBAABCCACBCACBABAAAAACACBACACAAAC.exe" start= auto displayName= "UserDataSvc_BACCBCACCBBACAACCABABABAACABBACACAAABBAACBBCBABACCA"
    3⤵
    - Launches sc.exe
    PID:7136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCBCACCBBACAACCABABABAACABBACACAAABBAACBBCBABACCA"
  2⤵
  PID:6616
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCBCACCBBACAACCABABABAACABBACACAAABBAACBBCBABACCA"
    3⤵
    - Launches sc.exe
    PID:7204

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCAAACCCABACCBCCCCCBACCCCCCCACCCCBAABABAAAAACBCCBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCAAACCCABACCBCCCCCBACCCCCCCACCCCBAABABAAAAACBCCBAAA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCAAACCCCACABABCBCCCCACABCBCCABCBCABCBCBACACBCCACAAABBCBCCCBAACBACCAACBBBABCAABABCCACCACBACBAABCAABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABAABAACCACABBCBAABBCBABABBABABACBBCBCCCACABCAABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCAAACCCCACABABCBCCCCACABCBCCABCBCABCBCBACACBCCACAAABBCBCCCBAACBACCAACBBBABCAABABCCACCACBACBAABCAABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABAABAACCACABBCBAABBCBABABBABABACBBCBCCCACABCAABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAAABABABABBCCBCBACBABACAACABCCAABACBABBAACCBCBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABAABAACCACABBCBAABBCBABABBABABACBBCBCCCACABCAABAAB.exe" start= auto displayName= "UserDataSvc_BAAAABABABABBCCBCBACBABACAACABCCAABACBABBAACCBCBCCB"
  2⤵
  PID:6712
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAAAABABABABBCCBCBACBABACAACABCCAABACBABBAACCBCBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABAABAACCACABBCBAABBCBABABBABABACBBCBCCCACABCAABAAB.exe" start= auto displayName= "UserDataSvc_BAAAABABABABBCCBCBACBABACAACABCCAABACBABBAACCBCBCCB"
    3⤵
    PID:3024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAAABABABABBCCBCBACBABACAACABCCAABACBABBAACCBCBCCB"
  2⤵
  PID:7012
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAAAABABABABBCCBCBACBABACAACABCCAABACBABBAACCBCBCCB"
    3⤵
    PID:7308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCCBCABCBBCABCCCBAAACACBBCCAAABBBABCBBBCCACACACAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCCBCABCBBCABCCCBAAACACBBCCAAABBBABCBBBCCACACACAABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:5908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCACBBBCABBCABCBCACBBBACBBCAABBCABCABCCBBACCABABCCBBAAAACCACCACBCCAAAABCBAABABCBBACAABACBABBABBABCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACAACCBBCAABACCBABBCCABABABABCBAAAABABCBBBCAABAACBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCACBBBCABBCABCBCACBBBACBBCAABBCABCABCCBBACCABABCCBBAAAACCACCACBCCAAAABCBAABABCBBACAABACBABBABBABCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACAACCBBCAABACCBABBCCABABABABCBAAAABABCBBBCAABAACBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCCBABBBBCCCCCAACCBCBAAAAAAABCABCCBCBCBBBAABBCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACAACCBBCAABACCBABBCCABABABABCBAAAABABCBBBCAABAACBBC.exe" start= auto displayName= "UserDataSvc_ABBCCBABBBBCCCCCAACCBCBAAAAAAABCABCCBCBCBBBAABBCCBB"
  2⤵
  PID:7196
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBCCBABBBBCCCCCAACCBCBAAAAAAABCABCCBCBCBBBAABBCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACAACCBBCAABACCBABBCCABABABABCBAAAABABCBBBCAABAACBBC.exe" start= auto displayName= "UserDataSvc_ABBCCBABBBBCCCCCAACCBCBAAAAAAABCABCCBCBCBBBAABBCCBB"
    3⤵
    - Launches sc.exe
    PID:7420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBCCBABBBBCCCCCAACCBCBAAAAAAABCABCCBCBCBBBAABBCCBB"
  2⤵
  PID:7480
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBCCBABBBBCCCCCAACCBCBAAAAAAABCABCCBCBCBBBAABBCCBB"
    3⤵
    PID:7668

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCCBCABCBBCABCCCBAAACACBBCCAAABBBABCBBBCCACACACAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCCBCABCBBCABCCCBAAACACBBCCAAABBBABCBBBCCACACACAABB.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBAABBCBBAACBAAAABBCACCBACBCCCCBBBCABACCBCABCCBBBBABBBCABBBCCBCCAAAACBACCCAACACCCACABBCCAACACACABCCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABABBCCBBBABACABABABBCACCCBBBABBCCACCCACAAABCACABBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBAABBCBBAACBAAAABBCACCBACBCCCCBBBCABACCBCABCCBBBBABBBCABBBCCBCCAAAACBACCCAACACCCACABBCCAACACACABCCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABABBCCBBBABACABABABBCACCCBBBABBCCACCCACAAABCACABBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBBCBABBCBBAABBABABABBCBACAABBBCACCCBCBCCCCACCBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABABBCCBBBABACABABABBCACCCBBBABBCCACCCACAAABCACABBBA.exe" start= auto displayName= "UserDataSvc_CBBBCBABBCBBAABBABABABBCBACAABBBCACCCBCBCCCCACCBBAB"
  2⤵
  PID:7332
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBBCBABBCBBAABBABABABBCBACAABBBCACCCBCBCCCCACCBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABABBCCBBBABACABABABBCACCCBBBABBCCACCCACAAABCACABBBA.exe" start= auto displayName= "UserDataSvc_CBBBCBABBCBBAABBABABABBCBACAABBBCACCCBCBCCCCACCBBAB"
    3⤵
    - Launches sc.exe
    PID:7488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBBCBABBCBBAABBABABABBCBACAABBBCACCCBCBCCCCACCBBAB"
  2⤵
  PID:7612
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBBCBABBCBBAABBABABABBCBACAABBBCACCCBCBCCCCACCBBAB"
    3⤵
    PID:7720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABAABAABAACAABBBBBCAABACCCABAACBCABBCBCABCBABCABCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABAABAABAACAABBBBBCAABACCCABAACBCABBCBCABCBABCABCCB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBCBCBBCCCBACBACBCBBBBBCBAACABBBBCBABACBBCBBCACCAABBABACAAACABCAABABBBBBBCBCBACCBABBABCBCBCACCCBAACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCBBCCCBACBACBCBBBBBCBAACABBBBCBABACBBCBBCACCAABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBCBCBBCCCBACBACBCBBBBBCBAACABBBBCBABACBBCBBCACCAABBABACAAACABCAABABBBBBBCBCBACCBABBABCBCBCACCCBAACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCBBCCCBACBACBCBBBBBCBAACABBBBCBABACBBCBBCACCAABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCBCBBBCBCCCBCABAAAACACBBAAACBABAABACACCBABCAAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCBBCCCBACBACBCBBBBBCBAACABBBBCBABACBBCBBCACCAABBA.exe" start= auto displayName= "UserDataSvc_AACCBCBBBCBCCCBCABAAAACACBBAAACBABAABACACCBABCAAACB"
  2⤵
  PID:7164
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCBCBBBCBCCCBCABAAAACACBBAAACBABAABACACCBABCAAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCBBCCCBACBACBCBBBBBCBAACABBBBCBABACBBCBBCACCAABBA.exe" start= auto displayName= "UserDataSvc_AACCBCBBBCBCCCBCABAAAACACBBAAACBABAABACACCBABCAAACB"
    3⤵
    PID:6536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCBCBBBCBCCCBCABAAAACACBBAAACBABAABACACCBABCAAACB"
  2⤵
  PID:4352
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCBCBBBCBCCCBCABAAAACACBBAAACBABAABACACCBABCAAACB"
    3⤵
    PID:6240

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABAABAABAACAABBBBBCAABACCCABAACBCABBCBCABCBABCABCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABAABAABAACAABBBBBCAABACCCABAACBCABBCBCABCBABCABCCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCACBBBCABACCABCBCCBCCCBABACCBCBCBABCCBBAABABBAACBBBCCCCACBABBABCCACBCACAAAABBBABABACABBAAAACCBCCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAACBAAACACBCABBCCABAACBBACBBAACABAABAAACCCBBBCCABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCACBBBCABACCABCBCCBCCCBABACCBCBCBABCCBBAABABBAACBBBCCCCACBABBABCCACBCACAAAABBBABABACABBAAAACCBCCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAACBAAACACBCABBCCABAACBBACBBAACABAABAAACCCBBBCCABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCBBACBAABAACBBACAACCCCBABBCBBBBBBACCBBAACCBBBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAACBAAACACBCABBCCABAACBBACBBAACABAABAAACCCBBBCCABAAB.exe" start= auto displayName= "UserDataSvc_CBBCBBACBAABAACBBACAACCCCBABBCBBBBBBACCBBAACCBBBABB"
  2⤵
  PID:7000
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCBBACBAABAACBBACAACCCCBABBCBBBBBBACCBBAACCBBBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAACBAAACACBCABBCCABAACBBACBBAACABAABAAACCCBBBCCABAAB.exe" start= auto displayName= "UserDataSvc_CBBCBBACBAABAACBBACAACCCCBABBCBBBBBBACCBBAACCBBBABB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCBBACBAABAACBBACAACCCCBABBCBBBBBBACCBBAACCBBBABB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7036
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCBBACBAABAACBBACAACCCCBABBCBBBBBBACCBBAACCBBBABB"
    3⤵
    PID:6684

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACACBBCCABACABCABBAAABCACABCCCBAACABABABACCABACBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACACBBCCABACABCABBAAABCACABCCCBAACABABABACCABACBAAA.exe
1⤵
- Executes dropped EXE
PID:6784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABBCABABBABBCCCBCACBBBCCBBBCBACBABACCBCBBCBAACCBBACACCABAACBABCBCCBCAAAACACCACACCACBABBBCCABBCBCBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCABABBABBCCCBCACBBBCCBBBCBACBABACCBCBBCBAACCBBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABBCABABBABBCCCBCACBBBCCBBBCBACBABACCBCBBCBAACCBBACACCABAACBABCBCCBCAAAACACCACACCACBABBBCCABBCBCBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCABABBABBCCCBCACBBBCCBBBCBACBABACCBCBBCBAACCBBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACBCCACABACABCBCBABACAABBCAABBCCABCBBAAABCAACCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCABABBABBCCCBCACBBBCCBBBCBACBABACCBCBBCBAACCBBACAC.exe" start= auto displayName= "UserDataSvc_CAACBCCACABACABCBCBABACAABBCAABBCCABCBBAAABCAACCCAA"
  2⤵
  PID:8716
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAACBCCACABACABCBCBABACAABBCAABBCCABCBBAAABCAACCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCABABBABBCCCBCACBBBCCBBBCBACBABACCBCBBCBAACCBBACAC.exe" start= auto displayName= "UserDataSvc_CAACBCCACABACABCBCBABACAABBCAABBCCABCBBAAABCAACCCAA"
    3⤵
    - Launches sc.exe
    PID:8720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAACBCCACABACABCBCBABACAABBCAABBCCABCBBAAABCAACCCAA"
  2⤵
  PID:9372
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAACBCCACABACABCBCBABACAABBCAABBCCABCBBAAABCAACCCAA"
    3⤵
    - Launches sc.exe
    PID:9416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACACBBCCABACABCABBAAABCACABCCCBAACABABABACCABACBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACACBBCCABACABCABBAAABCACABCCCBAACABABABACCABACBAAA.exe
1⤵
- Executes dropped EXE
PID:6824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCABCACABCCBACBACCCBCABCBBCBACBCCABCBAAAACBCABCABBBBCBCACCBAABBBBACCABAABABCAABBCCCCCCCBCCBBCBABBCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCCACABCCBACBAACABAABBABBAACBBCCACABCABAABCAABABCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCABCACABCCBACBACCCBCABCBBCBACBCCABCBAAAACBCABCABBBBCBCACCBAABBBBACCABAABABCAABBCCCCCCCBCCBBCBABBCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCCACABCCBACBAACABAABBABBAACBBCCACABCABAABCAABABCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACBCCACABACABCBCBABACAABBCAABBCCABCBBAAABCAACCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCCACABCCBACBAACABAABBABBAACBBCCACABCABAABCAABABCBCC.exe" start= auto displayName= "UserDataSvc_CAACBCCACABACABCBCBABACAABBCAABBCCABCBBAAABCAACCCAA"
  2⤵
  PID:8668
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAACBCCACABACABCBCBABACAABBCAABBCCABCBBAAABCAACCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCCACABCCBACBAACABAABBABBAACBBCCACABCABAABCAABABCBCC.exe" start= auto displayName= "UserDataSvc_CAACBCCACABACABCBCBABACAABBCAABBCCABCBBAAABCAACCCAA"
    3⤵
    - Launches sc.exe
    PID:916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCCBBAABBBCBABCCCACBAACBAABBBBBCBCCBACCACCCCCACACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCCBBAABBBCBABCCCACBAACBAABBBBBCBCCBACCACCCCCACACCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAABCBABAACCCBBABACBBACABBAABAAAAABBBBBBCABBBCACCAAABAAABAABCAABACBABABCBBABCCBACBCBCBAABAABABBAACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACACBBBCCBBBCACBACCBBBBBCBCBCAABBABABABCAACAAACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8676
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAABCBABAACCCBBABACBBACABBAABAAAAABBBBBBCABBBCACCAAABAAABAABCAABACBABABCBBABCCBACBCBCBAABAABABBAACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACACBBBCCBBBCACBACCBBBBBCBCBCAABBABABABCAACAAACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCABAABCCCBBBAACBACABCCAABBBABABBBACBBCBBCABAABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACACBBBCCBBBCACBACCBBBBBCBCBCAABBABABABCAACAAACBCA.exe" start= auto displayName= "UserDataSvc_ACCCABAABCCCBBBAACBACABCCAABBBABABBBACBBCBBCABAABCC"
  2⤵
  PID:4940
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCABAABCCCBBBAACBACABCCAABBBABABBBACBBCBBCABAABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACACBBBCCBBBCACBACCBBBBBCBCBCAABBABABABCAACAAACBCA.exe" start= auto displayName= "UserDataSvc_ACCCABAABCCCBBBAACBACABCCAABBBABABBBACBBCBBCABAABCC"
    3⤵
    PID:8712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCABAABCCCBBBAACBACABCCAABBBABABBBACBBCBBCABAABCC"
  2⤵
  PID:5140
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCABAABCCCBBBAACBACABCCAABBBABABBBACBBCBBCABAABCC"
    3⤵
    PID:10116

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCBBCCCBACBACBCBBBBBCBAACABBBBCBABACBBCBBCACCAABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCBBCCCBACBACBCBBBBBCBAACABBBBCBABACBBCBBCACCAABBA.exe
1⤵
- Executes dropped EXE
PID:6524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCBCCBAAAACBABBCCABBBBACBCCACBBACABCCCCCCABABBBABAABABACACBCBCAAABACAABCCCAABAACABCBABBBAAACBABCBBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBCCBAAAACBABBCCABBBBACBCCACBBACABCCCCCCABABBBABAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCBCCBAAAACBABBCCABBBBACBCCACBBACABCCCCCCABABBBABAABABACACBCBCAAABACAABCCCAABAACABCBABBBAAACBABCBBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBCCBAAAACBABBCCABBBBACBCCACBBACABCCCCCCABABBBABAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAAAACABACBACACCCCBCCCBACBCBAABBBCAACCBCABACBCACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBCCBAAAACBABBCCABBBBACBCCACBBACABCCCCCCABABBBABAABA.exe" start= auto displayName= "UserDataSvc_BCAAAACABACBACACCCCBCCCBACBCBAABBBCAACCBCABACBCACCA"
  2⤵
  PID:8016
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCAAAACABACBACACCCCBCCCBACBCBAABBBCAACCBCABACBCACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBCCBAAAACBABBCCABBBBACBCCACBBACABCCCCCCABABBBABAABA.exe" start= auto displayName= "UserDataSvc_BCAAAACABACBACACCCCBCCCBACBCBAABBBCAACCBCABACBCACCA"
    3⤵
    PID:7504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAAAACABACBACACCCCBCCCBACBCBAABBBCAACCBCABACBCACCA"
  2⤵
  PID:6100
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCAAAACABACBACACCCCBCCCBACBCBAABBBCAACCBCABACBCACCA"
    3⤵
    - Launches sc.exe
    PID:800

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAACBAAACACBCABBCCABAACBBACBBAACABAABAAACCCBBBCCABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAACBAAACACBCABBCCABAACBBACBBAACABAABAAACCCBBBCCABAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAABBBAABBCBCCACCCCAACCBCCCBBCBACBAAABCACCBABABCBCCBBAACAACBCBCBAAACBAABAACAABCCABBBABACCCBCCCCBCCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBBAABBCBCCACCCCAACCBCCCBBCBACBAAABCACCBABABCBCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAABBBAABBCBCCACCCCAACCBCCCBBCBACBAAABCACCBABABCBCCBBAACAACBCBCBAAACBAABAACAABCCABBBABACCCBCCCCBCCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBBAABBCBCCACCCCAACCBCCCBBCBACBAAABCACCBABABCBCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABCBCCBBCBCBACCBBBACABBCABBBBCABABCAAAABBBCABABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBBAABBCBCCACCCCAACCBCCCBBCBACBAAABCACCBABABCBCCBB.exe" start= auto displayName= "UserDataSvc_BCABCBCCBBCBCBACCBBBACABBCABBBBCABABCAAAABBBCABABCB"
  2⤵
  PID:5604
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABCBCCBBCBCBACCBBBACABBCABBBBCABABCAAAABBBCABABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBBAABBCBCCACCCCAACCBCCCBBCBACBAAABCACCBABABCBCCBB.exe" start= auto displayName= "UserDataSvc_BCABCBCCBBCBCBACCBBBACABBCABBBBCABABCAAAABBBCABABCB"
    3⤵
    PID:3428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABCBCCBBCBCBACCBBBACABBCABBBBCABABCAAAABBBCABABCB"
  2⤵
  PID:7944
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABCBCCBBCBCBACCBBBACABBCABBBBCABABCAAAABBBCABABCB"
    3⤵
    PID:3608

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAACAABACCBAACABCBABCBBBABABCCBACCBACBCBCCBBABBBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAACAABACCBAACABCBABCBBBABABCCBACCBACBCBCCBBABBBBCA.exe
1⤵
- Executes dropped EXE
PID:6620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCCAABCBCCAACCCCAACBACBCBCABBBCBACABBCBCCAABABABBBCCAACCCABBBAACBCCCBABAABBABACCABCCBABCCCCCABCCCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBABBCACCBACBBBACBBCCABACACAAACBAACCCBABAAAACAABCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7524
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCCAABCBCCAACCCCAACBACBCBCABBBCBACABBCBCCAABABABBBCCAACCCABBBAACBCCCBABAABBABACCABCCBABCCCCCABCCCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBABBCACCBACBBBACBBCCABACACAAACBAACCCBABAAAACAABCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCCAABCBABCBACBBCABBCAABCCACBABAACBBBCBBBBABAACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBABBCACCBACBBBACBBCCABACACAAACBAACCCBABAAAACAABCCAA.exe" start= auto displayName= "UserDataSvc_CBCCCAABCBABCBACBBCABBCAABCCACBABAACBBBCBBBBABAACAA"
  2⤵
  PID:7996
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCCAABCBABCBACBBCABBCAABCCACBABAACBBBCBBBBABAACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBABBCACCBACBBBACBBCCABACACAAACBAACCCBABAAAACAABCCAA.exe" start= auto displayName= "UserDataSvc_CBCCCAABCBABCBACBBCABBCAABCCACBABAACBBBCBBBBABAACAA"
    3⤵
    PID:7228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCCAABCBABCBACBBCABBCAABCCACBABAACBBBCBBBBABAACAA"
  2⤵
  PID:7360
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCCCAABCBABCBACBBCABBCAABCCACBABAACBBBCBBBBABAACAA"
    3⤵
    - Launches sc.exe
    PID:7200

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAACBAAACACBCABBCCABAACBBACBBAACABAABAAACCCBBBCCABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAACBAAACACBCABBCCABAACBBACBBAACABAABAAACCCBBBCCABAAB.exe
1⤵
- Executes dropped EXE
PID:2460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBBCBABBCCBBABCBCABCABBBCBABAABCCACCBAAABAABABCABABAACABBBCBABBAAAABBCABCAACCACBAAAAABCBACACACBAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBACACCCCABBBCCACBCCBCABBCABBCABCAAABABCCCABCCCAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBBCBABBCCBBABCBCABCABBBCBABAABCCACCBAAABAABABCABABAACABBBCBABBAAAABBCABCAACCACBAAAAABCBACACACBAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBACACCCCABBBCCACBCCBCABBCABBCABCAAABABCCCABCCCAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCCBBBBACCCABABBAAABBABAABABACCACABBCBACAABCBAABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBACACCCCABBBCCACBCCBCABBCABBCABCAAABABCCCABCCCAAACC.exe" start= auto displayName= "UserDataSvc_BCCCBBBBACCCABABBAAABBABAABABACCACABBCBACAABCBAABCC"
  2⤵
  PID:8112
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCCBBBBACCCABABBAAABBABAABABACCACABBCBACAABCBAABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBACACCCCABBBCCACBCCBCABBCABBCABCAAABABCCCABCCCAAACC.exe" start= auto displayName= "UserDataSvc_BCCCBBBBACCCABABBAAABBABAABABACCACABBCBACAABCBAABCC"
    3⤵
    - Launches sc.exe
    PID:1232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCCBBBBACCCABABBAAABBABAABABACCACABBCBACAABCBAABCC"
  2⤵
  PID:7952
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCCBBBBACCCABABBAAABBABAABABACCACABBCBACAABCBAABCC"
    3⤵
    - Launches sc.exe
    PID:7876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCBBCCCBACBACBCBBBBBCBAACABBBBCBABACBBCBBCACCAABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCBBCCCBACBACBCBBBBBCBAACABBBBCBABACBBCBBCACCAABBA.exe
1⤵
- Executes dropped EXE
PID:6276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAACCBBCBCAABCBBBACCBAAAABBAABCAACBCCABBBBAABAACAABAACCBCAACABABACBCABACABCBACCABACAACAABCACCBBCAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCCABCBBCACCCBABBCCCCCBBBCCABBCCACCABBABABBBBBCCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAACCBBCBCAABCBBBACCBAAAABBAABCAACBCCABBBBAABAACAABAACCBCAACABABACBCABACABCBACCABACAACAABCACCBBCAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCCABCBBCACCCBABBCCCCCBBBCCABBCCACCABBABABBBBBCCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCBCACABBCACBCCABCBCACBCBBACACCABCCCBBBCCAAACCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCCABCBBCACCCBABBCCCCCBBBCCABBCCACCABBABABBBBBCCACB.exe" start= auto displayName= "UserDataSvc_BCBCBCACABBCACBCCABCBCACBCBBACACCABCCCBBBCCAAACCBCB"
  2⤵
  PID:3536
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCBCACABBCACBCCABCBCACBCBBACACCABCCCBBBCCAAACCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCCABCBBCACCCBABBCCCCCBBBCCABBCCACCABBABABBBBBCCACB.exe" start= auto displayName= "UserDataSvc_BCBCBCACABBCACBCCABCBCACBCBBACACCABCCCBBBCCAAACCBCB"
    3⤵
    - Launches sc.exe
    PID:5996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCBCACABBCACBCCABCBCACBCBBACACCABCCCBBBCCAAACCBCB"
  2⤵
  PID:8136
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCBCACABBCACBCCABCBCACBCBBACACCABCCCBBBCCAAACCBCB"
    3⤵
    - Launches sc.exe
    PID:7328

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABAABAACCACABBCBAABBCBABABBABABACBBCBCCCACABCAABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABAABAACCACABBCBAABBCBABABBABABACBBCBCCCACABCAABAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCACCBBBCAAABAABBCCABAACBABACCACACAABABBBBCBACCCABBBCBCBACAACABBACABBCABBCCBCCACAABABCCBBAAABAACAAAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBCAAACBBCCCBABBBACABAABCCBCBCCBABBBAACBBCAABBCBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCACCBBBCAAABAABBCCABAACBABACCACACAABABBBBCBACCCABBBCBCBACAACABBACABBCABBCCBCCACAABABCCBBAAABAACAAAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBCAAACBBCCCBABBBACABAABCCBCBCCBABBBAACBBCAABBCBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAACACBBABABCCBBABBACBCABBBCACCBBBCCBBCBACCBCBAACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBCAAACBBCCCBABBBACABAABCCBCBCCBABBBAACBBCAABBCBBCA.exe" start= auto displayName= "UserDataSvc_AAACACBBABABCCBBABBACBCABBBCACCBBBCCBBCBACCBCBAACAA"
  2⤵
  PID:8124
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAACACBBABABCCBBABBACBCABBBCACCBBBCCBBCBACCBCBAACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBCAAACBBCCCBABBBACABAABCCBCBCCBABBBAACBBCAABBCBBCA.exe" start= auto displayName= "UserDataSvc_AAACACBBABABCCBBABBACBCABBBCACCBBBCCBBCBACCBCBAACAA"
    3⤵
    PID:8496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAACACBBABABCCBBABBACBCABBBCACCBBBCCBBCBACCBCBAACAA"
  2⤵
  PID:8872
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAACACBBABABCCBBABBACBCABBBCACCBBBCCBBCBACCBCBAACAA"
    3⤵
    PID:1708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAACAABACCBAACABCBABCBBBABABCCBACCBACBCBCCBBABBBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBAACAABACCBAACABCBABCBBBABABCCBACCBACBCBCCBBABBBBCA.exe
1⤵
- Executes dropped EXE
PID:6280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBABBCBBBBBBAAABBBCBCCCABBACABBCCBACAABCBCACAABBAACCBBCCCBACBBBBBBCCBBCBBCBACACCCBABAACBAACBBCCCCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBBBCCBABCCCACACAABBABBBCBCCBACCCACCCCCCABACCABBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBABBCBBBBBBAAABBBCBCCCABBACABBCCBACAABCBCACAABBAACCBBCCCBACBBBBBBCCBBCBBCBACACCCBABAACBAACBBCCCCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBBBCCBABCCCACACAABBABBBCBCCBACCCACCCCCCABACCABBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAABCACACBCBBACBBABCAACBABCCCCCCCBABACBCABBBCBCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBBBCCBABCCCACACAABBABBBCBCCBACCCACCCCCCABACCABBAC.exe" start= auto displayName= "UserDataSvc_ABAABCACACBCBBACBBABCAACBABCCCCCCCBABACBCABBBCBCABB"
  2⤵
  PID:8800
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAABCACACBCBBACBBABCAACBABCCCCCCCBABACBCABBBCBCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBBBCCBABCCCACACAABBABBBCBCCBACCCACCCCCCABACCABBAC.exe" start= auto displayName= "UserDataSvc_ABAABCACACBCBBACBBABCAACBABCCCCCCCBABACBCABBBCBCABB"
    3⤵
    PID:8504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAABCACACBCBBACBBABCAACBABCCCCCCCBABACBCABBBCBCABB"
  2⤵
  PID:8256
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAABCACACBCBBACBBABCAACBABCCCCCCCBABACBCABBBCBCABB"
    3⤵
    - Launches sc.exe
    PID:8564

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBACACABABABBABBCBCCBAABCCACBCACBABAAAAACACBACACAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBACACABABABBABBCBCCBAABCCACBCACBABAAAAACACBACACAAAC.exe
1⤵
- Executes dropped EXE
PID:7124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBCCAAABCACAABABBAAACABACBACAABBABCBBCAAABBAACCBBBCCABABBACBACAABAABBCCCBAACBCABAABCBCBCBBCCBBCBBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBABACBACBBBABCCABBBCBBACBACCCABBBCCCBCBCBCABCABAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8244
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBCCAAABCACAABABBAAACABACBACAABBABCBBCAAABBAACCBBBCCABABBACBACAABAABBCCCBAACBCABAABCBCBCBBCCBBCBBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBABACBACBBBABCCABBBCBBACBACCCABBBCCCBCBCBCABCABAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCABCCBCBAABACABCCBACBCBABAACCBAACCCCACBCCBAABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBABACBACBBBABCCABBBCBBACBACCCABBBCCCBCBCBCABCABAACB.exe" start= auto displayName= "UserDataSvc_BBBCABCCBCBAABACABCCBACBCBABAACCBAACCCCACBCCBAABBCC"
  2⤵
  PID:9016
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCABCCBCBAABACABCCBACBCBABAACCBAACCCCACBCCBAABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBABACBACBBBABCCABBBCBBACBACCCABBBCCCBCBCBCABCABAACB.exe" start= auto displayName= "UserDataSvc_BBBCABCCBCBAABACABCCBACBCBABAACCBAACCCCACBCCBAABBCC"
    3⤵
    PID:8912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCABCCBCBAABACABCCBACBCBABAACCBAACCCCACBCCBAABBCC"
  2⤵
  PID:3096
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCABCCBCBAABACABCCBACBCBABAACCBAACCCCACBCCBAABBCC"
    3⤵
    - Launches sc.exe
    PID:4328

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBACACABABABBABBCBCCBAABCCACBCACBABAAAAACACBACACAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBACACABABABBABBCBCCBAABCCACBCACBABAAAAACACBACACAAAC.exe
1⤵
- Executes dropped EXE
PID:7240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCABAACACBBCBBBAACCBCCCBBCBACCBCABCBAACCBCBCBCCCABCBBAABBCABCCAABABCABACCAACCAAAACCACACBABBBCCBCABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACAACBABBBBCBCBBCBBCACBACACBCCACBCCCABCCBBCACCAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCABAACACBBCBBBAACCBCCCBBCBACCBCABCBAACCBCBCBCCCABCBBAABBCABCCAABABCABACCAACCAAAACCACACBABBBCCBCABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACAACBABBBBCBCBBCBBCACBACACBCCACBCCCABCCBBCACCAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:8700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBCBCCBCCCBCBACBBBCBAACBBAACCBBCACABBCCCABCACACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACAACBABBBBCBCBBCBBCACBACACBCCACBCCCABCCBBCACCAABAC.exe" start= auto displayName= "UserDataSvc_ACCBCBCCBCCCBCBACBBBCBAACBBAACCBBCACABBCCCABCACACBC"
  2⤵
  PID:8664
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBCBCCBCCCBCBACBBBCBAACBBAACCBBCACABBCCCABCACACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACAACBABBBBCBCBBCBBCACBACACBCCACBCCCABCCBBCACCAABAC.exe" start= auto displayName= "UserDataSvc_ACCBCBCCBCCCBCBACBBBCBAACBBAACCBBCACABBCCCABCACACBC"
    3⤵
    - Launches sc.exe
    PID:9448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBCBCCBCCCBCBACBBBCBAACBBAACCBBCACABBCCCABCACACBC"
  2⤵
  PID:10128
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBCBCCBCCCBCBACBBBCBAACBBAACCBBCACABBCCCABCACACBC"
    3⤵
    PID:9844

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABAABAACCACABBCBAABBCBABABBABABACBBCBCCCACABCAABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABAABAACCACABBCBAABBCBABABBABABACBBCBCCCACABCAABAAB.exe
1⤵
PID:7396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBCBACCCAAABACACCCBCABCACABBCBABBBABCCBCBAABACBACAABCBAABABBCABABBCBBCACBBBACCABCABACCCBBCABCACCCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBCBCACCABBBBCCCCCBBCCAAACAAACBABCBCABCABBACBBBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBCBACCCAAABACACCCBCABCACABBCBABBBABCCBCBAABACBACAABCBAABABBCABABBCBBCACBBBACCABCABACCCBBCABCACCCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBCBCACCABBBBCCCCCBBCCAAACAAACBABCBCABCABBACBBBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCAACCAACACBBAACCACABCBCCCCACCACBACBCABACCACAACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBCBCACCABBBBCCCCCBBCCAAACAAACBABCBCABCABBACBBBACA.exe" start= auto displayName= "UserDataSvc_BBCAACCAACACBBAACCACABCBCCCCACCACBACBCABACCACAACBCB"
  2⤵
  PID:9828
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCAACCAACACBBAACCACABCBCCCCACCACBACBCABACCACAACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBCBCACCABBBBCCCCCBBCCAAACAAACBABCBCABCABBACBBBACA.exe" start= auto displayName= "UserDataSvc_BBCAACCAACACBBAACCACABCBCCCCACCACBACBCABACCACAACBCB"
    3⤵
    - Launches sc.exe
    PID:9244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCAACCAACACBBAACCACABCBCCCCACCACBACBCABACCACAACBCB"
  2⤵
  PID:5380
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCAACCAACACBBAACCACABCBCCCCACCACBACBCABACCACAACBCB"
    3⤵
    PID:6128

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACAACCBBCAABACCBABBCCABABABABCBAAAABABCBBBCAABAACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACAACCBBCAABACCBABBCCABABABABCBAAAABABCBBBCAABAACBBC.exe
1⤵
PID:7540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCAAAABACBCABAABAAABBBBACAACCCBABCAACCCCBBCCBBBCCBCABAABACCCBCBAAAABCABCBBBBBABCBCABCACAACAACAAAABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAAABACBCABAABAAABBBBACAACCCBABCAACCCCBBCCBBBCCBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCAAAABACBCABAABAAABBBBACAACCCBABCAACCCCBBCCBBBCCBCABAABACCCBCBAAAABCABCBBBBBABCBCABCACAACAACAAAABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAAABACBCABAABAAABBBBACAACCCBABCAACCCCBBCCBBBCCBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABCABCCCCBABCBBCACCABBCBCACACCABBBBBCACCBAABABACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAAABACBCABAABAAABBBBACAACCCBABCAACCCCBBCCBBBCCBCAB.exe" start= auto displayName= "UserDataSvc_BBABCABCCCCBABCBBCACCABBCBCACACCABBBBBCACCBAABABACA"
  2⤵
  PID:10080
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBABCABCCCCBABCBBCACCABBCBCACACCABBBBBCACCBAABABACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAAABACBCABAABAAABBBBACAACCCBABCAACCCCBBCCBBBCCBCAB.exe" start= auto displayName= "UserDataSvc_BBABCABCCCCBABCBBCACCABBCBCACACCABBBBBCACCBAABABACA"
    3⤵
    PID:8760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABCABCCCCBABCBBCACCABBCBCACACCABBBBBCACCBAABABACA"
  2⤵
  PID:10880
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBABCABCCCCBABCBBCACCABBCBCACACCABBBBBCACCBAABABACA"
    3⤵
    PID:11168

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACAACCBBCAABACCBABBCCABABABABCBAAAABABCBBBCAABAACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACAACCBBCAABACCBABBCCABABABABCBAAAABABCBBBCAABAACBBC.exe
1⤵
PID:7696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCABCBABBBAAABAAABCAACCCACCCCBBCCABAABABAABBACCCAAAAABBBBBCCBCBAACCCCABAACCBACABCABCBBACACCABCCBCCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCABBAACBABCBBBBCACCABCBACAACAACCCBACCCAABCBCBBBBCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCABCBABBBAAABAAABCAACCCACCCCBBCCABAABABAABBACCCAAAAABBBBBCCBCBAACCCCABAACCBACABCABCBBACACCABCCBCCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCABBAACBABCBBBBCACCABCBACAACAACCCBACCCAABCBCBBBBCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:8824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCCBCCAABACBCBACABAABABCCCBCABCCBBCBBBBCCCCBCCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCABBAACBABCBBBBCACCABCBACAACAACCCBACCCAABCBCBBBBCBBC.exe" start= auto displayName= "UserDataSvc_CCCCCBCCAABACBCBACABAABABCCCBCABCCBBCBBBBCCCCBCCCAC"
  2⤵
  PID:4516
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCCBCCAABACBCBACABAABABCCCBCABCCBBCBBBBCCCCBCCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCABBAACBABCBBBBCACCABCBACAACAACCCBACCCAABCBCBBBBCBBC.exe" start= auto displayName= "UserDataSvc_CCCCCBCCAABACBCBACABAABABCCCBCABCCBBCBBBBCCCCBCCCAC"
    3⤵
    PID:6048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCCBCCAABACBCBACABAABABCCCBCABCCBBCBBBBCCCCBCCCAC"
  2⤵
  PID:408
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCCBCCAABACBCBACABAABABCCCBCABCCBBCBBBBCCCCBCCCAC"
    3⤵
    - Launches sc.exe
    PID:12032

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCCABCACBBAAABCAABCAABBCBBCABABACAACCABCAAACAABCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCCABCACBBAAABCAABCAABBCBBCABABACAACCABCAAACAABCBBC.exe
1⤵
PID:7812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCBBACABBCACCBCCABAAABCAACBCCCBCCABBCCCCABAAACACCAABBCBABCCCBBCCCCCCACABBCBABBAABCABCCBACAABABCAABCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBACABBCACCBCCABAAABCAACBCCCBCCABBCCCCABAAACACCAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCBBACABBCACCBCCABAAABCAACBCCCBCCABBCCCCABAAACACCAABBCBABCCCBBCCCCCCACABBCBABBAABCABCCBACAABABCAABCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBACABBCACCBCCABAAABCAACBCCCBCCABBCCCCABAAACACCAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:9288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBBBBBCCABCCAACBCAACAACABBCBACBCBCBBCCCAAABCABCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBACABBCACCBCCABAAABCAACBCCCBCCABBCCCCABAAACACCAABB.exe" start= auto displayName= "UserDataSvc_CCBBBBBBCCABCCAACBCAACAACABBCBACBCBCBBCCCAAABCABCCB"
  2⤵
  PID:10692
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBBBBBCCABCCAACBCAACAACABBCBACBCBCBBCCCAAABCABCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBACABBCACCBCCABAAABCAACBCCCBCCABBCCCCABAAACACCAABB.exe" start= auto displayName= "UserDataSvc_CCBBBBBBCCABCCAACBCAACAACABBCBACBCBCBBCCCAAABCABCCB"
    3⤵
    - Launches sc.exe
    PID:3868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBBBBBCCABCCAACBCAACAACABBCBACBCBCBBCCCAAABCABCCB"
  2⤵
  PID:11676
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBBBBBCCABCCAACBCAACAACABBCBACBCBCBBCCCAAABCABCCB"
    3⤵
    - Launches sc.exe
    PID:12252

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABABBCCBBBABACABABABBCACCCBBBABBCCACCCACAAABCACABBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABABBCCBBBABACABABABBCACCCBBBABBCCACCCACAAABCACABBBA.exe
1⤵
PID:7868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAAABBABBCABABBABCBCBCBCCBACBCBBBABBBACCCBCCCACBCACCAACCBBCBABCACCBCBBBBABACABABABCAABBBCBABAAAAABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABCCBABAABAAAABBBABBABBABCACCBCAACCBACAACCAACAABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAAABBABBCABABBABCBCBCBCCBACBCBBBABBBACCCBCCCACBCACCAACCBBCBABCACCBCBBBBABACABABABCAABBBCBABAAAAABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABCCBABAABAAAABBBABBABBABCACCBCAACCBACAACCAACAABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCBBCABCBACCBACACBCACCCABABBACCBBBACABCABCBABCCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABCCBABAABAAAABBBABBABBABCACCBCAACCBACAACCAACAABBAB.exe" start= auto displayName= "UserDataSvc_BBCBBCABCBACCBACACBCACCCABABBACCBBBACABCABCBABCCCAA"
  2⤵
  PID:10140
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCBBCABCBACCBACACBCACCCABABBACCBBBACABCABCBABCCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABCCBABAABAAAABBBABBABBABCACCBCAACCBACAACCAACAABBAB.exe" start= auto displayName= "UserDataSvc_BBCBBCABCBACCBACACBCACCCABABBACCBBBACABCABCBABCCCAA"
    3⤵
    - Launches sc.exe
    PID:9456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCBBCABCBACCBACACBCACCCABABBACCBBBACABCABCBABCCCAA"
  2⤵
  PID:9864
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCBBCABCBACCBACACBCACCCABABBACCBBBACABCABCBABCCCAA"
    3⤵
    - Launches sc.exe
    PID:12244

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCBAAABAACBCCBCBBCACBCAABAABBCCACBBCAABABABACBBBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCBAAABAACBCCBCBBCACBCAABAABBCCACBBCAABABABACBBBCCA.exe
1⤵
PID:728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCACACBBCABCACCACBACABABBAAAACCBCCACACBCAAABAAACABBCBBAAABBBBCAAAABCCBCBCBBBCCBCBABBACCAABACBAABACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCAAABBBBAAABBAAAAACCABCBBCAABCACCBBACBBCCACCCABBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCACACBBCABCACCACBACABABBAAAACCBCCACACBCAAABAAACABBCBBAAABBBBCAAAABCCBCBCBBBCCBCBABBACCAABACBAABACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCAAABBBBAAABBAAAAACCABCBBCAABCACCBBACBBCCACCCABBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAAABCAACAABCACBBBABBAACACCABAAAAABCACCBCBCABBCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCAAABBBBAAABBAAAAACCABCBBCAABCACCBBACBBCCACCCABBCAA.exe" start= auto displayName= "UserDataSvc_ABAAABCAACAABCACBBBABBAACACCABAAAAABCACCBCBCABBCBBC"
  2⤵
  PID:10588
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAAABCAACAABCACBBBABBAACACCABAAAAABCACCBCBCABBCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCAAABBBBAAABBAAAAACCABCBBCAABCACCBBACBBCCACCCABBCAA.exe" start= auto displayName= "UserDataSvc_ABAAABCAACAABCACBBBABBAACACCABAAAAABCACCBCBCABBCBBC"
    3⤵
    - Launches sc.exe
    PID:11852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAAABCAACAABCACBBBABBAACACCABAAAAABCACCBCBCABBCBBC"
  2⤵
  PID:6804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCBAAABAACBCCBCBBCACBCAABAABBCCACBBCAABABABACBBBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCBAAABAACBCCBCBBCACBCAABAABBCCACBBCAABABABACBBBCCA.exe
1⤵
PID:3240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACBCACABCBCCCCBBABCACABACBABCBCCAAAACCBBACCAABBACCAACAAAAACBAACABBBCAAACABCCBCABABCCACBABBCBBBACBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABCCABACABCAAAAACCBAACBCACBACAABABBBCBCBABCBABCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9444
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACBCACABCBCCCCBBABCACABACBABCBCCAAAACCBBACCAABBACCAACAAAAACBAACABBBCAAACABCCBCABABCCACBABBCBBBACBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABCCABACABCAAAAACCBAACBCACBACAABABBBCBCBABCBABCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABABBBCBCACBCAACBBCBABBBBCBBCBBABBBACBACCCBABBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABCCABACABCAAAAACCBAACBCACBACAABABBBCBCBABCBABCBAC.exe" start= auto displayName= "UserDataSvc_CBABABBBCBCACBCAACBBCBABBBBCBBCBBABBBACBACCCBABBAAC"
  2⤵
  PID:6036
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABABBBCBCACBCAACBBCBABBBBCBBCBBABBBACBACCCBABBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABCCABACABCAAAAACCBAACBCACBACAABABBBCBCBABCBABCBAC.exe" start= auto displayName= "UserDataSvc_CBABABBBCBCACBCAACBBCBABBBBCBBCBBABBBACBACCCBABBAAC"
    3⤵
    - Launches sc.exe
    PID:1796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBABBCACCBACBBBACBBCCABACACAAACBAACCCBABAAAACAABCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBABBCACCBACBBBACBBCCABACACAAACBAACCCBABAAAACAABCCAA.exe
1⤵
PID:1288

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBBAABBCBCCACCCCAACCBCCCBBCBACBAAABCACCBABABCBCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBBAABBCBCCACCCCAACCBCCCBBCBACBAAABCACCBABABCBCCBB.exe
1⤵
PID:5276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCCCBCAABBABCCCBACAAACBCBCCBCAAABBABCCCCAACBCABAAAABBCCAAAACCBBBBBBBCAAACCBCACCAAABBAABCCBACCBCAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCCBCAABBABCCCBACAAACBCBCCBCAAABBABCCCCAACBCABAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCCCBCAABBABCCCBACAAACBCBCCBCAAABBABCCCCAACBCABAAAABBCCAAAACCBBBBBBBCAAACCBCACCAAABBAABCCBACCBCAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCCBCAABBABCCCBACAAACBCBCCBCAAABBABCCCCAACBCABAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBCBABBCCCABBCCABCCAAAACAABCBBABAAABBBCBABCBBCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCCBCAABBABCCCBACAAACBCBCCBCAAABBABCCCCAACBCABAAAAB.exe" start= auto displayName= "UserDataSvc_ACCBCBABBCCCABBCCABCCAAAACAABCBBABAAABBBCBABCBBCAAB"
  2⤵
  PID:9884
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBCBABBCCCABBCCABCCAAAACAABCBBABAAABBBCBABCBBCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCCBCAABBABCCCBACAAACBCBCCBCAAABBABCCCCAACBCABAAAAB.exe" start= auto displayName= "UserDataSvc_ACCBCBABBCCCABBCCABCCAAAACAABCBBABAAABBBCBABCBBCAAB"
    3⤵
    - Launches sc.exe
    PID:9444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBCBABBCCCABBCCABCCAAAACAABCBBABAAABBBCBABCBBCAAB"
  2⤵
  PID:9476
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBCBABBCCCABBCCABCCAAAACAABCBBABAAABBBCBABCBBCAAB"
    3⤵
    PID:11184

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBCCBAAAACBABBCCABBBBACBCCACBBACABCCCCCCABABBBABAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBCCBAAAACBABBCCABBBBACBCCACBBACABCCCCCCABABBBABAABA.exe
1⤵
PID:7388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCACBCCBCBBBAAABCBBAAACBBACABBABCAABABACCCABCCACCAACCCABABAABCABBCCABCBBBCBCBAACBCCBAABAACBABABAAABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABBCAAACCAAACBCBACAABBACAABBBACCABACCABBCACABABAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7236
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCACBCCBCBBBAAABCBBAAACBBACABBABCAABABACCCABCCACCAACCCABABAABCABBCCABCBBBCBCBAACBCCBAABAACBABABAAABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABBCAAACCAAACBCBACAABBACAABBBACCABACCABBCACABABAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:10000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBCBBBBCCAACCACCAABCACBACCAACABCBBCCBCACACBCCBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABBCAAACCAAACBCBACAABBACAABBBACCABACCABBCACABABAABBB.exe" start= auto displayName= "UserDataSvc_ACCBCBBBBCCAACCACCAABCACBACCAACABCBBCCBCACACBCCBAAC"
  2⤵
  PID:9764
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBCBBBBCCAACCACCAABCACBACCAACABCBBCCBCACACBCCBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABBCAAACCAAACBCBACAABBACAABBBACCABACCABBCACABABAABBB.exe" start= auto displayName= "UserDataSvc_ACCBCBBBBCCAACCACCAABCACBACCAACABCBBCCBCACACBCCBAAC"
    3⤵
    PID:10904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBCBBBBCCAACCACCAABCACBACCAACABCBBCCBCACACBCCBAAC"
  2⤵
  PID:9540
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBCBBBBCCAACCACCAABCACBACCAACABCBBCCBCACACBCCBAAC"
    3⤵
    PID:12120

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBACACCCCABBBCCACBCCBCABBCABBCABCAAABABCCCABCCCAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBACACCCCABBBCCACBCCBCABBCABBCABCAAABABCCCABCCCAAACC.exe
1⤵
PID:8020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABACBBCACCCBABBCBBCAAACCBCAAACCBCACAAAACACCAABCCACACBBCACBACACACACCBBAACABACCCBCBBBACBCBBCBABBABCAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBCACCCBABBCBBCAAACCBCAAACCBCACAAAACACCAABCCACACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABACBBCACCCBABBCBBCAAACCBCAAACCBCACAAAACACCAABCCACACBBCACBACACACACCBBAACABACCCBCBBBACBCBBCBABBABCAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBCACCCBABBCBBCAAACCBCAAACCBCACAAAACACCAABCCACACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:10404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACBCBAACCCBCBCAABBAABACBABCCACBCCBAACCCAABAABCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBCACCCBABBCBBCAAACCBCAAACCBCACAAAACACCAABCCACACBB.exe" start= auto displayName= "UserDataSvc_CCACBCBAACCCBCBCAABBAABACBABCCACBCCBAACCCAABAABCABB"
  2⤵
  PID:10820
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCACBCBAACCCBCBCAABBAABACBABCCACBCCBAACCCAABAABCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBCACCCBABBCBBCAAACCBCAAACCBCACAAAACACCAABCCACACBB.exe" start= auto displayName= "UserDataSvc_CCACBCBAACCCBCBCAABBAABACBABCCACBCCBAACCCAABAABCABB"
    3⤵
    PID:12040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACBCBAACCCBCBCAABBAABACBABCCACBCCBAACCCAABAABCABB"
  2⤵
  PID:10700
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCACBCBAACCCBCBCAABBAABACBABCCACBCCBAACCCAABAABCABB"
    3⤵
    - Launches sc.exe
    PID:12656

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBABBCACCBACBBBACBBCCABACACAAACBAACCCBABAAAACAABCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBABBCACCBACBBBACBBCCABACACAAACBAACCCBABAAAACAABCCAA.exe
1⤵
PID:8052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACBBCAABABCCACBCBCCBBCACACCABBABBBCCBABACCBCCCACCAABCABBCCACBBAACCCBCCAABACAABCACAACABABCCBBCACCBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBAACCBCBCAABABCCCBABCBCBCCBBBAAABCCBBCBAAAABACBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACBBCAABABCCACBCBCCBBCACACCABBABBBCCBABACCBCCCACCAABCABBCCACBBAACCCBCCAABACAABCACAACABABCCBBCACCBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBAACCBCBCAABABCCCBABCBCBCCBBBAAABCCBBCBAAAABACBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCBABCBABCBCABBABCBCACABABACBBBCBACBCBCACBBACBBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBAACCBCBCAABABCCCBABCBCBCCBBBAAABCCBBCBAAAABACBABC.exe" start= auto displayName= "UserDataSvc_BBCBABCBABCBCABBABCBCACABABACBBBCBACBCBCACBBACBBCCC"
  2⤵
  PID:4608
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCBABCBABCBCABBABCBCACABABACBBBCBACBCBCACBBACBBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBAACCBCBCAABABCCCBABCBCBCCBBBAAABCCBBCBAAAABACBABC.exe" start= auto displayName= "UserDataSvc_BBCBABCBABCBCABBABCBCACABABACBBBCBACBCBCACBBACBBCCC"
    3⤵
    - Launches sc.exe
    PID:9256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCBABCBABCBCABBABCBCACABABACBBBCBACBCBCACBBACBBCCC"
  2⤵
  PID:9996
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCBABCBABCBCABBABCBCACABABACBBBCBACBCBCACBBACBBCCC"
    3⤵
    PID:12264

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBCCBAAAACBABBCCABBBBACBCCACBBACABCCCCCCABABBBABAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBCCBAAAACBABBCCABBBBACBCCACBBACABCCCCCCABABBBABAABA.exe
1⤵
PID:8064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABAAAABABAAACBCBABCBAAACACCACACACCCCABBBACAAABBACBCBBCABCCBBCBBCCCABCCCACBABBBBACBCACCBBCAACBBCBCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCACCCABBACBBAAACACACBABCABACCCAABCBABBACCCBBCCBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABAAAABABAAACBCBABCBAAACACCACACACCCCABBBACAAABBACBCBBCABCCBBCBBCCCABCCCACBABBBBACBCACCBBCAACBBCBCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCACCCABBACBBAAACACACBABCABACCCAABCBABBACCCBBCCBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCCCCCACCABBAACBBCAAAABACABCBBBACCBBAABBBCAAABCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCACCCABBACBBAAACACACBABCABACCCAABCBABBACCCBBCCBAAC.exe" start= auto displayName= "UserDataSvc_BBBCCCCCACCABBAACBBCAAAABACABCBBBACCBBAABBBCAAABCAC"
  2⤵
  PID:4084
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCCCCCACCABBAACBBCAAAABACABCBBBACCBBAABBBCAAABCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCACCCABBACBBAAACACACBABCABACCCAABCBABBACCCBBCCBAAC.exe" start= auto displayName= "UserDataSvc_BBBCCCCCACCABBAACBBCAAAABACABCBBBACCBBAABBBCAAABCAC"
    3⤵
    - Launches sc.exe
    PID:11612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCCCCCACCABBAACBBCAAAABACABCBBBACCBBAABBBCAAABCAC"
  2⤵
  PID:10524
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCCCCCACCABBAACBBCAAAABACABCBBBACCBBAABBBCAAABCAC"
    3⤵
    PID:11904

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBBAABBCBCCACCCCAACCBCCCBBCBACBAAABCACCBABABCBCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBBAABBCBCCACCCCAACCBCCCBBCBACBAAABCACCBABABCBCCBB.exe
1⤵
PID:1532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBABCCCCABAACBBABCABCCAAACCCBCCACCBACCBBCBBCAACCCABACABCACBBABBAABACCBCACCBACAABCCBCCBCCAACCBBBCBCBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAACBAAACBABCBCACBCCCBACAACBBBBCBBBCABACBABCCBCACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBABCCCCABAACBBABCABCCAAACCCBCCACCBACCBBCBBCAACCCABACABCACBBABBAABACCBCACCBACAABCCBCCBCCAACCBBBCBCBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAACBAAACBABCBCACBCCCBACAACBBBBCBBBCABACBABCCBCACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCABCCAACABAABAAAAABBBBCAAAAABBBABCBBABCCCCCCBCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAACBAAACBABCBCACBCCCBACAACBBBBCBBBCABACBABCCBCACBAC.exe" start= auto displayName= "UserDataSvc_ABCABCCAACABAABAAAAABBBBCAAAAABBBABCBBABCCCCCCBCBBC"
  2⤵
  PID:10312
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCABCCAACABAABAAAAABBBBCAAAAABBBABCBBABCCCCCCBCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAACBAAACBABCBCACBCCCBACAACBBBBCBBBCABACBABCCBCACBAC.exe" start= auto displayName= "UserDataSvc_ABCABCCAACABAABAAAAABBBBCAAAAABBBABCBBABCCCCCCBCBBC"
    3⤵
    PID:11748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCABCCAACABAABAAAAABBBBCAAAAABBBABCBBABCCCCCCBCBBC"
  2⤵
  PID:11376
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCABCCAACABAABAAAAABBBBCAAAAABBBABCBBABCCCCCCBCBBC"
    3⤵
    PID:5944

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBACACCCCABBBCCACBCCBCABBCABBCABCAAABABCCCABCCCAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBACACCCCABBBCCACBCCBCABBCABBCABCAAABABCCCABCCCAAACC.exe
1⤵
PID:7516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBACBACCBCBABCCABACBBAAABBCCBBCAACCBBAABBBACBACCACCCBCABACACCBACBCAAABCCBBBBABBABACAABACBCBCBCABCACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCCBCABCCACBCAABCBCCCCCCCBCBBBABCABACCBBBCABCCBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBACBACCBCBABCCABACBBAAABBCCBBCAACCBBAABBBACBACCACCCBCABACACCBACBCAAABCCBBBBABBABACAABACBCBCBCABCACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCCBCABCCACBCAABCBCCCCCCCBCBBBABCABACCBBBCABCCBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:10316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBAABCCCBCCBACACCABACAACABABAACBACCBBBCBABACBACAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCCBCABCCACBCAABCBCCCCCCCBCBBBABCABACCBBBCABCCBAAB.exe" start= auto displayName= "UserDataSvc_BBBAABCCCBCCBACACCABACAACABABAACBACCBBBCBABACBACAAA"
  2⤵
  PID:10552
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBAABCCCBCCBACACCABACAACABABAACBACCBBBCBABACBACAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCCBCABCCACBCAABCBCCCCCCCBCBBBABCABACCBBBCABCCBAAB.exe" start= auto displayName= "UserDataSvc_BBBAABCCCBCCBACACCABACAACABABAACBACCBBBCBABACBACAAA"
    3⤵
    PID:11640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBAABCCCBCCBACACCABACAACABABAACBACCBBBCBABACBACAAA"
  2⤵
  PID:11256
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBAABCCCBCCBACACCABACAACABABAACBACCBBBCBABACBACAAA"
    3⤵
    PID:5364

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCCABCBBCACCCBABBCCCCCBBBCCABBCCACCABBABABBBBBCCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCCABCBBCACCCBABBCCCCCBBBCCABBCCACCABBABABBBBBCCACB.exe
1⤵
PID:4220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACBACCCBBBCCBABCBBCCBBBBCBCAAACCAABCAAAACBCCACBCCCCACAABACCBACAACCCBACBBCABBBCBCBABCCCBABBACABBAABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACCCBCCBBCBCACCABABBBBBBACACCCBCCBBACAACCBCCBBCCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACBACCCBBBCCBABCBBCCBBBBCBCAAACCAABCAAAACBCCACBCCCCACAABACCBACAACCCBACBBCABBBCBCBABCCCBABBACABBAABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACCCBCCBBCBCACCABABBBBBBACACCCBCCBBACAACCBCCBBCCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCBBACABCBABAAABCCAABACCACBCCBBBCCAACABABBAAABBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACCCBCCBBCBCACCABABBBBBBACACCCBCCBBACAACCBCCBBCCCBC.exe" start= auto displayName= "UserDataSvc_ACBCBBACABCBABAAABCCAABACCACBCCBBBCCAACABABBAAABBCB"
  2⤵
  PID:4152
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCBBACABCBABAAABCCAABACCACBCCBBBCCAACABABBAAABBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACCCBCCBBCBCACCABABBBBBBACACCCBCCBBACAACCBCCBBCCCBC.exe" start= auto displayName= "UserDataSvc_ACBCBBACABCBABAAABCCAABACCACBCCBBBCCAACABABBAAABBCB"
    3⤵
    PID:12056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCBBACABCBABAAABCCAABACCACBCCBBBCCAACABABBAAABBCB"
  2⤵
  PID:11408
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCBBACABCBABAAABCCAABACCACBCCBBBCCAACABABBAAABBCB"
    3⤵
    - Launches sc.exe
    PID:12712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCCABCBBCACCCBABBCCCCCBBBCCABBCCACCABBABABBBBBCCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCCABCBBCACCCBABBCCCCCBBBCCABBCCACCABBABABBBBBCCACB.exe
1⤵
PID:4932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACACBACCABBACCAAACBCACBBCBABBACBCACBACBBAABCBCABCABACCCBBBACBCABBACCBBBACACCBACBBACCAAABCBBCACCABCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCABACACAABACBCCBAABBCBBAABBBABACCAACAAABBAABACBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10272
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACACBACCABBACCAAACBCACBBCBABBACBCACBACBBAABCBCABCABACCCBBBACBCABBACCBBBACACCBACBBACCAAABCBBCACCABCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCABACACAABACBCCBAABBCBBAABBBABACCAACAAABBAABACBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:4316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCBBACCBCAABBBCCBACBBABBCABCCCAABBCCBBBBABACBCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCABACACAABACBCCBAABBCBBAABBBABACCAACAAABBAABACBBBB.exe" start= auto displayName= "UserDataSvc_BACCBBACCBCAABBBCCBACBBABBCABCCCAABBCCBBBBABACBCBCC"
  2⤵
  PID:11760
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCBBACCBCAABBBCCBACBBABBCABCCCAABBCCBBBBABACBCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCABACACAABACBCCBAABBCBBAABBBABACCAACAAABBAABACBBBB.exe" start= auto displayName= "UserDataSvc_BACCBBACCBCAABBBCCBACBBABBCABCCCAABBCCBBBBABACBCBCC"
    3⤵
    - Launches sc.exe
    PID:11328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCBBACCBCAABBBCCBACBBABBCABCCCAABBCCBBBBABACBCBCC"
  2⤵
  PID:10652
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCBBACCBCAABBBCCBACBBABBCABCCCAABBCCBBBBABACBCBCC"
    3⤵
    PID:13292

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACCCBBCBBBBACCBAACAACCCABBACCBABBCAACCABCCBCCCCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACCCBBCBBBBACCBAACAACCCABBACCBABBCAACCABCCBCCCCACB.exe
1⤵
PID:8268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCCABBBBCCAAAACBCCCBCBACCCBCACCABBAABBBABBAAACCACBAACBBBAAACBACABBACCCCCAAACBAACCACABAACACBCCACACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABBBBCCAAAACBCCCBCBACCCBCACCABBAABBBABBAAACCACBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCCABBBBCCAAAACBCCCBCBACCCBCACCABBAABBBABBAAACCACBAACBBBAAACBACABBACCCCCAAACBAACCACABAACACBCCACACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABBBBCCAAAACBCCCBCBACCCBCACCABBAABBBABBAAACCACBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCBACCBACCBCAACBBAAACCBBCACCCBCBABCAACCBBBABCCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABBBBCCAAAACBCCCBCBACCCBCACCABBAABBBABBAAACCACBAAC.exe" start= auto displayName= "UserDataSvc_CABCBACCBACCBCAACBBAAACCBBCACCCBCBABCAACCBBBABCCCAA"
  2⤵
  PID:2924
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCBACCBACCBCAACBBAAACCBBCACCCBCBABCAACCBBBABCCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABBBBCCAAAACBCCCBCBACCCBCACCABBAABBBABBAAACCACBAAC.exe" start= auto displayName= "UserDataSvc_CABCBACCBACCBCAACBBAAACCBBCACCCBCBABCAACCBBBABCCCAA"
    3⤵
    - Launches sc.exe
    PID:1368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCBACCBACCBCAACBBAAACCBBCACCCBCBABCAACCBBBABCCCAA"
  2⤵
  PID:12108
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCBACCBACCBCAACBBAAACCBBCACCCBCBABCAACCBBBABCCCAA"
    3⤵
    - Launches sc.exe
    PID:4792

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACCCBBCBBBBACCBAACAACCCABBACCBABBCAACCABCCBCCCCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACCCBBCBBBBACCBAACAACCCABBACCBABBCAACCABCCBCCCCACB.exe
1⤵
PID:8276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCCABBBBCCAAAACBCCCBCBACCCBCACCABBAABBBABBAAACCACBAACBBBAAACBACABBACCCCCAAACBAACCACABAACACBCCACACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAABCCAAABBBBABBCABCCAAABABCCCBBCCCBACBCABBCBCABACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCCABBBBCCAAAACBCCCBCBACCCBCACCABBAABBBABBAAACCACBAACBBBAAACBACABBACCCCCAAACBAACCACABAACACBCCACACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAABCCAAABBBBABBCABCCAAABABCCCBBCCCBACBCABBCBCABACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABBBBBCAABAACBABBBCACAABACCCBCBCBACCCCABABCBABCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAABCCAAABBBBABBCABCCAAABABCCCBBCCCBACBCABBCBCABACAC.exe" start= auto displayName= "UserDataSvc_CBABBBBBCAABAACBABBBCACAABACCCBCBCBACCCCABABCBABCBC"
  2⤵
  PID:10724
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABBBBBCAABAACBABBBCACAABACCCBCBCBACCCCABABCBABCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAABCCAAABBBBABBCABCCAAABABCCCBBCCCBACBCABBCBCABACAC.exe" start= auto displayName= "UserDataSvc_CBABBBBBCAABAACBABBBCACAABACCCBCBCBACCCCABABCBABCBC"
    3⤵
    - Launches sc.exe
    PID:4044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABBBBBCAABAACBABBBCACAABACCCBCBCBACCCCABABCBABCBC"
  2⤵
  PID:4008
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABBBBBCAABAACBABBBCACAABACCCBCBCBACCCCABABCBABCBC"
    3⤵
    - Launches sc.exe
    PID:11728

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBBBCBCBCBCACBBAAAAAABBCABACAACCCBACABCCCACCBCBCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBBBCBCBCBCACBBAAAAAABBCABACAACCCBACABCCCACCBCBCCBB.exe
1⤵
PID:8456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABAACACACCBCBBABBBCCCAABCCCCCCBABACBBBAABACBBCAABBACBBBBBBCCCCCCABCABCCAAACCCACACCACAABCCBBACCCCBBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCCBABCCABCCACAABAAABCAACBBCCCBACCACABBCCCACBBBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABAACACACCBCBBABBBCCCAABCCCCCCBABACBBBAABACBBCAABBACBBBBBBCCCCCCABCABCCAAACCCACACCACAABCCBBACCCCBBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCCBABCCABCCACAABAAABCAACBBCCCBACCACABBCCCACBBBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCAABAAACACCBCCABCACAACCCBCBCACACAABACAAABBBCACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCCBABCCABCCACAABAAABCAACBBCCCBACCACABBCCCACBBBABB.exe" start= auto displayName= "UserDataSvc_CABCAABAAACACCBCCABCACAACCCBCBCACACAABACAAABBBCACCC"
  2⤵
  PID:10596
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCAABAAACACCBCCABCACAACCCBCBCACACAABACAAABBBCACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCCBABCCABCCACAABAAABCAACBBCCCBACCACABBCCCACBBBABB.exe" start= auto displayName= "UserDataSvc_CABCAABAAACACCBCCABCACAACCCBCBCACACAABACAAABBBCACCC"
    3⤵
    PID:11912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCAABAAACACCBCCABCACAACCCBCBCACACAABACAAABBBCACCC"
  2⤵
  PID:11640
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCAABAAACACCBCCABCACAACCCBCBCACACAABACAAABBBCACCC"
    3⤵
    - Launches sc.exe
    PID:12556

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBCAAACBBCCCBABBBACABAABCCBCBCCBABBBAACBBCAABBCBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBCAAACBBCCCBABBBACABAABCCBCBCCBABBBAACBBCAABBCBBCA.exe
1⤵
PID:8480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACACACACBCABBBABABCCBCCBCABCCCCCCAAAABBBAAACCABAABAAACBCCAACCBCAACCAABBBBCABCACCAACACBABCBAABAABABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACABBCAAAAAABAABBBCCBBCCBACAAAABAAAAACCACBAABCCCABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACACACACBCABBBABABCCBCCBCABCCCCCCAAAABBBAAACCABAABAAACBCCAACCBCAACCAABBBBCABCACCAACACBABCBAABAABABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACABBCAAAAAABAABBBCCBBCCBACAAAABAAAAACCACBAABCCCABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBAAAABBBCCACBAABCBBABAACCCAACBCBCABABCBBBBBBCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACABBCAAAAAABAABBBCCBBCCBACAAAABAAAAACCACBAABCCCABAC.exe" start= auto displayName= "UserDataSvc_CACBAAAABBBCCACBAABCBBABAACCCAACBCBCABABCBBBBBBCBBB"
  2⤵
  PID:10052
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBAAAABBBCCACBAABCBBABAACCCAACBCBCABABCBBBBBBCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACABBCAAAAAABAABBBCCBBCCBACAAAABAAAAACCACBAABCCCABAC.exe" start= auto displayName= "UserDataSvc_CACBAAAABBBCCACBAABCBBABAACCCAACBCBCABABCBBBBBBCBBB"
    3⤵
    PID:11520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBAAAABBBCCACBAABCBBABAACCCAACBCBCABABCBBBBBBCBBB"
  2⤵
  PID:2360

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBBBCBCBCBCACBBAAAAAABBCABACAACCCBACABCCCACCBCBCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBBBCBCBCBCACBBAAAAAABBCABACAACCCBACABCCCACCBCBCCBB.exe
1⤵
PID:8768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCCBBCACCACCACABCBBACCABCCABCBAABCAACBCCBBCAACCCCBCABABCAAACCBABBCBCBBAAACACACCBCABBBBCBAACBBCAABBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCBCBCCCAAACABBCBBBBACBCBBACCAACCBABCCBBABACCCBBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCCBBCACCACCACABCBBACCABCCABCBAABCAACBCCBBCAACCCCBCABABCAAACCBABBCBCBBAAACACACCBCABBBBCBAACBBCAABBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCBCBCCCAAACABBCBBBBACBCBBACCAACCBABCCBBABACCCBBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACBCACABCCCCCBCBCBCBCAAAAACCCBCBABBAACAABCACBCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCBCBCCCAAACABBCBBBBACBCBBACCAACCBABCCBBABACCCBBCCB.exe" start= auto displayName= "UserDataSvc_ABACBCACABCCCCCBCBCBCBCAAAAACCCBCBABBAACAABCACBCABB"
  2⤵
  PID:11796
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACBCACABCCCCCBCBCBCBCAAAAACCCBCBABBAACAABCACBCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCBCBCCCAAACABBCBBBBACBCBBACCAACCBABCCBBABACCCBBCCB.exe" start= auto displayName= "UserDataSvc_ABACBCACABCCCCCBCBCBCBCAAAAACCCBCBABBAACAABCACBCABB"
    3⤵
    PID:3528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACBCACABCCCCCBCBCBCBCAAAAACCCBCBABBAACAABCACBCABB"
  2⤵
  PID:12520

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBABACBACBBBABCCABBBCBBACBACCCABBBCCCBCBCBCABCABAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBABACBACBBBABCCABBBCBBACBACCCABBBCCCBCBCBCABCABAACB.exe
1⤵
PID:9044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACCCACAACACAABCCBCAACAACBCACABBCBCCBACCBABBBACCBCCBBACBACCACBCBCCBCAACAAABBBABABCCBAAACBCAAACBACBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCAABCAACBBBCAACCBCABBBAABBBBBBAABBACCABBACCABAABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACCCACAACACAABCCBCAACAACBCACABBCBCCBACCBABBBACCBCCBBACBACCACBCBCCBCAACAAABBBABABCCBAAACBCAAACBACBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCAABCAACBBBCAACCBCABBBAABBBBBBAABBACCABBACCABAABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:12004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCCCCAABCAACBCABBBCCAACAAAACCABCBBABBCBCACCBCBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCAABCAACBBBCAACCBCABBBAABBBBBBAABBACCABBACCABAABBA.exe" start= auto displayName= "UserDataSvc_BACCCCCAABCAACBCABBBCCAACAAAACCABCBBABBCBCACCBCBCAC"
  2⤵
  PID:12236
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCCCCAABCAACBCABBBCCAACAAAACCABCBBABBCBCACCBCBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCAABCAACBBBCAACCBCABBBAABBBBBBAABBACCABBACCABAABBA.exe" start= auto displayName= "UserDataSvc_BACCCCCAABCAACBCABBBCCAACAAAACCABCBBABBCBCACCBCBCAC"
    3⤵
    - Launches sc.exe
    PID:12692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBCAAACBBCCCBABBBACABAABCCBCBCCBABBBAACBBCAABBCBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBCAAACBBCCCBABBBACABAABCCBCBCCBABBBAACBBCAABBCBBCA.exe
1⤵
PID:8636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCBAAACABABABBBAACCBBBBACBCCACBCBAABCACCAAAABABBCCCCBAAABAACBBAACBCABAACBCBBAAACCBAAABBBCCAACBBACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCACBCACABBCBABABABCCCBBABBCBBCABCABACBAABCBCCABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCBAAACABABABBBAACCBBBBACBCCACBCBAABCACCAAAABABBCCCCBAAABAACBBAACBCABAACBCBBAAACCBAAABBBCCAACBBACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCACBCACABBCBABABABCCCBBABBCBBCABCABACBAABCBCCABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:11924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACACCBBCAABACCABCCCCABBBCAACCBACBBACABBAAACCBCBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCACBCACABBCBABABABCCCBBABBCBBCABCABACBAABCBCCABAAA.exe" start= auto displayName= "UserDataSvc_BACACCBBCAABACCABCCCCABBBCAACCBACBBACABBAAACCBCBACA"
  2⤵
  PID:10832

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBBBCCBABCCCACACAABBABBBCBCCBACCCACCCCCCABACCABBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBBBCCBABCCCACACAABBABBBCBCCBACCCACCCCCCABACCABBAC.exe
1⤵
PID:4648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAACBBCACCCBBCABACAACCABBACCAACCCAAAAACCAABCCACCAABCABBBBBABABBACBACCCABCCBCCBBBBCBBBCAABBBBCABAABCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCCBCABBAAAAACAACAACBBCAACCBCAABACBACBACCBBBBCCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAACBBCACCCBBCABACAACCABBACCAACCCAAAAACCAABCCACCAABCABBBBBABABBACBACCCABCCBCCBBBBCBBBCAABBBBCABAABCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCCBCABBAAAAACAACAACBBCAACCBCAABACBACBACCBBBBCCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBCCBABACBCCACBBBBACBABBBACCACBBAAAAAACCACBABCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCCBCABBAAAAACAACAACBBCAACCBCAABACBACBACCBBBBCCABAB.exe" start= auto displayName= "UserDataSvc_BACBCCBABACBCCACBBBBACBABBBACCACBBAAAAAACCACBABCBAA"
  2⤵
  PID:13004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACACBBBCCBBBCACBACCBBBBBCBCBCAABBABABABCAACAAACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACACBBBCCBBBCACBACCBBBBBCBCBCAABBABABABCAACAAACBCA.exe
1⤵
PID:9172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCCCCBACACBABBABCCCBAABBBCACCAAABBBCCABBBBACBCCABCCCCBACBCCBCBCBACACCBACACBBBBBBCBBABAACAAABCBACACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCAAABBAACABAABBBCBBBCCABCBBCACACCCCABACBACBCAACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:12080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCCCCBACACBABBABCCCBAABBBCACCAAABBBCCABBBBACBCCABCCCCBACBCCBCBCBACACCBACACBBBBBBCBBABAACAAABCBACACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCAAABBAACABAABBBCBBBCCABCBBCACACCCCABACBACBCAACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:12836

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCABABBABBCCCBCACBBBCCBBBCBACBABACCBCBBCBAACCBBACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCABABBABBCCCBCACBBBCCBBBCBACBABACCBCBBCBAACCBBACAC.exe
1⤵
PID:9116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABACBAAAABBBBABACCCCCCCCBCABCBBCCCBBBBACACBBBBBCAACBBBBBCAACCBCACBCCABABBABBCBBCBCCACCBACACABAABBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACACBCCCAAACBBACCABCAABCAACAAACBCCBCCABCBAACAACCBABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABACBAAAABBBBABACCCCCCCCBCABCBBCCCBBBBACACBBBBBCAACBBBBBCAACCBCACBCCABABBABBCBBCBCCACCBACACABAABBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACACBCCCAAACBBACCABCAABCAACAAACBCCBCCABCBAACAACCBABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:13028

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCCACABCCBACBAACABAABBABBAACBBCCACABCABAABCAABABCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCCACABCCBACBAACABAABBABBAACBBCCACABCABAABCAABABCBCC.exe
1⤵
PID:1400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAABAACCBAABCBABAABCBABBABBABBCCCBBCACAABCBACBABABAACBCABBAACCAABCCAAABBBBBBCBCBCACACACBCCCABABCCBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABBBBAACBBCBBAACCCBBCCBABBBACACBBACBBCAABCABBCAABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:12672

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBBBCCBABCCCACACAABBABBBCBCCBACCCACCCCCCABACCABBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBBBCCBABCCCACACAABBABBBCBCCBACCCACCCCCCABACCABBAC.exe
1⤵
PID:1072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACCACBBCCABACBCCCBAACABABCAAABCCCABACABABAACBCBCBCCABCCBBBBBBCBCCBABBBCCCBCBBCCBAAACAABCCBBCABBCABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCCACBCCACBACBACCACBBCCBCCCBCBBCCBCACBCBBACBBAABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:12776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBABACBACBBBABCCABBBCBBACBACCCABBBCCCBCBCBCABCABAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBABACBACBBBABCCABBBCBBACBACCCABBBCCCBCBCBCABCABAACB.exe
1⤵
PID:9352

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACAACBABBBBCBCBBCBBCACBACACBCCACBCCCABCCBBCACCAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACAACBABBBBCBCBBCBBCACBACACBCCACBCCCABCCBBCACCAABAC.exe
1⤵
PID:8652

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACACBBBCCBBBCACBACCBBBBBCBCBCAABBABABABCAACAAACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACACBBBCCBBBCACBACCBBBBBCBCBCAABBABABABCAACAAACBCA.exe
1⤵
PID:1376

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCCBCAABBABCCCBACAAACBCBCCBCAAABBABCCCCAACBCABAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCCBCAABBABCCCBACAAACBCBCCBCAAABBABCCCCAACBCABAAAAB.exe
1⤵
PID:9180

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCABABBABBCCCBCACBBBCCBBBCBACBABACCBCBBCBAACCBBACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCABABBABBCCCBCACBBBCCBBBCBACBABACCBCBBCBAACCBBACAC.exe
1⤵
PID:8852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAAABACBCABAABAAABBBBACAACCCBABCAACCCCBBCCBBBCCBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAAABACBCABAABAAABBBBACAACCCBABCAACCCCBBCCBBBCCBCAB.exe
1⤵
PID:8604

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABBCAAACCAAACBCBACAABBACAABBBACCABACCABBCACABABAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABBCAAACCAAACBCBACAABBACAABBBACCABACCABBCACABABAABBB.exe
1⤵
PID:10032

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACAACBABBBBCBCBBCBBCACBACACBCCACBCCCABCCBBCACCAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACAACBABBBBCBCBBCBBCACBACACBCCACBCCCABCCBBCACCAABAC.exe
1⤵
PID:4324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCBAAACABABABBBAACCBBBBACBCCACBCBAABCACCAAAABABBCCCCBAAABAACBBAACBCABAACBCBBAAACCBAAABBBCCAACBBACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABCAACAABCACBBBABBAACACCABAAAAABCACCBCBCABBCBBCABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11524
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCBAAACABABABBBAACCBBBBACBCCACBCBAABCACCAAAABABBCCCCBAAABAACBBAACBCABAACBCBBAAACCBAAABBBCCAACBBACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABCAACAABCACBBBABBAACACCABAAAAABCACCBCBCABBCBBCABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCACAACBABABCBCBCCABABCACABCACBABBBBBBBCACACCACBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABCAACAABCACBBBABBAACACCABAAAAABCACCBCBCABBCBBCABAC.exe" start= auto displayName= "UserDataSvc_BCCACAACBABABCBCBCCABABCACABCACBABBBBBBBCACACCACBBB"
  2⤵
  PID:12104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACACBABCACCCCBABABAACBBBCCABBBAABBCCAAACCCCCCABCCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACACBABCACCCCBABABAACBBBCCABBBAABBCCAAACCCCCCABCCACB.exe
1⤵
PID:9992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCBCACBAACCACACCCCBAAAAABBAABBAAACAABCBBBCBAABABBBCAABCABBBBBABAAABBBBBBABACCBABCCBCCABBAABBBCBAAACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBBBCBCCBBCCBBCABACBABBCBACACCBACBCBACBBBACACABBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:12284

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAABCCAAABBBBABBCABCCAAABABCCCBBCCCBACBCABBCBCABACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAABCCAAABBBBABBCABCCAAABABCCCBBCCCBACBCABBCBCABACAC.exe
1⤵
PID:10328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCBCACBAACCACACCCCBAAAAABBAABBAAACAABCBBBCBAABABBBCAABCABBBBBABAAABBBBBBABACCBABCCBCCABBAABBBCBAAACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCAACCBCBBCCACBBCACBACBCAACABBBCAACABCAACAAACABCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11380

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBCBCACCABBBBCCCCCBBCCAAACAAACBABCBCABCABBACBBBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBCBCACCABBBBCCCCCBBCCAAACAAACBABCBCABCABBACBBBACA.exe
1⤵
PID:10384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBBCABACABBCBCCBABBACBCCCBCACBACBBAACACCBAACCCABBBACBBCAACACBBABCABCAACCCCAABBBCCABCCACCBABCCBCCCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCAACACCCCCBAABACBBCBBAABACCBBBBABBCBBACCBBBACCACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10836

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCABBAACBABCBBBBCACCABCBACAACAACCCBACCCAABCBCBBBBCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCABBAACBABCBBBBCACCABCBACAACAACCCBACCCAABCBCBBBBCBBC.exe
1⤵
PID:10812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBBABCBCBBABABCCBCAAAAAABABABCCABCACAACBABCBBBABACABCCACACCCABAAAAACCBBBABAABBABCBBCCCBABBCAABBCACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBABABBABCCBCBCACABBCCCBACAAABBCCABBCACBACCCAAABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBCACCCBABBCBBCAAACCBCAAACCBCACAAAACACCAABCCACACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBCACCCBABBCBBCAAACCBCAAACCBCACAAAACACCAABCCACACBB.exe
1⤵
PID:1800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCAACCBCBBCCACBBCACBACBCAACABBBCAACABCAACAAACABCBABBACBCBCABBABCAACBCACBCACCBCACCBCBAABBCCCACABCBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCAACCBCBBCCACBBCACBACBCAACABBBCAACABCAACAAACABCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:12272

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBCBCACCABBBBCCCCCBBCCAAACAAACBABCBCABCABBACBBBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBCBCACCABBBBCCCCCBBCCAAACAAACBABCBCABCABBACBBBACA.exe
1⤵
PID:5308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACABBCAAAAAABAABBBCCBBCCBACAAAABAAAAACCACBAABCCCABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACABBCAAAAAABAABBBCCBBCCBACAAAABAAAAACCACBAABCCCABAC.exe
1⤵
PID:2260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCCBABCCABCCACAABAAABCAACBBCCCBACCACABBCCCACBBBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCCBABCCABCCACAABAAABCAACBBCCCBACCACABBCCCACBBBABB.exe
1⤵
PID:9936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAAABACBCABAABAAABBBBACAACCCBABCAACCCCBBCCBBBCCBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAAABACBCABAABAAABBBBACAACCCBABCAACCCCBBCCBBBCCBCAB.exe
1⤵
PID:9620

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCCBCAABBABCCCBACAAACBCBCCBCAAABBABCCCCAACBCABAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCCBCAABBABCCCBACAAACBCBCCBCAAABBABCCCCAACBCABAAAAB.exe
1⤵
PID:4780

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCABACACAABACBCCBAABBCBBAABBBABACCAACAAABBAABACBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCABACACAABACBCCBAABBCBBAABBBABACCAACAAABBAABACBBBB.exe
1⤵
PID:10520

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAACBAAACBABCBCACBCCCBACAACBBBBCBBBCABACBABCCBCACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAACBAAACBABCBCACBCCCBACAACBBBBCBBBCABACBABCCBCACBAC.exe
1⤵
PID:9256

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBACABBCACCBCCABAAABCAACBCCCBCCABBCCCCABAAACACCAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBACABBCACCBCCABAAABCAACBCCCBCCABBCCCCABAAACACCAABB.exe
1⤵
PID:12144

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBAACCBCBCAABABCCCBABCBCBCCBBBAAABCCBBCBAAAABACBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBAACCBCBCAABABCCCBABCBCBCCBBBAAABCCBBCBAAAABACBABC.exe
1⤵
PID:12152

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCABBAACBABCBBBBCACCABCBACAACAACCCBACCCAABCBCBBBBCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCABBAACBABCBBBBCACCABCBACAACAACCCBACCCAABCBCBBBBCBBC.exe
1⤵
PID:9436

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABBCAAACCAAACBCBACAABBACAABBBACCABACCABBCACABABAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABBCAAACCAAACBCBACAABBACAABBBACCABACCABBCACABABAABBB.exe
1⤵
PID:11288

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBAACCBCBCAABABCCCBABCBCBCCBBBAAABCCBBCBAAAABACBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBAACCBCBCAABABCCCBABCBCBCCBBBAAABCCBBCBAAAABACBABC.exe
1⤵
PID:10456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABBBBCCAAAACBCCCBCBACCCBCACCABBAABBBABBAAACCACBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABBBBCCAAAACBCCCBCBACCCBCACCABBAABBBABBAAACCACBAAC.exe
1⤵
PID:11364

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABCCBABAABAAAABBBABBABBABCACCBCAACCBACAACCAACAABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABCCBABAABAAAABBBABBABBABCACCBCAACCBACAACCAACAABBAB.exe
1⤵
PID:9948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABCCBABAABAAAABBBABBABBABCACCBCAACCBACAACCAACAABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABCCBABAABAAAABBBABBABBABCACCBCAACCBACAACCAACAABBAB.exe
1⤵
PID:11016

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBACABBCACCBCCABAAABCAACBCCCBCCABBCCCCABAAACACCAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBACABBCACCBCCABAAABCAACBCCCBCCABBCCCCABAAACACCAABB.exe
1⤵
PID:11464

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCCBCABCCACBCAABCBCCCCCCCBCBBBABCABACCBBBCABCCBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCCBCABCCACBCAABCBCCCCCCCBCBBBABCABACCBBBCABCCBAAB.exe
1⤵
PID:11472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCACCCABBACBBAAACACACBABCABACCCAABCBABBACCCBBCCBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCACCCABBACBBAAACACACBABCABACCCAABCBABBACCCBBCCBAAC.exe
1⤵
PID:10620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAABCAACAACCACAAACABABAABCABAACABCBABAABCAAAAAABACBBBBACCCCBCCABABBABBCAABCCAACBBBABABBCBABBABAABABCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAAACCCCBAABACBBCACACABCBABCACCCABCBABBBBCBBAABAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:12748

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABCCABACABCAAAAACCBAACBCACBACAABABBBCBCBABCBABCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACABCCABACABCAAAAACCBAACBCACBACAABABBBCBCBABCBABCBAC.exe
1⤵
PID:12220

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACCCBCCBBCBCACCABABBBBBBACACCCBCCBBACAACCBCCBBCCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACCCBCCBBCBCACCABABBBBBBACACCCBCCBBACAACCBCCBBCCCBC.exe
1⤵
PID:11040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCAABCAACBBBCAACCBCABBBAABBBBBBAABBACCABBACCABAABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCAABCAACBBBCAACCBCABBBAABBBBBBAABBACCABBACCABAABBA.exe
1⤵
PID:2832

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABBBBCCAAAACBCCCBCBACCCBCACCABBAABBBABBAAACCACBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABBBBCCAAAACBCCCBCBACCCBCACCABBAABBBABBAAACCACBAAC.exe
1⤵
PID:11872

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCBCBCCCAAACABBCBBBBACBCBBACCAACCBABCCBBABACCCBBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCBCBCCCAAACABBCBBBBACBCBBACCAACCBABCCBBABACCCBBCCB.exe
1⤵
PID:11560

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCAAABBBBAAABBAAAAACCABCBBCAABCACCBBACBBCCACCCABBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCAAABBBBAAABBAAAAACCABCBBCAABCACCBBACBBCCACCCABBCAA.exe
1⤵
PID:5268

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAACBAAACBABCBCACBCCCBACAACBBBBCBBBCABACBABCCBCACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAACBAAACBABCBCACBCCCBACAACBBBBCBBBCABACBABCCBCACBAC.exe
1⤵
PID:12460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCCBCABCCACBCAABCBCCCCCCCBCBBBABCABACCBBBCABCCBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCCBCABCCACBCAABCBCCCCCCCBCBBBABCABACCBBBCABCCBAAB.exe
1⤵
PID:12468

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCACCCABBACBBAAACACACBABCABACCCAABCBABBACCCBBCCBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCACCCABBACBBAAACACACBABCABACCCAABCBABBACCCBBCCBAAC.exe
1⤵
PID:12484

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAABCCAAABBBBABBCABCCAAABABCCCBBCCCBACBCABBCBCABACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAABCCAAABBBBABBCABCCAAABABCCCBBCCCBACBCABBCBCABACAC.exe
1⤵
PID:12596

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCCBABCCABCCACAABAAABCAACBBCCCBACCACABBCCCACBBBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCCBABCCABCCACAABAAABCAACBBCCCBACCACABBCCCACBBBABB.exe
1⤵
PID:12900

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACCCBCCBBCBCACCABABBBBBBACACCCBCCBBACAACCBCCBBCCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACCCBCCBBCBCACCABABBBBBBACACCCBCCBBACAACCBCCBBCCCBC.exe
1⤵
PID:13068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 2952bc155066497df86ebcfe2f7ad9c8d79a9e0f5c3bdde2208b418b33401702
MD5 81d32680be0b6d60b958ee3360034f9d
SHA1 6e12b8e6b2d370d0660d8a6681e04213d7813b0a
SHA512 eade08af86c87b8bde47f8aef87dd800dbf7fb8a9a67dd511176e337da75bec52c8e4d1edf1b76a12f361895603f1e1becc6f46b2bdbe6c4f4762d15e7853e7c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Program Files\Common Files\System\ado\de-DE\qap`g`v~dtlq
Size 10B
SHA256 c93238ea7106e971ac5dbafc7564040d760cfafd9a94a8a675a8c59a02c45048
MD5 9c901c129d34000b452c12bdfb2269f6
SHA1 a8a04fed580385c98b68a90c2f7fd1638f728a13
SHA512 a8416727b13f08b58038ada449e4cef3b81637f2e11e5c4cca823ffdd7d327ac200b10ca54f502bb3e2e1a5604405ba6ae225f1d0467d00ad1e77db6c402a23e
MD5 SHA1 SHA512

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 14.9MB
SHA256 5ba672fae5b73a39b1172d9d68cb6d5197042f4aa481ce95eb07e7f084c5119c
MD5 5abff5c1e52ed849829dca652988ce10
SHA1 c3fdd8af1919c1497ccdfd0ab36e01d8811eed43
SHA512 0c772a86202f0bf57b2bd58bcc53f7db11e098bdd53df29e2135357e7c68aea2fe53bab8eb44cae9d2a0dd4b964ab694897f91b7501ef74fe7320d3ae443fe3a
SSDEEP 98304:B4TS4TS4TS4TS4TS4TS4TS4T6OU/jIEeQfoR/IuOFVjUu50oq2Vjnm3:BppppppphFIF0wuWGnO
TLSH
T108F67D12B6EC0168F0F30771DE799266A935FCEE6F22D5AF6549640E2973B40C939332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\qap`g`v~dtlq
Size 10B
SHA256 b7ce1f033ac0f95df28f41cc6399f2cb0239d6a41aaee47c31421fbdc6b4ce24
MD5 3c18500908f773478fad1ac7e45d752e
SHA1 b3a0b366e08836273d90fd07a4a32c2e382f6b9b
SHA512 18b8e4a863740af73e75b10bfef05be52c1b3481894281396a25829becd3a4c2c988b841c389748f13973ab1ef3b4d1cf7b2b1599c61201e01e9dea7cb46207f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\qap`g`v~dtlq
Size 10B
SHA256 96a9f9750bd62be9bb2cd56fb4e3f19200827abe2a4305d651c57d22bd4ebba5
MD5 ca60f2acbb67a680c4695779f01ac3a6
SHA1 170b2828526ff077eec0facf819187e7b9c90dc4
SHA512 f25713fb1ab2c418af31775d776a4c863477727baf650886ff261cd29c07ebebf278b96b52cac7b953a0a96879569dcb9a2023fbaae3adf36a3549018d5f8122
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Program Files\Common Files\microsoft shared\ink\as-IN\qap`g`v~dtlq
Size 10B
SHA256 a5b136ee18066d2a7b4a7911ea3b64a0b564aa3dc3702e6ceb7519982c7806cb
MD5 0e7ff71d90cce87065380ea6b6176490
SHA1 a92b7fc27f6a85cd4a5aebb44a5be688af2f4530
SHA512 ec57cbbb5a364425239ec91cc72658024ca55144f99cad94c8578eba9866cfa2e619ef7660e184b0fcc2107964aabcdcfa0892110d9da7c72a07472323d61c3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Program Files\Common Files\microsoft shared\ink\gl-ES\qap`g`v~dtlq
Size 10B
SHA256 dac319bc0b1be2c7e29ac9fb87e2c121826a5dfd9595cbebeada38343259a991
MD5 dbf78b80e4e6b7e1ba7c7a9da89f7803
SHA1 114d6e8167393e4b8f989905468788e996c26faf
SHA512 6bbe2af8e46740667d0c03e909dbaec4f901309284002f0985bd6b8afc5da7810ad17cae6c6ae31fec9c1f5430009095522240f99dbac3cc4fd3ed7e5f543906
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Program Files\Common Files\microsoft shared\ink\vi-VN\qap`g`v~dtlq
Size 10B
SHA256 1881140eb539c5b3d5200e8fe364bfc3c8aa620ac02941d5c70d0006bd1c7b03
MD5 8b2ee30d8447c427ecd9c923cbe07934
SHA1 3c2e63abc48ee8c01521864ef544ad339c6877fa
SHA512 8c5ad0fc5db9b8e2f343150db0c25b202dd59cdc14876d5a60ce431c4a33e64101ded215cb903c5ec8b3f672abf2ef57088dfa0cc7110f6007864b0c478f5f0a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\qap`g`v~dtlq
Size 10B
SHA256 d40e58cf1227c7daec6334de26c7b7015d68cfe87d75755adf512d8d8610a990
MD5 fc61fbe50dc2440b1dab378e846277ad
SHA1 0680a4726e25f8953594ce9ab56983d0f2fb8f40
SHA512 8b24d8ffbc3da4bddb5500ea436ac6517a2594926347f34affdf2d67eccb4c1f737f4970421062a0d28fc87e91af57f84909a5bcf4d8d08e6e5acdbd957eb997
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\win_x64\qap`g`v~dtlq
Size 10B
SHA256 129d403f48b9027d27e29956192afc8a5e0b3f4ce261a1b6d2c02fa4cb270c96
MD5 cf92ff6e39003e531ce88f2cef58b078
SHA1 62d951436180ee062e191c54ee4cf32e2a642ce7
SHA512 f5fd88bf961a4a7f51a7b99a77a6a738cacbfe7eabd5863cc3a5a48138cb1c75c4c1d9326cae3312cd6d97f83acd9e4435b535e03d1e1144655b093cfb2fefff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Program Files\Internet Explorer\es-ES\qap`g`v~dtlq
Size 10B
SHA256 d3f74b165ef1e145ba93e0d8e443d55ac41d0e7a3585e10b577567da5a5a2118
MD5 339405b6806d620b3246293573bbdd1d
SHA1 d1a0bbf4c41d93295ee4c1a8ac2f0b62baa1d9e8
SHA512 e40df99a9fc4266e3c4bb376987959db3deb5f4126dffbcabbb2a1c56f5916aa50ef5d1291cd3745196f507b6f2bdc007ed2d388d2514cfed0f4604d9cf19713
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Program Files\dotnet\host\fxr\8.0.15\qap`g`v~dtlq
Size 10B
SHA256 0453fe8dedc139a67262eba3919bc71fe97d1c804b177672499622a1832d8384
MD5 c4dad1ca239dd304a6602d9aa3e4f5f5
SHA1 9855a0e9208bfb5a517ea8b1c7bfe03d0541e94a
SHA512 c041e697cb686319587703676f29355fd5077aaa7c3071ae261a77f4b8ae1423f26252cf772f9c3a4b3815c0992405ead8467023cf3cd4f882140d79718fed5a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\qap`g`v~dtlq
Size 10B
SHA256 28c45dd69d136788a24a6130d2a0b00e5b88104740e2dae731d9b54b2b6ee20c
MD5 ccde93c3d91ac27701312162e3362a03
SHA1 b54f03e25b5d65c4d422145077b7c56a8ce0e523
SHA512 ef221b8cedb2bc898812b52bf1df43e9c0822decd6e691e71e778bc8960f4cab5b2ca96b07cfa124862ace042b4e847d3d0ee5104cb0df68e08f353924b63ca7
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Admin\AppData\Local\Temp\virus_log.txt
Size 1KB
SHA256 2d363cfb2fef95d431a09fb07353ec08844027d2e1fc9bbbd1808a6fd6b14ed6
MD5 63691a227156e9bf1ce0b7fdee0c08e1
SHA1 a9d7bed34b72b1762d159b7cef308e24ccd8495a
SHA512 1625841d9e4d426e589f2b9662bf17bd43318acf671017ea5631d4e2abd0eb9a05f861752d3f5c5989d457c74a726af7080bc272c8138430410b2d4d782cc62e
TLSH
T17D412612C1E9DC77D1209587A62BFFCDC4D4FA5BBC58AA2693C84529BB95C33DC1A0C1
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f183abf20179d5a6669c0dd68d5ef0fc08bd26e4b53059619d6a868af5c935f2
MD5 ec99787ef0fcf72b090de7e6b3ab765b
SHA1 7306f9def36aa84319eb6d6852f4c613423e571a
SHA512 617fabae68f297f64811eba14f9a5c68917929909f100bd5f592916b1ae06f1f7d80b12bb6c3e280b09ea3be28ea4dbf2d63c8a6944ac76a5e870e5fcd05da8a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b6cc59d9bc345e2b9e3ab3cc54ee807f972775e6af74faefae57fa0cc9eb856b
MD5 cab99133eb54a25d3e6bf9579dc48e65
SHA1 af41049178ac74c59516a82ea7a1ac52bf4f7084
SHA512 1192fc6685b7fb4740d84a27244ebb447cf861d15ce0edf45031e0294782ea5225b4387163ee2575d19613f70151fffdf3060dec9a28696468cd135935608adc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4986d59b2b276ef435f30367490e3266a8e0e5900e2db35f349371888bb3eb22
MD5 b1345761f8cb3ebe9028b9e80669ae12
SHA1 a614a9c29caf1d68ea5aa400800fac71d8fa133f
SHA512 496bad123b9e464f9d514eff3b37ca6b3425f8b07a72df043ec80a2bcfc2c8bc63fcd9660cbb807c2d30a30f72665bbe1eeaad0bb8bb8aff24d300013683d004
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8e6226e5f57bb20aa42e119d98ce7d3060867328741227dd1b896d3e95758f98
MD5 cd446c58ee8811274818140d95f0875f
SHA1 ab5c36b2d40786709421884fe69e8fd2ddb28cb6
SHA512 82dc069004bd7554b6975ea90f24081c3e7a3f9a6926699a0ead3032547f1dd18c262d577a670680cf4fb24b49df38cef0f3bab535d177352eb20bb6a9de461e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 34e6fbcae92abc4a0626f71edd4ce019215c2367846448d025e0ff8b99be63fd
MD5 d11bf34014ed42277194774132d8ab8c
SHA1 ab8b06676ae3b792db6d43bfc254fb92e35b0d03
SHA512 dd29db8e763e07cb15d066f73eb22d1a369b2f596add61a11a27500336de9378cfde0c80b458103b6ca6beb346e4b6963eeb213fc19df29cc27d224879807dfe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ace63a7de792f4c00c6e890adddbd6c0327ea2f12f85fee6c4e2fd5f8abe142d
MD5 1b6e4ea66c286fbc1dcb2106cc894c88
SHA1 1fc920809a69f76275be99a37a8e97eddc1b9c6b
SHA512 3fd8dab707a7fe7bf51de38a2e5062bc011289007b2233fb9e61ff4ceb8038b959216aff49f16e1f7bf37048b6391dd8db8440159921939d80de7c89413490f5
MD5 SHA1 SHA512

Submit Download

svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACAABBAAABABCBABACCCACACBCABCABACAACCCAACBACCCCCBCB.exe
Size 12.8MB
SHA256 f857a2b99a4ebd63b0b07afa416f09d48bfdad964bea0f62e15b2f0756fa3c67
MD5 5dcbb1125a348fde6e6190673893000c
SHA1 5c0493a86db68d353aa62c222a6a7d20d425c355
SHA512 8c92f9fa09cbd5f17b59c92f708277edba16dce8ea3c2092a81a37c6d6c8542430aec1317b888f512d42de2f66c2dfcd17a9c9e118dd28ebe03577c1299883b0
SSDEEP 98304:B4TS4TS4TS4TS4TS4TS4TS4T6OU/jIEeQfoR/IuOFVjUu54:BppppppphFIF0wum
TLSH
T13ED67C12B6ED016DF0F30B31EE39A266A935FCFE6E12D55E6549740E2672B00C929337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 690d5200360163e3697f74b8f08f7dcc08ffd4165f39532e39bde9ffd9cf90b8
MD5 5730f0420991726bc275f0b80a93891a
SHA1 060ad3339529688486ad541d9d5481c44a79f881
SHA512 8c9082377a48767295e89f4e0e8b33188d9cb578d5d5065255c236d368db4ff697f3b853e85ee89e9390686a79073f5be729466b320a752a80e6c85582b20cfd
SSDEEP 96:oDA1FFB4FWr+wbQI4pS1yL4elrR+h+8lX7JXTD1bcqt4qECEP50W+w0LkFq1Vx4E:/VeS/QgC2JgIYq0Qcb1GKju
TLSH
T182B10521E1E5DCB3E13269C7961AABD149E8B39FEC8C9A1552C94228BFD5C33CD1D0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 e63caea140f8bae02463eb65300d9ba4291f72ec444aa7530b3054076e2a5bb5
MD5 5dc031cf0214d4503f987be260f96d90
SHA1 9014101ff524deefabfe71564f1b7284628eda03
SHA512 8ab9ddc8054c7bd7900fc5aff887e62541d888bab1961da9e2215791f4762a75817e169bd314faf9fd1b1a166b6dcaa766444c60a7809fbe41101ca342e96ce3
SSDEEP 96:oDA1FFB4FWr+wbQI4pS1yL4elrR+h+8lX7JXTD1bcqt4qECEP50W+w0LkFq1Vx4M:/VeS/QgC2JgIYq0Qcb1GKjb2
TLSH
T1D4C10721E1E5DCB3E13269C7961AABD149E8B39FEC8C9A1552C94228BFD5C33CD1D0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 892b74ee14b9c9809fce1027311e9a0fc983c8b0ef015fe6d9abfdfcc21b07d5
MD5 59b291e4c1ab1655154d9a786a61a108
SHA1 8050f1d8574caf6e7eb2f45b5650bd0616666588
SHA512 5439f2601c5abaedf1ba2ed0eb6939050984e00a572135bce50e637a59247dfb93e68a5c97ba6f97814180423162d8af3d4dd7457a0cf1b14b45fc7f754feec7
SSDEEP 96:oDA1FFB4FWr+wbQI4pS1yL4elrR+h+8lX7JXTD1bcqt4qECEP50W+w0LkFq1Vx4J:/VeS/QgC2JgIYq0Qcb1GKjbj7
TLSH
T19BC10821E1E5DCB3E13269C7961AABD149E8B39FEC8C9A1552C94228BFD5C33CD1D0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 c59c21c260a5040b936c85cdd44465fee2889a6a7ce74a0ad3511ca0c96015db
MD5 415792a44673bee2179f042ec7bab9e8
SHA1 40437b2b9f6294a60e030fb96a12ca1bec91a4cc
SHA512 9ca305fdea2e47c99a38214c06a32ee061d2e6697b095de68f36e96b450d2bc8833656d3e56e0185114ff76c81ece914e3522353e64aef01c4887289cb91238d
SSDEEP 96:oDA1FFB4FWr+wbQI4pS1yL4elrR+h+8lX7JXTD1bcqt4qECEP50W+w0LkFq1Vx4w:/VeS/QgC2JgIYq0Qcb1GKjbj2
TLSH
T1F0C10921E1E5DCB3E13269C7961AABD149E8B39FEC8C9A1552C94228BFD5C33CD1D0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 50c0be1ef7b669c4976bf80a85870fda11b1cf344a76715ae0a9a63677c7db61
MD5 b9409d893851ffed44981a751e7dfd35
SHA1 4080754332f75b557e53e7875beb18c4cfb447d7
SHA512 64bf93f192efc9d101ae5271aa4502c5feea22068b07ac88ac5bcc4dd7d158decb0eabf233145986c50e02cc425cffce57a2a318f023cfb110c26af19df60f77
SSDEEP 192:/VeS/QgC2JgIYq0Qcb1GKjbjnp+nsqlr7:9eS/Qz2qIYZFb1GKjbjp+nsqlr7
TLSH
T1C6F11821E1E5DC73E13265C7961AABD54DE4F39BAC8C9A1553C94228BFE5C33CC190D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 a89f82bfda82df028a8ccbf681ab4928cc84ae831e0262e345abeb346f31f276
MD5 81e41100f4790e50f0ca931d22ed74eb
SHA1 7148caa3eeff52e3767f4f48f26fa129c9be5ebc
SHA512 fb7b955ec16b1a8d0afa61804346112aa13caa57a7d28f51c6252fae9e405e03f07c0d7836b575f549ad8f79fd667c03c6d886b8b8bb7a325e3b8f1c71c121c7
SSDEEP 192:/VeS/QgC2JgIYq0Qcb1GKjbjnp+nsqlr5f:9eS/Qz2qIYZFb1GKjbjp+nsqlr5f
TLSH
T1DCF10821E1E5DC73E13265C7962AABD58DE8F39BAC8C9A1553C94228BFE5C33CC190D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 fa2f81fd61e41e6dea212a9236c914938647599d1892466f4b348016d04d6b1f
MD5 f244e0b2ac0b5fd282bf7b800ad68e45
SHA1 bf3b0bc090de8a882c81e5d3605dbfbafc4ac70f
SHA512 2344c6df8ea78beaae7bcfb528489c7b701926dcfe9f73f11cf96e4ab7cfeb7c0f349cc95839f65abdd2db9fc2f5c6c291bb92957cec6dff2a1314a5e98973e3
SSDEEP 192:/VeS/QgC2JgIYq0Qcb1GKjbjnp+nsqlr5Im1tevX:9eS/Qz2qIYZFb1GKjbjp+nsqlr5D1te/
TLSH
T1B5120821E1E5DC73E23269C7961AABD58DE4F39BBC8C5A1553C98228BFA5C33CC190D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 10KB
SHA256 896e9a9283b27242cd769191335d9d10dfa09230c311c303f5df29b2248397d2
MD5 d0039329f5703e623481712a93934a32
SHA1 1cf2025f01045a67e894a9343ce22426980d5732
SHA512 cda6764f64a00aa70f69ab39f865c4218189fd4778efb395f2486f4eb35da8122683c87fbf44c6a4a43324c9129cdb551378035272bc49db0bacaa705f9dd50b
SSDEEP 192:/VeS/QgC2JgIYq0Qcb1GKjbjnp+nsqlr5Im1teveQ/4:9eS/Qz2qIYZFb1GKjbjp+nsqlr5D1te0
TLSH
T14B22F831E1E5DC73E23229C79A1AABD54DE4F39FAC8C5A1552C98628BF95C33CC190D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 81dbaae1c25a72870b25614e0457418bc85de53fd2a8db28cd302445ac5bf784
MD5 d94dbbc891493c44ee0eec4006035213
SHA1 c969c224e4505e75883ba2311b7d5efa066ce03b
SHA512 740809e6a6b9da5f5c066b80fa76be9f6773fc47052e3b45da22c3a359d77539604acffc0cc338dd0ac038e988ea5791697942a98eda225e3d44ce16cc0859fd
SSDEEP 384:9eS/Qz2qIYZFb1GKjbjp+nsqlr5D1tevb/pyrTZ:9eS/0bvZFb1GKjR+ns4lD1tUbByp
TLSH
T14242E932E1E5DC73E13229C79A1AABD54DE4F39BBC8C5A1562C98628BF95C33CC190D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 abe7af9df763c173350b61ee56d59f37add1e9ab357cf79dd53d4cf8f2176b0d
MD5 54b2da7b9516e2f3d1b965a4f9bf61e0
SHA1 cc935442d98f42acaf02fb4d89958c8b40cf1a39
SHA512 958b9593802fadc6175be5098f625a8c6afe377d8a8792800371c310aaacee2204cdcdfd05d49ee1ac4c634bb0d23958c73af6edf518873f3a34d4c20ac6b950
SSDEEP 384:9eS/Qz2qIYZFb1GKjbjp+nsqlr5D1tevb/pyrTilKp:9eS/0bvZFb1GKjR+ns4lD1tUbByy8p
TLSH
T17842E832E1E5DC73E13229C79A1AABD14DE4F39BBC8C5A1562C98628BF95C33CC194D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 13KB
SHA256 27bc4fc05eb2a34b1b3c160bef7bd942130e86a362810cf831e7189161768dc0
MD5 62c2286b1b159e297949dd44c517dc27
SHA1 d62acca443b42da49a4dd653a74599eea3b95068
SHA512 f9f30025553713dd47154ada50a973da30dcffe88a13ebae8c6e8c354b6421b27f467e321bc677a160265b109e2345faf050301bcb160d2f740bb6af70352e25
SSDEEP 384:9eS/Qz2qIYZFb1GKjbjp+nsqlr5D1tevb/pyrTilKIRd:9eS/0bvZFb1GKjR+ns4lD1tUbByy8ID
TLSH
T159520832E1E5DC73E13269C79A1AABD54DE4F39BBC8C5A1562C98228BF95C33CC190D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 56a0ea72c0ae3c260be9ab1c7ac131fd7459067041b7b17bada372ec7d50f131
MD5 7ea6eb0f2891497bb46ffa869c004234
SHA1 3eb4a50008ba105b1ad207a605c087d9fc05482b
SHA512 cad492053024c71d1f621d19e68dd362ea54d9331c4ccbef4b81e089808d6958453edfdd37112e9419ef2a83b863ecaa92de90bb000d83907ee473cfd312fcdc
SSDEEP 384:9eS/Qz2qIYZFb1GKjbjp+nsqlr5D1tevb/pyrTilKIRop:9eS/0bvZFb1GKjR+ns4lD1tUbByy8Iup
TLSH
T1F152F832E1E5DC73E13269C79A1AABD54DE4F39BBC8C5A1562C98228BF95C33CC190D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 15KB
SHA256 680044dbf14b2520265d5af0818d01b5ca7b927b395e900ceecd4d2f0cf70cbc
MD5 9f0ef8f70164256f31843e2d7ce67354
SHA1 e7813ef933a3b52dac0c7e4b4c6d1d210e968ecf
SHA512 46dd0e0c5e4cc9faf11ba51d857bbc98bb1f43646caeb7f4473ed7ec517e65400ea068dd9eb1848abec2807a80d37ec0aa0af012d79b2b7d743d5d0210619179
SSDEEP 384:9eS/Qz2qIYZFb1GKjbjp+nsqlr5D1tevb/pyrTilKIRoAbe:9eS/0bvZFb1GKjR+ns4lD1tUbByy8IuF
TLSH
T16262F732E1E5DC73E13229C79A1AABD54DE4F39BBC8C5A1562C98228BF95C33CC194D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 af933f1e442172e2ce410125a95a47e211aae70f8428d8719880c12e537f42e7
MD5 d108f59ee7b9503ed6a181f36e9a090e
SHA1 7ed6dad8230ea10b6ca45744ffea9bb407ba362c
SHA512 1bcc5b2bc9c3faef658c361ca45aaba1eeb20b2c9c5dcd8ac4b22d846ab2ff5850b3c1fda0a1bd4867f9e80631e27d965ec011f399705471c78e7804c6f642b2
TLSH
T17F21C922E0E5DCA7E13265CAD615EBE148D4B29FA89C991153CD4228BFD9C33CD1D4F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 15KB
SHA256 f15e0af405d9cf7720a0e52969c8c90df4afdeb10caaa249e40829df4a29a599
MD5 0b2d48bb8698fa3d45dd48443311916b
SHA1 38b78c2c5173831e4d49b33cd9ce180d78c0e693
SHA512 1f74b31632384320de609e1930fe3eedcc7a0fd1141ecf181118d64f5f57d41047ed76250a5ad0168e4f5d8e613d1bc593eb81a676acd107dc6a6c65baee1105
SSDEEP 384:9eS/Qz2qIYZFb1GKjbjp+nsqlr5D1tevb/pyrTilKIRoAb7:9eS/0bvZFb1GKjR+ns4lD1tUbByy8Iuy
TLSH
T16862F721E1E5DC73E13229C79A2AABD54DE4F39BBC8C5A1563C98228BF95C33CC194D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 16KB
SHA256 4071fc0ae44fa38d3478b1e352e57f01829edba5472e0adf2732c71dc09565df
MD5 aead9c8d3dfdcdf6a9e17970bb817244
SHA1 cf5252d7069a82e215ef16aa4f36c0b4256abf26
SHA512 edbda0225a587ca1a5e11832f1f99d4c1dbe879df2b3d6e20f78e44e706b6808bc12c8a24f46f4e0e225177962a4a849a36d1466f8519a1221857512706ba6fa
SSDEEP 384:9eS/Qz2qIYZFb1GKjbjp+nsqlr5D1tevb/pyrTilKIRoAbZlK:9eS/0bvZFb1GKjR+ns4lD1tUbByy8Iu5
TLSH
T1F1721732E1E5DC73E13269C79A1AABD14DE4B39BBC8C5A1563C98228BF95C33CC194D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 16KB
SHA256 a9530acab83dee788a3550fe1cfedfe73a47f072c8c2e268dcc0b23f3c771376
MD5 19b08ee1552e36b17a245c84c1a94ca6
SHA1 49b2b92c0f83c1168875131f2952865461552c47
SHA512 e228a1809989c122829a34c2dda2ab14a91bfbc7522b7fcf0f0c9e03475fa916acc9e3bb956e1569e78917a058e1fc3c0df94c4fbb80637f6c379ad66bfca29e
SSDEEP 384:9eS/Qz2qIYZFb1GKjbjp+nsqlr5D1tevb/pyrTilKIRoAbZl8j:9eS/0bvZFb1GKjR+ns4lD1tUbByy8Iup
TLSH
T141720831E1E5DC73E13269C79A1AABD14DE4B39BAC8C5A1563C98228BF95C33CC194D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 16KB
SHA256 f0a4bbbaa3a9ba446b8da54cf18d42dab1d5d7a2099da912ce9ed7cebcff21fe
MD5 890c8f61ec59012d48ec2d6e748d8f54
SHA1 6e41dd5f10d170f842e5458747ad51b74fc2ea29
SHA512 3fa3a7e1cba0fe84014353259b683cc277c61ce7b41e09a351dfb37411653b2e96bdc4491cc43c6d7ae04e52cfddfe68cc51c274501099e2977ebce5c7500019
SSDEEP 384:9eS/Qz2qIYZFb1GKjbjp+nsqlr5D1tevb/pyrTilKIRoAbZl8n/:9eS/0bvZFb1GKjR+ns4lD1tUbByy8Iu1
TLSH
T198720831E1E5DC73E13269C79A1AABD14DE4F39BAC8C5A1563C98228BF95C33CC194D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 16KB
SHA256 5dc9e4f45fc2c53035c43cbc35f0d66819f4a845c13e96388cb0430185c0372b
MD5 f387573d0f0d28ed7db4c4fd262e108e
SHA1 73db40538a564754c12e6e19cb08756cb5da0f5c
SHA512 282b95bd40095481f9b7a778d3425c1d122d4d7059a435645d3104a3e4d5d868e8f31c27b23fe5e37ba5008b2c0952203327149e3a622194bdf1ed64e45a2b9f
SSDEEP 384:9eS/Qz2qIYZFb1GKjbjp+nsqlr5D1tevb/pyrTilKIRoAbZl8nG:9eS/0bvZFb1GKjR+ns4lD1tUbByy8Iu8
TLSH
T1D3721831E1E5DC73E13269C79A1AABD14DE4F39BAC8C5A2563C98228BF95C33CC194D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 16KB
SHA256 b00bccbab00627b5e986897fe2b4ab9232c704dea45625242cdb4e7bec3ede58
MD5 f2ab4a1048a92ba457958cc9af3f1911
SHA1 cbe3d8fe60db75a0f0e815789b109e10234e46c6
SHA512 8027472df018a58b29d36aa2fcdc483e84da3d51553ce78125d796ad0496c77a6a6a40073998c87c747a40ec14081deb209d44b2674aae1c3b9c11a624af6e8b
SSDEEP 384:9eS/Qz2qIYZFb1GKjbjp+nsqlr5D1tevb/pyrTilKIRoAbZl8ny:9eS/0bvZFb1GKjR+ns4lD1tUbByy8Iu8
TLSH
T148721831E1E5DC73E13269C79A1AABD14DE4F39BAC8C5A2563C98228BF95C33CC194D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 17KB
SHA256 802e22623620a4204efa662c737d663e2b74d4d2420b14c196ea6eb023239de4
MD5 0e75dea9f3f46e7c3f3df38d5fd0cd3d
SHA1 ee2d3196ca3db1477e98f85de72e4d04e4751cf9
SHA512 84502c3cfd741075d05a4e7629719139beb9e5d2162a4ee85a4d057b638836120187552a8e8c7c4412c2b95df74bfd7a5bec5152e6b696058f7b6ed2252a1903
SSDEEP 384:9eS/Qz2qIYZFb1GKjbjp+nsqlr5D1tevb/pyrTilKIRoAbZl8nC4ysy:9eS/0bvZFb1GKjR+ns4lD1tUbByy8Iuu
TLSH
T12B822931E1E5DC77E13229CB9A1AEBD14DE4B39BAC8C5A1563C98228BF95C33CC194D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 19KB
SHA256 cbe3315c80abb1e9e431e51f63d3aa5c0efd2c7996eac6c0c5185b500472245e
MD5 33008f7ca982ce1df1f854d7cd0bc492
SHA1 199a0f0c18cdbbd053556fe799a7be1214ebe658
SHA512 5395c759da53ea5a02a55f36eee30b99f996a5611c603ca648d5252d828f086169167de230fe0aa5bc5ce07d3f82c17ff24bf0f9d3819583dd519f28a6d24dda
SSDEEP 384:9eS/Qz2qIYZFb1GKjbjp+nsqlr5D1tevb/pyrTilKIRoAbZl8nC4ysY:9eS/0bvZFb1GKjR+ns4lD1tUbByy8IuM
TLSH
T18A921931E1E5DC77E13229C79A1AABD14DE4B39BBC8C5A1563C98228BF95C33CC194D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 19KB
SHA256 2d18c498359305687a9e4b0decd21793445455d1e8c19d3de4fe725754a27aad
MD5 4af51b5d3f034b54ebaac769f02cf102
SHA1 0e533e5cec4e20de9da80f8c256fdf074c1312b6
SHA512 e0326389721a2c151de786f5d585e1b2ee244f0883f7d210f814e8a11dee1e676c7ebd9bf6b37846421131a425f060d11f440624d886a9f4d06efa8f6615f1d4
SSDEEP 384:9eS/Qz2qIYZFb1GKjbjp+nsqlr5D1tevb/pyrTilKIRoAbZl8nC4ysjU:9eS/0bvZFb1GKjR+ns4lD1tUbByy8Ius
TLSH
T1DB921931E1E5DC77E13229CB9A1AABD14DE4B39BBC8C5A1563C98228BF95C33CC194D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 19KB
SHA256 120ac758a0c0793a55408bb9c225122144132c6d07cea3c8273fa7e72689f00e
MD5 769eed103b62016ff796811b562c71cf
SHA1 1940368e3cfee3e149892a58e71fe499f5e52737
SHA512 decf57823775fe174cc43c3138afd8987b816013439be4957cd4e50fb2f0385b4306f132cf7f8c9f5955d70bd5e06c0e3b74935f10e80f62b48b0bc299aa8516
SSDEEP 384:9eS/Qz2qIYZFb1GKjbjp+nsqlr5D1tevb/pyrTilKIRoAbZl8nC4ysjXz:9eS/0bvZFb1GKjR+ns4lD1tUbByy8IuL
TLSH
T1D7922931E1E5DC77E13269C79A2AEBD14DE4B39BAC8C5A1563C98228BF95C33CC190D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 19KB
SHA256 2f4f237d47688a3fbf1b64e4945143a8c5dbc0cc8d248c15bbb47da0b3b366eb
MD5 bb98df6c7e452f31118a54ee726386c6
SHA1 fd185d80095afed4e77f78faefd43962759f181e
SHA512 8c37e06d573545c14a61d0313a3a85b988ec4a1e8e4fbdabc983b9f2897f6e65eac28c21d5fc628c5affcd3c804d693c5db000528e263450a474f1b10220418b
SSDEEP 384:9eS/Qz2qIYZFb1GKjbjp+nsqlr5D1tevb/pyrTilKIRoAbZl8nC4ysjXZ6:9eS/0bvZFb1GKjR+ns4lD1tUbByy8Iu4
TLSH
T156922A31E1E5DC77E13269C79A2AEBD14DE4B39BAC8C5A1563C98228BF95C33CC190D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 f8b38fb076a5b3084b50def56fd71d5e319dd9d872fdeeeb60ae7411a72c21a1
MD5 bea92a84159e27e8fccf3ac314c30500
SHA1 7365a14757594f06875d32040a077198a5e24828
SHA512 991e56f4342757dd7529713f51142aa1476783cc5d58de32dfed3cab04abe6419029aee6fba843368d28a46793b24e2e68b8291accb144e497a4ad182820e547
TLSH
T1E441D522E1E5DCA7E13369C79516AFD149E8B29FE88C9A1153C94228BFD5C33CC2D4E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 6937d66ddb4ec9840778ca43f2a6ec0df19c1e63ee42823e70ecf929aea2f100
MD5 704e96ce98581f41c9ff720016283927
SHA1 50c6fbfc96176dbfd0c697ff27c305e27c9e6f3a
SHA512 282c70bd85415e86377ddc3cb4a1c7521913e9fffcb7a26498f8f094b9317c71cafd61f5adbcb011b73e32131a06620b4f2766581c2f4bb240c808def2358768
TLSH
T14D710722A1E5DCA7E13265C79516AFD148E4B39FEC8C9A1153C94228BFD5C33CD1D4E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 5f80f9c6aaf5d573ac85ce44042f945f4b3cd9ba600ac180c459f3d72b8775f7
MD5 2a6a04468a03668ef5eaa032e4b5bccf
SHA1 514b40414221d537e22acaa7d28f7c0bc7fb48f8
SHA512 43f286dc87f49178f0f555764e29c4c8f123c5d2f21748790b10c2c8bc535ecd418d8d7cf58bd562e3edd907f58ba71a19405f3e9086d10a217cc1cefe3eacc6
SSDEEP 96:oDA1FFB4FWr+wbQI4pS1yL4elrR+h+8lX7JXTD1bcqt4qECEP50W+w0LkFq1Vx4c:/VeS/QgC2JgIYq0Qcb1O
TLSH
T1BCB11921E1E5DCB3E13265C7951AAFD249D8B29FFC8C9A1552C94228BF95C33CD1D0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 65d2fa334640dbce32a395208f412ab8a5b83521b2ef60b2c7cd16375f5b5be5
MD5 26f1e955906d8f38cb382849b4d2ec98
SHA1 e6b37af16bb0c24cb0f27c096dffc420217a52e9
SHA512 6c6169cd9ffdf34997481a44423bcae388e7e2c4a725583f8804d089e57345d053cf7ed77d6ddb77a92c3c7efefdc2a57c236763cfd45c4b114f86bde0cf7b77
SSDEEP 96:oDA1FFB4FWr+wbQI4pS1yL4elrR+h+8lX7JXTD1bcqt4qECEP50W+w0LkFq1Vx4J:/VeS/QgC2JgIYq0Qcb1Gy
TLSH
T1DDB11821E1E5DCB3E13269C7961AAFD149E8B29FEC8C9A1552C94228BF95C33CD1D0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-146-0x0000000000560000-0x0000000000582000-memory.dmp

Download

memory/120-43-0x0000000000560000-0x0000000000582000-memory.dmp

Download

memory/252-44-0x0000000000560000-0x0000000000582000-memory.dmp

Download

memory/252-126-0x0000000000560000-0x0000000000582000-memory.dmp

Download

memory/1016-359-0x0000000000200000-0x0000000000222000-memory.dmp

Download

memory/1016-449-0x0000000000200000-0x0000000000222000-memory.dmp

Download

memory/1332-264-0x00000000005F0000-0x0000000000612000-memory.dmp

Download

memory/1332-337-0x00000000005F0000-0x0000000000612000-memory.dmp

Download

memory/1432-149-0x0000000000D80000-0x0000000000DA2000-memory.dmp

Download

memory/1432-260-0x0000000000D80000-0x0000000000DA2000-memory.dmp

Download

memory/1628-187-0x0000000000D40000-0x0000000000D62000-memory.dmp

Download

memory/1628-265-0x0000000000D40000-0x0000000000D62000-memory.dmp

Download

memory/1928-640-0x0000000000F10000-0x0000000000F32000-memory.dmp

Download

memory/2064-786-0x00000000008D0000-0x00000000008F2000-memory.dmp

Download

memory/2080-784-0x0000000000F10000-0x0000000000F32000-memory.dmp

Download

memory/2388-450-0x00000000003E0000-0x0000000000402000-memory.dmp

Download

memory/2388-360-0x00000000003E0000-0x0000000000402000-memory.dmp

Download

memory/2604-524-0x0000000000CC0000-0x0000000000CE2000-memory.dmp

Download

memory/2604-936-0x0000000000CC0000-0x0000000000CE2000-memory.dmp

Download

memory/2636-326-0x0000000000DA0000-0x0000000000DC2000-memory.dmp

Download

memory/2636-462-0x0000000000DA0000-0x0000000000DC2000-memory.dmp

Download

memory/2724-328-0x0000000000620000-0x0000000000642000-memory.dmp

Download

memory/2724-501-0x0000000000620000-0x0000000000642000-memory.dmp

Download

memory/2856-41-0x0000000000360000-0x0000000000382000-memory.dmp

Download

memory/2856-14-0x0000000000360000-0x0000000000382000-memory.dmp

Download

memory/2868-701-0x0000000000230000-0x0000000000252000-memory.dmp

Download

memory/2960-935-0x0000000000CC0000-0x0000000000CE2000-memory.dmp

Download

memory/2960-465-0x0000000000CC0000-0x0000000000CE2000-memory.dmp

Download

memory/2968-375-0x0000000000EE0000-0x0000000000F02000-memory.dmp

Download

memory/2968-303-0x0000000000EE0000-0x0000000000F02000-memory.dmp

Download

memory/3244-638-0x0000000000070000-0x0000000000092000-memory.dmp

Download

memory/3244-995-0x0000000000070000-0x0000000000092000-memory.dmp

Download

memory/3284-302-0x0000000000EE0000-0x0000000000F02000-memory.dmp

Download

memory/3284-374-0x0000000000EE0000-0x0000000000F02000-memory.dmp

Download

memory/3408-222-0x0000000000DD0000-0x0000000000DF2000-memory.dmp

Download

memory/3408-166-0x0000000000DD0000-0x0000000000DF2000-memory.dmp

Download

memory/3532-329-0x0000000000620000-0x0000000000642000-memory.dmp

Download

memory/3612-447-0x0000000000A20000-0x0000000000A42000-memory.dmp

Download

memory/3700-12-0x00000000001E0000-0x0000000000202000-memory.dmp

Download

memory/3700-0-0x00000000001E0000-0x0000000000202000-memory.dmp

Download

memory/4228-40-0x0000000000360000-0x0000000000382000-memory.dmp

Download

memory/4228-13-0x0000000000360000-0x0000000000382000-memory.dmp

Download

memory/4480-639-0x0000000000230000-0x0000000000252000-memory.dmp

Download

memory/4528-170-0x0000000000D80000-0x0000000000DA2000-memory.dmp

Download

memory/4528-148-0x0000000000D80000-0x0000000000DA2000-memory.dmp

Download

memory/4620-451-0x00000000003E0000-0x0000000000402000-memory.dmp

Download

memory/4620-361-0x00000000003E0000-0x0000000000402000-memory.dmp

Download

memory/4696-399-0x0000000000E70000-0x0000000000E92000-memory.dmp

Download

memory/4696-673-0x0000000000E70000-0x0000000000E92000-memory.dmp

Download

memory/4900-459-0x0000000000480000-0x00000000004A2000-memory.dmp

Download

memory/4944-650-0x0000000000AD0000-0x0000000000AF2000-memory.dmp

Download

memory/4944-463-0x0000000000AD0000-0x0000000000AF2000-memory.dmp

Download

memory/4992-147-0x0000000000C80000-0x0000000000CA2000-memory.dmp

Download

memory/4992-235-0x0000000000C80000-0x0000000000CA2000-memory.dmp

Download

memory/5144-336-0x00000000005F0000-0x0000000000612000-memory.dmp

Download

memory/5144-263-0x00000000005F0000-0x0000000000612000-memory.dmp

Download

memory/5252-325-0x0000000000DA0000-0x0000000000DC2000-memory.dmp

Download

memory/5252-460-0x0000000000DA0000-0x0000000000DC2000-memory.dmp

Download

memory/5580-163-0x00000000001F0000-0x0000000000212000-memory.dmp

Download

memory/5580-109-0x00000000001F0000-0x0000000000212000-memory.dmp

Download

memory/5908-785-0x00000000008D0000-0x00000000008F2000-memory.dmp

Download

memory/6000-58-0x0000000000CD0000-0x0000000000CF2000-memory.dmp

Download

memory/6348-897-0x0000000000720000-0x0000000000742000-memory.dmp

Download

memory/6356-938-0x0000000000720000-0x0000000000742000-memory.dmp

Download