Overview

overview

10

Static

static

10

2026-07-15...ar.exe

windows10-2004-x64

9

2026-07-15...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    105s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/07/2026, 07:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-15_a1409d302550c23a83c1469103a19984_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
  • Size 18.9MB
  • Sample260715-jlsensey2l
  • SHA256 dfc318b23dd879364348f4808cb3cc932e08e40bb1366d8b79af7920dda656a1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Detects executables manipulated with Fody 2 IoCs
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Drops startup file 4 IoCs
  • Executes dropped EXE 40 IoCs
  • Adds Run key to start application 2 TTPs 10 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 64 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-15_a1409d302550c23a83c1469103a19984_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-15_a1409d302550c23a83c1469103a19984_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4356
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACAAAABAAAABAACAAAACCCCBBABBBBAACBBABBABCCBACACCAAACACCBACABCACBBACCBCABAACCABACAABAABBBACCBAACABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACBBBCABCABBBCACCACAAABCCBAACABCCCAABCBBBBCAAACBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4340
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACAAAABAAAABAACAAAACCCCBBABBBBAACBBABBABCCBACACCAAACACCBACABCACBBACCBCABAACCABACAABAABBBACCBAACABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACBBBCABCABBBCACCACAAABCCBAACABCCCAABCBBBBCAAACBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1660
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABAAABBCBBACCBABABBACBCACCCCBABCCCABBACBBBABBAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACBBBCABCABBBCACCACAAABCCBAACABCCCAABCBBBBCAAACBCAA.exe" start= auto displayName= "UserDataSvc_BCABAAABBCBBACCBABABBACBCACCCCBABCCCABBACBBBABBAAAB"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2816
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_BCABAAABBCBBACCBABABBACBCACCCCBABCCCABBACBBBABBAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACBBBCABCABBBCACCACAAABCCBAACABCCCAABCBBBBCAAACBCAA.exe" start= auto displayName= "UserDataSvc_BCABAAABBCBBACCBABABBACBCACCCCBABCCCABBACBBBABBAAAB"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:6080
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABAAABBCBBACCBABABBACBCACCCCBABCCCABBACBBBABBAAAB"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3444
      • C:\Windows\SysWOW64\sc.exe
        sc start "UserDataSvc_BCABAAABBCBBACCBABABBACBCACCCCBABCCCABBACBBBABBAAAB"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:864
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACBBBCABCABBBCACCACAAABCCBAACABCCCAABCBBBBCAAACBCAA.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACBBBCABCABBBCACCACAAABCCBAACABCCCAABCBBBBCAAACBCAA.exe
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2724
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCAAABCABCCBAAABBAACBCACCCAABCBBCABCBBBBCACBAABCACBCBAACCABBBCBBCCCBBCACACACCBBCACACABAAACCCBABCCCCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAABCABCCBAAABBAACBCACCCAABCBBCABCBBBBCACBAABCACBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5448
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCAAABCABCCBAAABBAACBCACCCAABCBBCABCBBBBCACBAABCACBCBAACCABBBCBBCCCBBCACACACCBBCACACABAAACCCBABCCCCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAABCABCCBAAABBAACBCACCCAABCBBCABCBBBBCACBAABCACBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5200
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBBCBCCBCABAAAACABAAABACCACAACCCBAABAACCABBBBACBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAABCABCCBAAABBAACBCACCCAABCBBCABCBBBBCACBAABCACBCBA.exe" start= auto displayName= "UserDataSvc_BBBBCBCCBCABAAAACABAAABACCACAACCCBAABAACCABBBBACBBC"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4728
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_BBBBCBCCBCABAAAACABAAABACCACAACCCBAABAACCABBBBACBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAABCABCCBAAABBAACBCACCCAABCBBCABCBBBBCACBAABCACBCBA.exe" start= auto displayName= "UserDataSvc_BBBBCBCCBCABAAAACABAAABACCACAACCCBAABAACCABBBBACBBC"
        3⤵
          PID:2364
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBBCBCCBCABAAAACABAAABACCACAACCCBAABAACCABBBBACBBC"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1168
        • C:\Windows\SysWOW64\sc.exe
          sc start "UserDataSvc_BBBBCBCCBCABAAAACABAAABACCACAACCCBAABAACCABBBBACBBC"
          3⤵
          • Launches sc.exe
          PID:3076
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACBBBCABCABBBCACCACAAABCCBAACABCCCAABCBBBBCAAACBCAA.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACBBBCABCABBBCACCACAAABCCBAACABCCCAABCBBBBCAAACBCAA.exe
      1⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4868
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCBBACBCACBACCCCAABAACCBAAABCBCBCAABACBACCCCCCBCAABAAAACBCCBCACABBBABABAABBCBBCBCBACABACBBCBAABABCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBACCACACBBBBAAACCABBAABAAACABABCBBCBBACAACBCABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5400
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCBBACBCACBACCCCAABAACCBAAABCBCBCAABACBACCCCCCBCAABAAAACBCCBCACABBBABABAABBCBBCBCBACABACBBCBAABABCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBACCACACBBBBAAACCABBAABAAACABABCBBCBBACAACBCABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
          3⤵
            PID:4444
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCBABBBBBCACBBBABBABCABABBBCCCCABCBBCACCACBBCACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBACCACACBBBBAAACCABBAABAAACABABCBBCBBACAACBCABCAA.exe" start= auto displayName= "UserDataSvc_CACCBABBBBBCACBBBABBABCABABBBCCCCABCBBCACCACBBCACCB"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2808
          • C:\Windows\SysWOW64\sc.exe
            sc create "UserDataSvc_CACCBABBBBBCACBBBABBABCABABBBCCCCABCBBCACCACBBCACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBACCACACBBBBAAACCABBAABAAACABABCBBCBBACAACBCABCAA.exe" start= auto displayName= "UserDataSvc_CACCBABBBBBCACBBBABBABCABABBBCCCCABCBBCACCACBBCACCB"
            3⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:5356
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCBABBBBBCACBBBABBABCABABBBCCCCABCBBCACCACBBCACCB"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4136
          • C:\Windows\SysWOW64\sc.exe
            sc start "UserDataSvc_CACCBABBBBBCACBBBABBABCABABBBCCCCABCBBCACCACBBCACCB"
            3⤵
              PID:4388
        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAABCABCCBAAABBAACBCACCCAABCBBCABCBBBBCACBAABCACBCBA.exe
          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAABCABCCBAAABBAACBCACCCAABCBBCABCBBBBCACBAABCACBCBA.exe
          1⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2872
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBABBBAACBABCACBCBBAABBBACACAACACBCCCCBCAACAABBAABCCBAAACAACBBCACCBCCBABCACCBBABCCABABAACCBABCBCCAACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBABCBABCAACCABCCCAABAAABBBAAABBCAACCCBBAAABBCBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4940
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBABBBAACBABCACBCBBAABBBACACAACACBCCCCBCAACAABBAABCCBAAACAACBBCACCBCCBABCACCBBABCCABABAACCBABCBCCAACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBABCBABCAACCABCCCAABAAABBBAAABBCAACCCBBAAABBCBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:5936
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABACCCBACCBCABABBBBAAAACCACBCAAAACBCBBCCBCCBAABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBABCBABCAACCABCCCAABAAABBBAAABBCAACCCBBAAABBCBBCAB.exe" start= auto displayName= "UserDataSvc_CABACCCBACCBCABABBBBAAAACCACBCAAAACBCBBCCBCCBAABBBB"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2444
            • C:\Windows\SysWOW64\sc.exe
              sc create "UserDataSvc_CABACCCBACCBCABABBBBAAAACCACBCAAAACBCBBCCBCCBAABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBABCBABCAACCABCCCAABAAABBBAAABBCAACCCBBAAABBCBBCAB.exe" start= auto displayName= "UserDataSvc_CABACCCBACCBCABABBBBAAAACCACBCAAAACBCBBCCBCCBAABBBB"
              3⤵
                PID:5640
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABACCCBACCBCABABBBBAAAACCACBCAAAACBCBBCCBCCBAABBBB"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:5012
              • C:\Windows\SysWOW64\sc.exe
                sc start "UserDataSvc_CABACCCBACCBCABABBBBAAAACCACBCAAAACBCBBCCBCCBAABBBB"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:4528
          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBACCACACBBBBAAACCABBAABAAACABABCBBCBBACAACBCABCAA.exe
            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBACCACACBBBBAAACCABBAABAAACABABCBBCBBACAACBCABCAA.exe
            1⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2696
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAACABBCCBBCBCBAACAACACCACCACCACBABABACCBCBCAACABBCBABBCCABAAAABBCCBCBCBBCCBCAAAACACCCACABBBABACBBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABBCBAACBACCCBBABABBCACCBCABABCABBABABBAAAAACBAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
              2⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5084
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAACABBCCBBCBCBAACAACACCACCACCACBABABACCBCBCAACABBCBABBCCABAAAABBCCBCBCBBCCBCAAAACACCCACABBBABACBBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABBCBAACBACCCBBABABBCACCBCABABCABBABABBAAAAACBAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:5568
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCBABACCBCCABCBAAACCABCCCCACCCCCCABABACAABBCBABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABBCBAACBACCCBBABABBCACCBCABABCABBABABBAAAAACBAABA.exe" start= auto displayName= "UserDataSvc_BBBCBABACCBCCABCBAAACCABCCCCACCCCCCABABACAABBCBABCC"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1732
              • C:\Windows\SysWOW64\sc.exe
                sc create "UserDataSvc_BBBCBABACCBCCABCBAAACCABCCCCACCCCCCABABACAABBCBABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABBCBAACBACCCBBABABBCACCBCABABCABBABABBAAAAACBAABA.exe" start= auto displayName= "UserDataSvc_BBBCBABACCBCCABCBAAACCABCCCCACCCCCCABABACAABBCBABCC"
                3⤵
                • Launches sc.exe
                PID:2400
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCBABACCBCCABCBAAACCABCCCCACCCCCCABABACAABBCBABCC"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4236
              • C:\Windows\SysWOW64\sc.exe
                sc start "UserDataSvc_BBBCBABACCBCCABCBAAACCABCCCCACCCCCCABABACAABBCBABCC"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:4572
          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBABCBABCAACCABCCCAABAAABBBAAABBCAACCCBBAAABBCBBCAB.exe
            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBABCBABCAACCABCCCAABAAABBBAAABBCAACCCBBAAABBCBBCAB.exe
            1⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4820
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCABCBBBABBBBCAAAACCCBBCACAABBABBCACCCCACCBCABAAAABCABCAABAACAAACACCBBBCCBBCAACABCCCBBAAACACACBBACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCCCBABAAAACCBCBBBAACACCCAABABCBBABCBCABBCBABABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1976
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCABCBBBABBBBCAAAACCCBBCACAABBABBCACCCCACCBCABAAAABCABCAABAACAAACACCBBBCCBBCAACABCCCBBAAACACACBBACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCCCBABAAAACCBCBBBAACACCCAABABCBBABCBCABBCBABABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:1392
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABBBCAAACBACAABCBBABBBCBCCCABAABCBABCCBAACAAAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCCCBABAAAACCBCBBBAACACCCAABABCBBABCBCABBCBABABCAB.exe" start= auto displayName= "UserDataSvc_AAABBBCAAACBACAABCBBABBBCBCCCABAABCBABCCBAACAAAAABB"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2320
              • C:\Windows\SysWOW64\sc.exe
                sc create "UserDataSvc_AAABBBCAAACBACAABCBBABBBCBCCCABAABCBABCCBAACAAAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCCCBABAAAACCBCBBBAACACCCAABABCBBABCBCABBCBABABCAB.exe" start= auto displayName= "UserDataSvc_AAABBBCAAACBACAABCBBABBBCBCCCABAABCBABCCBAACAAAAABB"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1536
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABBBCAAACBACAABCBBABBBCBCCCABAABCBABCCBAACAAAAABB"
              2⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1016
              • C:\Windows\SysWOW64\sc.exe
                sc start "UserDataSvc_AAABBBCAAACBACAABCBBABBBCBCCCABAABCBABCCBAACAAAAABB"
                3⤵
                  PID:2004
            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBABCBABCAACCABCCCAABAAABBBAAABBCAACCCBBAAABBCBBCAB.exe
              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBABCBABCAACCABCCCAABAAABBBAAABBCAACCCBBAAABBCBBCAB.exe
              1⤵
              • Drops startup file
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:5056
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCABCBBBABBBBCAAAACCCBBCACAABBABBCACCCCACCBCABAAAABCABCAABAACAAACACCBBBCCBBCAACABCCCBBAAACACACBBACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCCCBABAAAACCBCBBBAACACCCAABABCBBABCBCABBCBABABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:5548
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCABCBBBABBBBCAAAACCCBBCACAABBABBCACCCCACCBCABAAAABCABCAABAACAAACACCBBBCCBBCAACABCCCBBAAACACACBBACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCCCBABAAAACCBCBBBAACACCCAABABCBBABCBCABBCBABABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:3740
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBBACBCBBACCBBABABACACCBCCCABCBBCACAABBCBAAACBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCCCBABAAAACCBCBBBAACACCCAABABCBBABCBCABBCBABABCAB.exe" start= auto displayName= "UserDataSvc_ABBBBACBCBBACCBBABABACACCBCCCABCBBCACAABBCBAAACBCBB"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3408
                • C:\Windows\SysWOW64\sc.exe
                  sc create "UserDataSvc_ABBBBACBCBBACCBBABABACACCBCCCABCBBCACAABBCBAAACBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCCCBABAAAACCBCBBBAACACCCAABABCBBABCBCABBCBABABCAB.exe" start= auto displayName= "UserDataSvc_ABBBBACBCBBACCBBABABACACCBCCCABCBBCACAABBCBAAACBCBB"
                  3⤵
                    PID:3160
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBBACBCBBACCBBABABACACCBCCCABCBBCACAABBCBAAACBCBB"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5860
                  • C:\Windows\SysWOW64\sc.exe
                    sc start "UserDataSvc_ABBBBACBCBBACCBBABABACACCBCCCABCBBCACAABBCBAAACBCBB"
                    3⤵
                    • Launches sc.exe
                    • System Location Discovery: System Language Discovery
                    PID:4992
              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABBCBAACBACCCBBABABBCACCBCABABCABBABABBAAAAACBAABA.exe
                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABBCBAACBACCCBBABABBCACCBCABABCABBABABBAAAAACBAABA.exe
                1⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2720
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAABABABAABACABAABBBBBAAAAABACAABBBBBABBACABCACCBABCCABCAACCBBCCCACBACBAACACACCBAAAACCBBCACABCBCBAAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBACBAAACCCCACAAACBBBBCAACABBACCCABCBCBCBBBCABBBABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4120
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAABABABAABACABAABBBBBAAAAABACAABBBBBABBACABCACCBABCCABCAACCBBCCCACBACBAACACACCBAAAACCBBCACABCBCBAAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBACBAAACCCCACAAACBBBBCAACABBACCCABCBCBCBBBCABBBABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                    3⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:2588
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACACCABBCCCBCBCCAABACCBCBCACAACCBCCCCCBBBABCACBACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBACBAAACCCCACAAACBBBBCAACABBACCCABCBCBCBBBCABBBABBC.exe" start= auto displayName= "UserDataSvc_ACACCABBCCCBCBCCAABACCBCBCACAACCBCCCCCBBBABCACBACBC"
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:2256
                  • C:\Windows\SysWOW64\sc.exe
                    sc create "UserDataSvc_ACACCABBCCCBCBCCAABACCBCBCACAACCBCCCCCBBBABCACBACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBACBAAACCCCACAAACBBBBCAACABBACCCABCBCBCBBBCABBBABBC.exe" start= auto displayName= "UserDataSvc_ACACCABBCCCBCBCCAABACCBCBCACAACCBCCCCCBBBABCACBACBC"
                    3⤵
                      PID:3460
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACACCABBCCCBCBCCAABACCBCBCACAACCBCCCCCBBBABCACBACBC"
                    2⤵
                      PID:5336
                      • C:\Windows\SysWOW64\sc.exe
                        sc start "UserDataSvc_ACACCABBCCCBCBCCAABACCBCBCACAACCBCCCCCBBBABCACBACBC"
                        3⤵
                        • Launches sc.exe
                        PID:4944
                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCCCBABAAAACCBCBBBAACACCCAABABCBBABCBCABBCBABABCAB.exe
                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCCCBABAAAACCBCBBBAACACCCAABABCBBABCBCABBCBABABCAB.exe
                    1⤵
                    • Drops startup file
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:124
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBAABACCACAABCBBBBABAABCAAAABAACACBACCACCACAABAABABBCCBAAACCCCBACBBCBBACABBBBABBAABBAACAACCACCBBCBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBCBCCABABBAACACCCCAAACBBACBCBACCBACAACBAACBABCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3528
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBAABACCACAABCBBBBABAABCAAAABAACACBACCACCACAABAABABBCCBAAACCCCBACBBCBBACABBBBABBAABBAACAACCACCBBCBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBCBCCABABBAACACCCCAAACBBACBCBACCBACAACBAACBABCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                        3⤵
                        • System Location Discovery: System Language Discovery
                        • Scheduled Task/Job: Scheduled Task
                        PID:620
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBBCCCBCBCCCAAABBCAAAAABCAABBACCBCBAACBABCCCCAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBCBCCABABBAACACCCCAAACBBACBCBACCBACAACBAACBABCABA.exe" start= auto displayName= "UserDataSvc_BCBBBCCCBCBCCCAAABBCAAAAABCAABBACCBCBAACBABCCCCAACB"
                      2⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:5428
                      • C:\Windows\SysWOW64\sc.exe
                        sc create "UserDataSvc_BCBBBCCCBCBCCCAAABBCAAAAABCAABBACCBCBAACBABCCCCAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBCBCCABABBAACACCCCAAACBBACBCBACCBACAACBAACBABCABA.exe" start= auto displayName= "UserDataSvc_BCBBBCCCBCBCCCAAABBCAAAAABCAABBACCBCBAACBABCCCCAACB"
                        3⤵
                          PID:1880
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBBCCCBCBCCCAAABBCAAAAABCAABBACCBCBAACBABCCCCAACB"
                        2⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:3544
                        • C:\Windows\SysWOW64\sc.exe
                          sc start "UserDataSvc_BCBBBCCCBCBCCCAAABBCAAAAABCAABBACCBCBAACBABCCCCAACB"
                          3⤵
                          • Launches sc.exe
                          PID:3756
                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCCCBABAAAACCBCBBBAACACCCAABABCBBABCBCABBCBABABCAB.exe
                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCCCBABAAAACCBCBBBAACACCCAABABCBBABCBCABBCBABABCAB.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:704
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBCBBBCABACBBBABAABBABCCBCCBCBBABBCCABABCABBBAACCACCBBAACABACCACBABCCCCABCBACBABACCBCAABCACACBBBCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBAACACCACCAAAABACCBCAAACBAACCCBBCACCCCCBABBCBAABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3944
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBCBBBCABACBBBABAABBABCCBCCBCBBABBCCABABCABBBAACCACCBBAACABACCACBABCCCCABCBACBABACCBCAABCACACBBBCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBAACACCACCAAAABACCBCAAACBAACCCBBCACCCCCBABBCBAABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                          3⤵
                          • System Location Discovery: System Language Discovery
                          • Scheduled Task/Job: Scheduled Task
                          PID:5668
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBBCCBCBACAAACAABCAABAABBBACAAACABBAABBCACBCCCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBAACACCACCAAAABACCBCAAACBAACCCBBCACCCCCBABBCBAABBCC.exe" start= auto displayName= "UserDataSvc_BACBBCCBCBACAAACAABCAABAABBBACAAACABBAABBCACBCCCCBB"
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1496
                        • C:\Windows\SysWOW64\sc.exe
                          sc create "UserDataSvc_BACBBCCBCBACAAACAABCAABAABBBACAAACABBAABBCACBCCCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBAACACCACCAAAABACCBCAAACBAACCCBBCACCCCCBABBCBAABBCC.exe" start= auto displayName= "UserDataSvc_BACBBCCBCBACAAACAABCAABAABBBACAAACABBAABBCACBCCCCBB"
                          3⤵
                            PID:4244
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBBCCBCBACAAACAABCAABAABBBACAAACABBAABBCACBCCCCBB"
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2748
                          • C:\Windows\SysWOW64\sc.exe
                            sc start "UserDataSvc_BACBBCCBCBACAAACAABCAABAABBBACAAACABBAABBCACBCCCCBB"
                            3⤵
                            • Launches sc.exe
                            PID:5936
                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCCCBABAAAACCBCBBBAACACCCAABABCBBABCBCABBCBABABCAB.exe
                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCCCBABAAAACCBCBBBAACACCCAABABCBBABCBCABBCBABABCAB.exe
                        1⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2864
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABAAAAABBABCBABABCCBABBBBABCAABCBACCAAABABABCBCBBBBABBABBBCACAAAABBAACCCACCABBACCCCABAABCBCCBBAAACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBBCBCBBAACAAACBCACAACCBBBCABAACBBCAAABAABABBBBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3148
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABAAAAABBABCBABABCCBABBBBABCAABCBACCAAABABABCBCBBBBABBABBBCACAAAABBAACCCACCABBACCCCABAABCBCCBBAAACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBBCBCBBAACAAACBCACAACCBBBCABAACBBCAAABAABABBBBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                            3⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:6008
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAACBACCCBAAABBCACCCCAACCACCCBCABACAABBCACABBBBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBBCBCBBAACAAACBCACAACCBBBCABAACBBCAAABAABABBBBACCC.exe" start= auto displayName= "UserDataSvc_BAAACBACCCBAAABBCACCCCAACCACCCBCABACAABBCACABBBBAAC"
                          2⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:6128
                          • C:\Windows\SysWOW64\sc.exe
                            sc create "UserDataSvc_BAAACBACCCBAAABBCACCCCAACCACCCBCABACAABBCACABBBBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBBCBCBBAACAAACBCACAACCBBBCABAACBBCAAABAABABBBBACCC.exe" start= auto displayName= "UserDataSvc_BAAACBACCCBAAABBCACCCCAACCACCCBCABACAABBCACABBBBAAC"
                            3⤵
                            • Launches sc.exe
                            • System Location Discovery: System Language Discovery
                            PID:4212
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAACBACCCBAAABBCACCCCAACCACCCBCABACAABBCACABBBBAAC"
                          2⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:6076
                          • C:\Windows\SysWOW64\sc.exe
                            sc start "UserDataSvc_BAAACBACCCBAAABBCACCCCAACCACCCBCABACAABBCACABBBBAAC"
                            3⤵
                            • Launches sc.exe
                            PID:1844
                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBCBCCABABBAACACCCCAAACBBACBCBACCBACAACBAACBABCABA.exe
                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBCBCCABABBAACACCCCAAACBBACBCBACCBACAACBAACBABCABA.exe
                        1⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1856
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABAACBABBCBABBCACBBCCABCCCABBABCBBBACBABCABCCABBCBBCBCBBBCACCABCACCCBABACBBBCCABACCABBABACACBACACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCACBCCACABCCCCCACCAABACCBBABACCAABCABCCABCACBABBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:1388
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABAACBABBCBABBCACBBCCABCCCABBABCBBBACBABCABCCABBCBBCBCBBBCACCABCACCCBABACBBBCCABACCABBABACACBACACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCACBCCACABCCCCCACCAABACCBBABACCAABCABCCABCACBABBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Scheduled Task/Job: Scheduled Task
                            PID:4896
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABACCACBBCABAACBBACBBCABABBCBBABBACABABBCCAACBBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCACBCCACABCCCCCACCAABACCBBABACCAABCABCCABCACBABBABB.exe" start= auto displayName= "UserDataSvc_AABACCACBBCABAACBBACBBCABABBCBBABBACABABBCCAACBBCAC"
                          2⤵
                            PID:5284
                            • C:\Windows\SysWOW64\sc.exe
                              sc create "UserDataSvc_AABACCACBBCABAACBBACBBCABABBCBBABBACABABBCCAACBBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCACBCCACABCCCCCACCAABACCBBABACCAABCABCCABCACBABBABB.exe" start= auto displayName= "UserDataSvc_AABACCACBBCABAACBBACBBCABABBCBBABBACABABBCCAACBBCAC"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:1188
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABACCACBBCABAACBBACBBCABABBCBBABBACABABBCCAACBBCAC"
                            2⤵
                              PID:1988
                              • C:\Windows\SysWOW64\sc.exe
                                sc start "UserDataSvc_AABACCACBBCABAACBBACBBCABABBCBBABBACABABBCCAACBBCAC"
                                3⤵
                                • Launches sc.exe
                                PID:1880
                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBCBCCABABBAACACCCCAAACBBACBCBACCBACAACBAACBABCABA.exe
                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBCBCCABABBAACACCCCAAACBBACBCBACCBACAACBAACBABCABA.exe
                            1⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5260
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCABCBABBBCABCBAABABAACCCACBBABABCBCCCBCAABAACCCCACBACCBAAABCCACACBAABCCABACBABBBCBCCBACCBCAAAABBBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCCBBBAAABCBCABCBACACABCBCABBBBABBBAACBCCCBBACBABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                              2⤵
                                PID:4852
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCABCBABBBCABCBAABABAACCCACBBABABCBCCCBCAABAACCCCACBACCBAAABCCACACBAABCCABACBABBBCBCCBACCBCAAAABBBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCCBBBAAABCBCABCBACACABCBCABBBBABBBAACBCCCBBACBABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:4268
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBCACABAABACCBABBBBABBBCCCCCBCACCBCACBBACBCABABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCCBBBAAABCBCABCBACACABCBCABBBBABBBAACBCCCBBACBABAB.exe" start= auto displayName= "UserDataSvc_ABBBCACABAABACCBABBBBABBBCCCCCBCACCBCACBBACBCABABBA"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:4960
                                • C:\Windows\SysWOW64\sc.exe
                                  sc create "UserDataSvc_ABBBCACABAABACCBABBBBABBBCCCCCBCACCBCACBBACBCABABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCCBBBAAABCBCABCBACACABCBCABBBBABBBAACBCCCBBACBABAB.exe" start= auto displayName= "UserDataSvc_ABBBCACABAABACCBABBBBABBBCCCCCBCACCBCACBBACBCABABBA"
                                  3⤵
                                  • Launches sc.exe
                                  PID:2036
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBCACABAABACCBABBBBABBBCCCCCBCACCBCACBBACBCABABBA"
                                2⤵
                                  PID:1744
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc start "UserDataSvc_ABBBCACABAABACCBABBBBABBBCCCCCBCACCBCACBBACBCABABBA"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1824
                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBAACACCACCAAAABACCBCAAACBAACCCBBCACCCCCBABBCBAABBCC.exe
                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBAACACCACCAAAABACCBCAAACBAACCCBBCACCCCCBABBCBAABBCC.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2964
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACCBCCCBBAABBCAACCACACCCAABCBCBBACAACCCABCCBCBCBBCBABBBABCCACBBCBCBCACBCCBBBBBCACBCACACCBCBBCCBCBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCCBBACBCCAACBBCCBACBABCCAABACCBAABACABAAAACBCBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:5872
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACCBCCCBBAABBCAACCACACCCAABCBCBBACAACCCABCCBCBCBBCBABBBABCCACBBCBCBCACBCCBBBBBCACBCACACCBCBBCCBCBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCCBBACBCCAACBBCCBACBABCCAABACCBAABACABAAAACBCBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                    3⤵
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:2820
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACBBCBBACCAACACBBABBCACCCCCBBCCCCABCCCBBCBCACCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCCBBACBCCAACBBCCBACBABCCAABACCBAABACABAAAACBCBAAC.exe" start= auto displayName= "UserDataSvc_BAACBBCBBACCAACACBBABBCACCCCCBBCCCCABCCCBBCBCACCCAA"
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4500
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc create "UserDataSvc_BAACBBCBBACCAACACBBABBCACCCCCBBCCCCABCCCBBCBCACCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCCBBACBCCAACBBCCBACBABCCAABACCBAABACABAAAACBCBAAC.exe" start= auto displayName= "UserDataSvc_BAACBBCBBACCAACACBBABBCACCCCCBBCCCCABCCCBBCBCACCCAA"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:5948
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACBBCBBACCAACACBBABBCACCCCCBBCCCCABCCCBBCBCACCCAA"
                                  2⤵
                                    PID:6060
                                    • C:\Windows\SysWOW64\sc.exe
                                      sc start "UserDataSvc_BAACBBCBBACCAACACBBABBCACCCCCBBCCCCABCCCBBCBCACCCAA"
                                      3⤵
                                      • Launches sc.exe
                                      PID:4156
                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBAACACCACCAAAABACCBCAAACBAACCCBBCACCCCCBABBCBAABBCC.exe
                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBAACACCACCAAAABACCBCAAACBAACCCBBCACCCCCBABBCBAABBCC.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1728
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCBBBCAACCACBBACBABCCABABAABCBCABACAABAAACCAAAACACABCCACBBACCCBABBBABAABCBCCAACBBBBCBCBCCABBCACACACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCABBABCCCABACCABACCABABABCBAAACAACACACCBBBCCBACACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                    2⤵
                                      PID:2472
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCBBBCAACCACBBACBABCCABABAABCBCABACAABAAACCAAAACACABCCACBBACCCBABBBABAABCBCCAACBBBBCBCBCCABBCACACACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCABBABCCCABACCABACCABABABCBAAACAACACACCBBBCCBACACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                        3⤵
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1444
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACCACBBABABAABABBABBCBBCCABBCBABCABABCCCACAABCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCABBABCCCABACCABACCABABABCBAAACAACACACCBBBCCBACACBBB.exe" start= auto displayName= "UserDataSvc_CAACCACBBABABAABABBABBCBBCCABBCBABCABABCCCACAABCBAA"
                                      2⤵
                                        PID:5368
                                        • C:\Windows\SysWOW64\sc.exe
                                          sc create "UserDataSvc_CAACCACBBABABAABABBABBCBBCCABBCBABCABABCCCACAABCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCABBABCCCABACCABACCABABABCBAAACAACACACCBBBCCBACACBBB.exe" start= auto displayName= "UserDataSvc_CAACCACBBABABAABABBABBCBBCCABBCBABCABABCCCACAABCBAA"
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:4628
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAACCACBBABABAABABBABBCBBCCABBCBABCABABCCCACAABCBAA"
                                        2⤵
                                          PID:2836
                                          • C:\Windows\SysWOW64\sc.exe
                                            sc start "UserDataSvc_CAACCACBBABABAABABBABBCBBCCABBCBABCABABCCCACAABCBAA"
                                            3⤵
                                            • Launches sc.exe
                                            PID:2580
                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBBCBCBBAACAAACBCACAACCBBBCABAACBBCAAABAABABBBBACCC.exe
                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBBCBCBBAACAAACBCACAACCBBBCABAACBBCAAABAABABBBBACCC.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:6124
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACACAABCBCCACBCBAAABCBCCCAACAACBACCBCAACACAAAACBCBABCCACCABCBBACACBCBBBBBBCABABABBCCCBBABACCCBBCBABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBBCACBACCBCCCBAACABCABCCCBABBBAACCACABCCBBCABACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                          2⤵
                                            PID:5540
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACACAABCBCCACBCBAAABCBCCCAACAACBACCBCAACACAAAACBCBABCCACCABCBBACACBCBBBBBBCABABABBCCCBBABACCCBBCBABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBBCACBACCBCCCBAACABCABCCCBABBBAACCACABCCBBCABACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                              3⤵
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3932
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCACBBACBABBBBBAAABBCABABCABCCACBBACACABBBCCCBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBBCACBACCBCCCBAACABCABCCCBABBBAACCACABCCBBCABACCBA.exe" start= auto displayName= "UserDataSvc_ABCCACBBACBABBBBBAAABBCABABCABCCACBBACACABBBCCCBBCB"
                                            2⤵
                                              PID:2376
                                              • C:\Windows\SysWOW64\sc.exe
                                                sc create "UserDataSvc_ABCCACBBACBABBBBBAAABBCABABCABCCACBBACACABBBCCCBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBBCACBACCBCCCBAACABCABCCCBABBBAACCACABCCBBCABACCBA.exe" start= auto displayName= "UserDataSvc_ABCCACBBACBABBBBBAAABBCABABCABCCACBBACACABBBCCCBBCB"
                                                3⤵
                                                • Launches sc.exe
                                                PID:1100
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCCACBBACBABBBBBAAABBCABABCABCCACBBACACABBBCCCBBCB"
                                              2⤵
                                                PID:4828
                                                • C:\Windows\SysWOW64\sc.exe
                                                  sc start "UserDataSvc_ABCCACBBACBABBBBBAAABBCABABCABCCACBBACACABBBCCCBBCB"
                                                  3⤵
                                                  • Launches sc.exe
                                                  PID:5976
                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBBCBCBBAACAAACBCACAACCBBBCABAACBBCAAABAABABBBBACCC.exe
                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBBCBCBBAACAAACBCACAACCBBBCABAACBBCAAABAABABBBBACCC.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2140
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBBCBBABABBBCBCBCBBBACACCABBABBCABACABBBACCACCCAAABACBABABACABBBABCCCABBBAACBACAABBBACABCCCBABCCABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAACACCBBCACCBCAACACCCCAABBBAACAABCABABBBBCAAABAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                2⤵
                                                  PID:4076
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBBCBBABABBBCBCBCBBBACACCABBABBCABACABBBACCACCCAAABACBABABACABBBABCCCABBBAACBACAABBBACABCCCBABCCABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAACACCBBCACCBCAACACCCCAABBBAACAABCABABBBBCAAABAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                    3⤵
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:1476
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCBCCCABBCBBABCACABBCBCBACBCBCBBBAAAAAAAABCAABBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAACACCBBCACCBCAACACCCCAABBBAACAABCABABBBBCAAABAAAC.exe" start= auto displayName= "UserDataSvc_CCCBCCCABBCBBABCACABBCBCBACBCBCBBBAAAAAAAABCAABBBAB"
                                                  2⤵
                                                    PID:3384
                                                    • C:\Windows\SysWOW64\sc.exe
                                                      sc create "UserDataSvc_CCCBCCCABBCBBABCACABBCBCBACBCBCBBBAAAAAAAABCAABBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAACACCBBCACCBCAACACCCCAABBBAACAABCABABBBBCAAABAAAC.exe" start= auto displayName= "UserDataSvc_CCCBCCCABBCBBABCACABBCBCBACBCBCBBBAAAAAAAABCAABBBAB"
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:1364
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCBCCCABBCBBABCACABBCBCBACBCBCBBBAAAAAAAABCAABBBAB"
                                                    2⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:488
                                                    • C:\Windows\SysWOW64\sc.exe
                                                      sc start "UserDataSvc_CCCBCCCABBCBBABCACABBCBCBACBCBCBBBAAAAAAAABCAABBBAB"
                                                      3⤵
                                                      • Launches sc.exe
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4848
                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBACBAAACCCCACAAACBBBBCAACABBACCCABCBCBCBBBCABBBABBC.exe
                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBACBAAACCCCACAAACBBBBCAACABBACCCABCBCBCBBBCABBBABBC.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5916
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAACABCACAABACCCCCAAACBCAACCAABBABABCBCBBABAAAACCACBBACBBCCCCBBCBABABBACBCACCCBACABAAABBBCACCACABACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAABAACAABCBBACCBBABCAACAACAABBCCBABBBBCCBAACCCBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                    2⤵
                                                      PID:564
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAACABCACAABACCCCCAAACBCAACCAABBABABCBCBBABAAAACCACBBACBBCCCCBBCBABABBACBCACCCBACABAAABBBCACCACABACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAABAACAABCBBACCBBABCAACAACAABBCCBABBBBCCBAACCCBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                        3⤵
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:6556
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCCACBCAAABCCBBAACCCCACACCCCCBABACBABCBBAACBBAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAABAACAABCBBACCBBABCAACAACAABBCCBABBBBCCBAACCCBCBC.exe" start= auto displayName= "UserDataSvc_CABCCACBCAAABCCBBAACCCCACACCCCCBABACBABCBBAACBBAABB"
                                                      2⤵
                                                        PID:6552
                                                        • C:\Windows\SysWOW64\sc.exe
                                                          sc create "UserDataSvc_CABCCACBCAAABCCBBAACCCCACACCCCCBABACBABCBBAACBBAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAABAACAABCBBACCBBABCAACAACAABBCCBABBBBCCBAACCCBCBC.exe" start= auto displayName= "UserDataSvc_CABCCACBCAAABCCBBAACCCCACACCCCCBABACBABCBBAACBBAABB"
                                                          3⤵
                                                          • Launches sc.exe
                                                          PID:7768
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCCACBCAAABCCBBAACCCCACACCCCCBABACBABCBBAACBBAABB"
                                                        2⤵
                                                          PID:8004
                                                          • C:\Windows\SysWOW64\sc.exe
                                                            sc start "UserDataSvc_CABCCACBCAAABCCBBAACCCCACACCCCCBABACBABCBBAACBBAABB"
                                                            3⤵
                                                              PID:8132
                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBACBAAACCCCACAAACBBBBCAACABBACCCABCBCBCBBBCABBBABBC.exe
                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBACBAAACCCCACAAACBBBBCAACABBACCCABCBCBCBBBCABBBABBC.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:2364
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACAABCBCBCBBBBACAACCCBBABCACBBABBCCBBBABABCBAABACBCCABABACABBCCBCBCCCBBBABACBBAACBABCABBCBCBBACBABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAABBBAABBAABCBCAACCBBBCCBCCBBAABCCCAAAACCCBABCBABBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                            2⤵
                                                              PID:6588
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACAABCBCBCBBBBACAACCCBBABCACBBABBCCBBBABABCBAABACBCCABABACABBCCBCBCCCBBBABACBBAACBABCABBCBCBBACBABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAABBBAABBAABCBCAACCBBBCCBCCBBAABCCCAAAACCCBABCBABBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                3⤵
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:5888
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACBABCBACCACAAABBBCBCCCCCBCBCCCACCBABBCCAABABBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAABBBAABBAABCBCAACCBBBCCBCCBBAABCCCAAAACCCBABCBABBBC.exe" start= auto displayName= "UserDataSvc_ABACBABCBACCACAAABBBCBCCCCCBCBCCCACCBABBCCAABABBCAA"
                                                              2⤵
                                                                PID:2912
                                                                • C:\Windows\SysWOW64\sc.exe
                                                                  sc create "UserDataSvc_ABACBABCBACCACAAABBBCBCCCCCBCBCCCACCBABBCCAABABBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAABBBAABBAABCBCAACCBBBCCBCCBBAABCCCAAAACCCBABCBABBBC.exe" start= auto displayName= "UserDataSvc_ABACBABCBACCACAAABBBCBCCCCCBCBCCCACCBABBCCAABABBCAA"
                                                                  3⤵
                                                                  • Launches sc.exe
                                                                  PID:7888
                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCACBCCACABCCCCCACCAABACCBBABACCAABCABCCABCACBABBABB.exe
                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCACBCCACABCCCCCACCAABACCBBABACCAABCABCCABCACBABBABB.exe
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4764
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCCCBABCCAABBCCBCBACAAABACCBACBBACBBBAACBBCACBBBABAACCACABABCCBCAACCBCCCABACBBBCBCACBABCAACCAAACBAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBCABCACABCCCAAACACBBCCBCACABBBCABBCABBBBCCBAAABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                2⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4792
                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCCCBABCCAABBCCBCBACAAABACCBACBBACBBBAACBBCACBBBABAACCACABABCCBCAACCBCCCABACBBBCBCACBABCAACCAAACBAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBCABCACABCCCAAACACBBCCBCACABBBCABBCABBBBCCBAAABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                  3⤵
                                                                  • Scheduled Task/Job: Scheduled Task
                                                                  PID:4132
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACABCCCBBCBBACBABCBACCCCCBBACBCCBAAACBABACACBCBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBCABCACABCCCAAACACBBCCBCACABBBCABBCABBBBCCBAAABCBA.exe" start= auto displayName= "UserDataSvc_BACABCCCBBCBBACBABCBACCCCCBBACBCCBAAACBABACACBCBCAB"
                                                                2⤵
                                                                  PID:4808
                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                    sc create "UserDataSvc_BACABCCCBBCBBACBABCBACCCCCBBACBCCBAAACBABACACBCBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBCABCACABCCCAAACACBBCCBCACABBBCABBCABBBBCCBAAABCBA.exe" start= auto displayName= "UserDataSvc_BACABCCCBBCBBACBABCBACCCCCBBACBCCBAAACBABACACBCBCAB"
                                                                    3⤵
                                                                      PID:4152
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACABCCCBBCBBACBABCBACCCCCBBACBCCBAAACBABACACBCBCAB"
                                                                    2⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4452
                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                      sc start "UserDataSvc_BACABCCCBBCBBACBABCBACCCCCBBACBCCBAAACBABACACBCBCAB"
                                                                      3⤵
                                                                      • Launches sc.exe
                                                                      PID:5220
                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCACBCCACABCCCCCACCAABACCBBABACCAABCABCCABCACBABBABB.exe
                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCACBCCACABCCCCCACCAABACCBBABACCAABCABCCABCACBABBABB.exe
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  • Adds Run key to start application
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:6104
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCBCABCACABCCCAAACACBBCCBCACABBBCABBCABBBBCCBAAABCBACCCCCBACBACBAABAAABBCAAABAAAACACCCCAACCCCCCAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBCABCACABCCCAAACACBBCCBCACABBBCABBCABBBBCCBAAABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                    2⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:5352
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCBCABCACABCCCAAACACBBCCBCACABBBCABBCABBBBCCBAAABCBACCCCCBACBACBAABAAABBCAAABAAAACACCCCAACCCCCCAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBCABCACABCCCAAACACBBCCBCACABBBCABBCABBBBCCBAAABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                      3⤵
                                                                      • Scheduled Task/Job: Scheduled Task
                                                                      PID:1588
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCBCCBCBCCABABBCCBCBABAACBAACCBCBCBABCBACABAACCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBCABCACABCCCAAACACBBCCBCACABBBCABBCABBBBCCBAAABCBA.exe" start= auto displayName= "UserDataSvc_CCCBCCBCBCCABABBCCBCBABAACBAACCBCBCBABCBACABAACCCBC"
                                                                    2⤵
                                                                      PID:3784
                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                        sc create "UserDataSvc_CCCBCCBCBCCABABBCCBCBABAACBAACCBCBCBABCBACABAACCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBCABCACABCCCAAACACBBCCBCACABBBCABBCABBBBCCBAAABCBA.exe" start= auto displayName= "UserDataSvc_CCCBCCBCBCCABABBCCBCBABAACBAACCBCBCBABCBACABAACCCBC"
                                                                        3⤵
                                                                          PID:2752
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCBCCBCBCCABABBCCBCBABAACBAACCBCBCBABCBACABAACCCBC"
                                                                        2⤵
                                                                          PID:3460
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            sc start "UserDataSvc_CCCBCCBCBCCABABBCCBCBABAACBAACCBCBCBABCBACABAACCCBC"
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5864
                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCCBBBAAABCBCABCBACACABCBCABBBBABBBAACBCCCBBACBABAB.exe
                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCCBBBAAABCBCABCBACACABCBCABBBBABBBAACBCCCBBACBABAB.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3156
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCAABBBAAAACAABACAABBBBBABACBBAABBBBCBCCAACBCCBCBBAACBCACAACAACAAABBABCAAABABCABABAACABBCBBCABABACBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACCCCCBBCACCACCBCAACBABBACACCCABBCCCBBBABCBBBBCBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                          2⤵
                                                                            PID:5300
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCAABBBAAAACAABACAABBBBBABACBBAABBBBCBCCAACBCCBCBBAACBCACAACAACAAABBABCAAABABCABABAACABBCBBCABABACBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACCCCCBBCACCACCBCAACBABBACACCCABBCCCBBBABCBBBBCBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Scheduled Task/Job: Scheduled Task
                                                                              PID:6084
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACABCCABBCBBCCACBBBBBBAACCCABBCBCBBBCBBBBCBBBCACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACCCCCBBCACCACCBCAACBABBACACCCABBCCCBBBABCBBBBCBCBAB.exe" start= auto displayName= "UserDataSvc_BACABCCABBCBBCCACBBBBBBAACCCABBCBCBBBCBBBBCBBBCACBC"
                                                                            2⤵
                                                                              PID:3740
                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                sc create "UserDataSvc_BACABCCABBCBBCCACBBBBBBAACCCABBCBCBBBCBBBBCBBBCACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACCCCCBBCACCACCBCAACBABBACACCCABBCCCBBBABCBBBBCBCBAB.exe" start= auto displayName= "UserDataSvc_BACABCCABBCBBCCACBBBBBBAACCCABBCBCBBBCBBBBCBBBCACBC"
                                                                                3⤵
                                                                                • Launches sc.exe
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5440
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACABCCABBCBBCCACBBBBBBAACCCABBCBCBBBCBBBBCBBBCACBC"
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2980
                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                sc start "UserDataSvc_BACABCCABBCBBCCACBBBBBBAACCCABBCBCBBBCBBBBCBBBCACBC"
                                                                                3⤵
                                                                                • Launches sc.exe
                                                                                PID:1480
                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCABBABCCCABACCABACCABABABCBAAACAACACACCBBBCCBACACBBB.exe
                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCABBABCCCABACCABACCABABABCBAAACAACACACCBBBCCBACACBBB.exe
                                                                            1⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4784
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCABBACBCCACACBCAACBBCABAAACBACCACBCAACCCCBABBBBCCCCBBAABBBCBCCBCACABBBCBCBACBBACBCBCCAACABCCBBCACCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCAACABCABAACACCCABBCACBCABBCBBCABCCCCBCCABACCCBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                              2⤵
                                                                                PID:4412
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCABBACBCCACACBCAACBBCABAAACBACCACBCAACCCCBABBBBCCCCBBAABBBCBCCBCACABBBCBCBACBBACBCBCCAACABCCBBCACCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCAACABCABAACACCCABBCACBCABBCBBCABCCCCBCCABACCCBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                  3⤵
                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                  PID:2616
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCABBABCBBCBCBAABCACBCABCBBCCCCCBACACCAACAAACAABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCAACABCABAACACCCABBCACBCABBCBBCABCCCCBCCABACCCBAABB.exe" start= auto displayName= "UserDataSvc_BCCABBABCBBCBCBAABCACBCABCBBCCCCCBACACCAACAAACAABCC"
                                                                                2⤵
                                                                                  PID:4064
                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                    sc create "UserDataSvc_BCCABBABCBBCBCBAABCACBCABCBBCCCCCBACACCAACAAACAABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCAACABCABAACACCCABBCACBCABBCBBCABCCCCBCCABACCCBAABB.exe" start= auto displayName= "UserDataSvc_BCCABBABCBBCBCBAABCACBCABCBBCCCCCBACACCAACAAACAABCC"
                                                                                    3⤵
                                                                                    • Launches sc.exe
                                                                                    PID:3112
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCABBABCBBCBCBAABCACBCABCBBCCCCCBACACCAACAAACAABCC"
                                                                                  2⤵
                                                                                    PID:3448
                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                      sc start "UserDataSvc_BCCABBABCBBCBCBAABCACBCABCBBCCCCCBACACCAACAAACAABCC"
                                                                                      3⤵
                                                                                      • Launches sc.exe
                                                                                      PID:6444
                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCCBBACBCCAACBBCCBACBABCCAABACCBAABACABAAAACBCBAAC.exe
                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCCBBACBCCAACBBCCBACBABCCAABACCBAABACABAAAACBCBAAC.exe
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  • Adds Run key to start application
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:4284
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACACBBBCABBABACACBACAAACACACBABACACCAACAABCAACABBAABCBABBCBABCCABBAAAABABBAACBCAAAACACCABACAACACBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABACCBACCBBCCCCBCCCBCCAAAAAAABAAAACACBABBBCABAAABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                    2⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:2940
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACACBBBCABBABACACBACAAACACACBABACACCAACAABCAACABBAABCBABBCBABCCABBAAAABABBAACBCAAAACACCABACAACACBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABACCBACCBBCCCCBCCCBCCAAAAAAABAAAACACBABBBCABAAABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                      3⤵
                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                      PID:3052
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCCABCBBBCBCCACBABCABBCACCABAACCCBAAABAAABABBBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABACCBACCBBCCCCBCCCBCCAAAAAAABAAAACACBABBBCABAAABCC.exe" start= auto displayName= "UserDataSvc_BBCCCABCBBBCBCCACBABCABBCACCABAACCCBAAABAAABABBBBCB"
                                                                                    2⤵
                                                                                      PID:3916
                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                        sc create "UserDataSvc_BBCCCABCBBBCBCCACBABCABBCACCABAACCCBAAABAAABABBBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABACCBACCBBCCCCBCCCBCCAAAAAAABAAAACACBABBBCABAAABCC.exe" start= auto displayName= "UserDataSvc_BBCCCABCBBBCBCCACBABCABBCACCABAACCCBAAABAAABABBBBCB"
                                                                                        3⤵
                                                                                          PID:5416
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCCABCBBBCBCCACBABCABBCACCABAACCCBAAABAAABABBBBCB"
                                                                                        2⤵
                                                                                          PID:6200
                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                            sc start "UserDataSvc_BBCCCABCBBBCBCCACBABCABBCACCABAACCCBAAABAAABABBBBCB"
                                                                                            3⤵
                                                                                            • Launches sc.exe
                                                                                            PID:6464
                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCCBBACBCCAACBBCCBACBABCCAABACCBAABACABAAAACBCBAAC.exe
                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCCBBACBCCAACBBCCBACBABCCAABACCBAABACABAAAACBCBAAC.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in System32 directory
                                                                                        • Drops file in Program Files directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:5760
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCAABBABCBBBAAACBCACACBABACBBBBCAAACACCCCBBCABAACCACACCBAAACBBBCBABCBCCCBACCCBAABBBAABABCCBCCCAACBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAAACAABCCCCACCBBBAACCBCACABBBCBAAACCABCBAAACCACBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                          2⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:2692
                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCAABBABCBBBAAACBCACACBABACBBBBCAAACACCCCBBCABAACCACACCBAAACBBBCBABCBCCCBACCCBAABBBAABABCCBCCCAACBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAAACAABCCCCACCBBBAACCBCACABBBCBAAACCABCBAAACCACBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                            3⤵
                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                            PID:1100
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABACBABAAACAACBACCBBBAAACCACAACCBBACABBACBCBCCCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAAACAABCCCCACCBBBAACCBCACABBBCBAAACCABCBAAACCACBBCB.exe" start= auto displayName= "UserDataSvc_AABACBABAAACAACBACCBBBAAACCACAACCBBACABBACBCBCCCAAA"
                                                                                          2⤵
                                                                                            PID:4324
                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                              sc create "UserDataSvc_AABACBABAAACAACBACCBBBAAACCACAACCBBACABBACBCBCCCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAAACAABCCCCACCBBBAACCBCACABBBCBAAACCABCBAAACCACBBCB.exe" start= auto displayName= "UserDataSvc_AABACBABAAACAACBACCBBBAAACCACAACCBBACABBACBCBCCCAAA"
                                                                                              3⤵
                                                                                              • Launches sc.exe
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:2916
                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCABBABCCCABACCABACCABABABCBAAACAACACACCBBBCCBACACBBB.exe
                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCABBABCCCABACCABACCABABABCBAAACAACACACCBBBCCBACACBBB.exe
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          • Adds Run key to start application
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:4680
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCAAAACAABABCCCACACBABABBCBCCBBBBCCCABABABCCBCBACABCBBABBBBCCBCBBCCCCCABAABACBBCACBBBACCCCABABBBAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCACCCACBBCBCBBABCBCACACBABACCBCBACBCBCBAAABBCBCBBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                            2⤵
                                                                                              PID:4248
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCAAAACAABABCCCACACBABABBCBCCBBBBCCCABABABCCBCBACABCBBABBBBCCBCBBCCCCCABAABACBBCACBBBACCCCABABBBAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCACCCACBBCBCBBABCBCACACBABACCBCBACBCBCBAAABBCBCBBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                3⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                PID:4948
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABACBABAAACAACBACCBBBAAACCACAACCBBACABBACBCBCCCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCACCCACBBCBCBBABCBCACACBABACCBCBACBCBCBAAABBCBCBBBAC.exe" start= auto displayName= "UserDataSvc_AABACBABAAACAACBACCBBBAAACCACAACCBBACABBACBCBCCCAAA"
                                                                                              2⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:3572
                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                sc create "UserDataSvc_AABACBABAAACAACBACCBBBAAACCACAACCBBACABBACBCBCCCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCACCCACBBCBCBBABCBCACACBABACCBCBACBCBCBAAABBCBCBBBAC.exe" start= auto displayName= "UserDataSvc_AABACBABAAACAACBACCBBBAAACCACAACCBBACABBACBCBCCCAAA"
                                                                                                3⤵
                                                                                                • Launches sc.exe
                                                                                                PID:1356
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABACBABAAACAACBACCBBBAAACCACAACCBBACABBACBCBCCCAAA"
                                                                                              2⤵
                                                                                                PID:6252
                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                  sc start "UserDataSvc_AABACBABAAACAACBACCBBBAAACCACAACCBBACABBACBCBCCCAAA"
                                                                                                  3⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:6492
                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACCCCCBBCACCACCBCAACBABBACACCCABBCCCBBBABCBBBBCBCBAB.exe
                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACCCCCBBCACCACCBCAACBABBACACCCABBCCCBBBABCBBBBCBCBAB.exe
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:5948
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCCCBACCABBBBBCCCCABBCCCBBBBAABBBABCACCBCCACBABABBBABABACCBCABAABBAABBBACAABCACCCCABAABCABABCCACBBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAAAACCABCBBABCBBAABAACBCACCACABBAAACCCAABBCBABABCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                2⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:6768
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCCCBACCABBBBBCCCCABBCCCBBBBAABBBABCACCBCCACBABABBBABABACCBCABAABBAABBBACAABCACCCCABAABCABABCCACBBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAAAACCABCBBABCBBAABAACBCACCACABBAAACCCAABBCBABABCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                  3⤵
                                                                                                    PID:6672
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCABBCBCCABABCAABCAACCABCBAAAABABAACCBBCBBAACBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAAAACCABCBBABCBBAABAACBCACCACABBAAACCCAABBCBABABCBB.exe" start= auto displayName= "UserDataSvc_AABCABBCBCCABABCAABCAACCABCBAAAABABAACCBBCBBAACBCCA"
                                                                                                  2⤵
                                                                                                    PID:6560
                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                      sc create "UserDataSvc_AABCABBCBCCABABCAABCAACCABCBAAAABABAACCBBCBBAACBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAAAACCABCBBABCBBAABAACBCACCACABBAAACCCAABBCBABABCBB.exe" start= auto displayName= "UserDataSvc_AABCABBCBCCABABCAABCAACCABCBAAAABABAACCBBCBBAACBCCA"
                                                                                                      3⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:7072
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCABBCBCCABABCAABCAACCABCBAAAABABAACCBBCBBAACBCCA"
                                                                                                    2⤵
                                                                                                      PID:4664
                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                        sc start "UserDataSvc_AABCABBCBCCABABCAABCAACCABCBAAAABABAACCBBCBBAACBCCA"
                                                                                                        3⤵
                                                                                                        • Launches sc.exe
                                                                                                        PID:6360
                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBCABCACABCCCAAACACBBCCBCACABBBCABBCABBBBCCBAAABCBA.exe
                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBCABCACABCCCAAACACBBCCBCACABBBCABBCABBBBCCBAAABCBA.exe
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:4872
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCACCCBCAAABBACCCACCAAACBBCBBBCBCBAACCBBBCCCAABCABAACBCACAACBCBAACBBAABABCABBACABACACABACCAACBCACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCCACCBBBCCCBABACAABCBAACAACCCACBCACAABACCCBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                      2⤵
                                                                                                        PID:4208
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCACCCBCAAABBACCCACCAAACBBCBBBCBCBAACCBBBCCCAABCABAACBCACAACBCBAACBBAABABCABBACABACACABACCAACBCACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCCACCBBBCCCBABACAABCBAACAACCCACBCACAABACCCBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                          3⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                          PID:6756
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAACCABACABAACAAABBACABCBACCCCCCCBBBBACAACBBACBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCCACCBBBCCCBABACAABCBAACAACCCACBCACAABACCCBCAA.exe" start= auto displayName= "UserDataSvc_CAAACCABACABAACAAABBACABCBACCCCCCCBBBBACAACBBACBCBB"
                                                                                                        2⤵
                                                                                                          PID:6536
                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                            sc create "UserDataSvc_CAAACCABACABAACAAABBACABCBACCCCCCCBBBBACAACBBACBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCCACCBBBCCCBABACAABCBAACAACCCACBCACAABACCCBCAA.exe" start= auto displayName= "UserDataSvc_CAAACCABACABAACAAABBACABCBACCCCCCCBBBBACAACBBACBCBB"
                                                                                                            3⤵
                                                                                                            • Launches sc.exe
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:3244
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAACCABACABAACAAABBACABCBACCCCCCCBBBBACAACBBACBCBB"
                                                                                                          2⤵
                                                                                                            PID:7108
                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                              sc start "UserDataSvc_CAAACCABACABAACAAABBACABCBACCCCCCCBBBBACAACBBACBCBB"
                                                                                                              3⤵
                                                                                                              • Launches sc.exe
                                                                                                              PID:3620
                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBCABCACABCCCAAACACBBCCBCACABBBCABBCABBBBCCBAAABCBA.exe
                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBCABCACABCCCAAACACBBCCBCACABBBCABBCABBBBCCBAAABCBA.exe
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:788
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCBBCABBACBBACCCACAAABACABBABBCAABCCBCCCCAACABCABCCACBBCCAACBBAAAABBACCACBBACCBBAAAACCACBBBCBABBCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCAAAAACCACABCCCABABBABBCCAABBCAACABBBCCBCCBBABBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                            2⤵
                                                                                                              PID:3208
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCBBCABBACBBACCCACAAABACABBABBCAABCCBCCCCAACABCABCCACBBCCAACBBAAAABBACCACBBACCBBAAAACCACBBBCBABBCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCAAAAACCACABCCCABABBABBCCAABBCAACABBBCCBCCBBABBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                3⤵
                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                PID:6168
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAACBABABBAACABBCCACCBBCCAACACABCCBCBCCBABCBBBAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCAAAAACCACABCCCABABBABBCCAABBCAACABBBCCBCCBBABBBB.exe" start= auto displayName= "UserDataSvc_BCAACBABABBAACABBCCACCBBCCAACACABCCBCBCCBABCBBBAABA"
                                                                                                              2⤵
                                                                                                                PID:4272
                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                  sc create "UserDataSvc_BCAACBABABBAACABBCCACCBBCCAACACABCCBCBCCBABCBBBAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCAAAAACCACABCCCABABBABBCCAABBCAACABBBCCBCCBBABBBB.exe" start= auto displayName= "UserDataSvc_BCAACBABABBAACABBCCACCBBCCAACACABCCBCBCCBABCBBBAABA"
                                                                                                                  3⤵
                                                                                                                  • Launches sc.exe
                                                                                                                  PID:7024
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAACBABABBAACABBCCACCBBCCAACACABCCBCBCCBABCBBBAABA"
                                                                                                                2⤵
                                                                                                                  PID:6916
                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                    sc start "UserDataSvc_BCAACBABABBAACABBCCACCBBCCAACACABCCBCBCCBABCBBBAABA"
                                                                                                                    3⤵
                                                                                                                      PID:6668
                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAACACCBBCACCBCAACACCCCAABBBAACAABCABABBBBCAAABAAAC.exe
                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAACACCBBCACCBCAACACCCCAABBBAACAABCABABBBBCAAABAAAC.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:3312
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACAACBBACCABBACABBCCCCCCAAAABBBCCAAAABBCCCCCCAACBBACCCCCACAAAACBBBCCCACBBBBBAABBAACCABABACABABBACAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCACABBAAABACBBCCCBABBCAACCCCAABCBCCBACCCCCCBAAACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                    2⤵
                                                                                                                      PID:6844
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACAACBBACCABBACABBCCCCCCAAAABBBCCAAAABBCCCCCCAACBBACCCCCACAAAACBBBCCCACBBBBBAABBAACCABABACABABBACAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCACABBAAABACBBCCCBABBCAACCCCAABCBCCBACCCCCCBAAACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                        3⤵
                                                                                                                          PID:5956
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAAAACCBCCACCABACBCCCCBAABACAACCCBCCABCBAACACABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCACABBAAABACBBCCCBABBCAACCCCAABCBCCBACCCCCCBAAACBC.exe" start= auto displayName= "UserDataSvc_CBAAAACCBCCACCABACBCCCCBAABACAACCCBCCABCBAACACABBCC"
                                                                                                                        2⤵
                                                                                                                          PID:6820
                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                            sc create "UserDataSvc_CBAAAACCBCCACCABACBCCCCBAABACAACCCBCCABCBAACACABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCACABBAAABACBBCCCBABBCAACCCCAABCBCCBACCCCCCBAAACBC.exe" start= auto displayName= "UserDataSvc_CBAAAACCBCCACCABACBCCCCBAABACAACCCBCCABCBAACACABBCC"
                                                                                                                            3⤵
                                                                                                                            • Launches sc.exe
                                                                                                                            PID:5416
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAAAACCBCCACCABACBCCCCBAABACAACCCBCCABCBAACACABBCC"
                                                                                                                          2⤵
                                                                                                                            PID:6284
                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                              sc start "UserDataSvc_CBAAAACCBCCACCABACBCCCCBAABACAACCCBCCABCBAACACABBCC"
                                                                                                                              3⤵
                                                                                                                                PID:6600
                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAACACCBBCACCBCAACACCCCAABBBAACAABCABABBBBCAAABAAAC.exe
                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAACACCBBCACCBCAACACCCCAABBBAACAABCABABBBBCAAABAAAC.exe
                                                                                                                            1⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:5176
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABCABAABACAACABCAAAACBBBBCAACCBAABCBBCABCACAABAAACBACACCAAACABCBACCBCCBBBBCAAAAAAACCCABCBCBCCAABCBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCCCBCACCCACBCBBCAAACBCAACAAAAACACCACABBABBBAAAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                              2⤵
                                                                                                                                PID:6788
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABCABAABACAACABCAAAACBBBBCAACCBAABCBBCABCACAABAAACBACACCAAACABCBACCBCCBBBBCAAAAAAACCCABCBCBCCAABCBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCCCBCACCCACBCBBCAAACBCAACAAAAACACCACABBABBBAAAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                  3⤵
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:6508
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCAACACBCBCBCCAAAABABCAACCBBBBABACABCCCBABBAACABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCCCBCACCCACBCBBCAAACBCAACAAAAACACCACABBABBBAAAACCC.exe" start= auto displayName= "UserDataSvc_BBBCAACACBCBCBCCAAAABABCAACCBBBBABACABCCCBABBAACABB"
                                                                                                                                2⤵
                                                                                                                                  PID:5912
                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                    sc create "UserDataSvc_BBBCAACACBCBCBCCAAAABABCAACCBBBBABACABCCCBABBAACABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCCCBCACCCACBCBBCAAACBCAACAAAAACACCACABBABBBAAAACCC.exe" start= auto displayName= "UserDataSvc_BBBCAACACBCBCBCCAAAABABCAACCBBBBABACABCCCBABBAACABB"
                                                                                                                                    3⤵
                                                                                                                                    • Launches sc.exe
                                                                                                                                    PID:7080
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCAACACBCBCBCCAAAABABCAACCBBBBABACABCCCBABBAACABB"
                                                                                                                                  2⤵
                                                                                                                                    PID:7132
                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                      sc start "UserDataSvc_BBBCAACACBCBCBCCAAAABABCAACCBBBBABACABCCCBABBAACABB"
                                                                                                                                      3⤵
                                                                                                                                        PID:7896
                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBBCACBACCBCCCBAACABCABCCCBABBBAACCACABCCBBCABACCBA.exe
                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBBCACBACCBCCCBAACABCABCCCBABBBAACCACABCCBBCABACCBA.exe
                                                                                                                                    1⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:4772
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAACACBABACCBABCCBBCBCCBBBACBBAACCBAAACABAAAAAABCCAABBAAACCACCBCBABCCABAABACCCBBAABCACCABBCACABAACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBABCBAACBBAAABACAACCCBABCCCAAABBACCAABCCCCACAAAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                      2⤵
                                                                                                                                        PID:6920
                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAACACBABACCBABCCBBCBCCBBBACBBAACCBAAACABAAAAAABCCAABBAAACCACCBCBABCCABAABACCCBBAABCACCABBCACABAACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBABCBAACBBAAABACAACCCBABCCCAAABBACCAABCCCCACAAAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                          3⤵
                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                          PID:984
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACCACBABBBCABBCACACACCABACACBAACABCBBAACCABBBBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBABCBAACBBAAABACAACCCBABCCCAAABBACCAABCCCCACAAAAAAB.exe" start= auto displayName= "UserDataSvc_BAACCACBABBBCABBCACACACCABACACBAACABCBBAACCABBBBAAA"
                                                                                                                                        2⤵
                                                                                                                                          PID:7840
                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                            sc create "UserDataSvc_BAACCACBABBBCABBCACACACCABACACBAACABCBBAACCABBBBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBABCBAACBBAAABACAACCCBABCCCAAABBACCAABCCCCACAAAAAAB.exe" start= auto displayName= "UserDataSvc_BAACCACBABBBCABBCACACACCABACACBAACABCBBAACCABBBBAAA"
                                                                                                                                            3⤵
                                                                                                                                            • Launches sc.exe
                                                                                                                                            PID:8168
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACCACBABBBCABBCACACACCABACACBAACABCBBAACCABBBBAAA"
                                                                                                                                          2⤵
                                                                                                                                            PID:7564
                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                              sc start "UserDataSvc_BAACCACBABBBCABBCACACACCABACACBAACABCBBAACCABBBBAAA"
                                                                                                                                              3⤵
                                                                                                                                              • Launches sc.exe
                                                                                                                                              PID:6780
                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBBCACBACCBCCCBAACABCABCCCBABBBAACCACABCCBBCABACCBA.exe
                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBBCACBACCBCCCBAACABCABCCCBABBBAACCACABCCBBCABACCBA.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:2752
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAACACBABACCBABCCBBCBCCBBBACBBAACCBAAACABAAAAAABCCAABBAAACCACCBCBABCCABAABACCCBBAABCACCABBCACABAACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBCBAAAABCAAABBBCCCCACBABACAABBBCCCAACBBBAACBAACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                            2⤵
                                                                                                                                              PID:7012
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAACACBABACCBABCCBBCBCCBBBACBBAACCBAAACABAAAAAABCCAABBAAACCACCBCBABCCABAABACCCBBAABCACCABBCACABAACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBCBAAAABCAAABBBCCCCACBABACAABBBCCCAACBBBAACBAACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                3⤵
                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                PID:5936
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBAACABACAABBBAAACCBACBBBAAACBACBCCBCCACAABACACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBCBAAAABCAAABBBCCCCACBABACAABBBCCCAACBBBAACBAACCA.exe" start= auto displayName= "UserDataSvc_BBBAACABACAABBBAAACCBACBBBAAACBACBCCBCCACAABACACCAA"
                                                                                                                                              2⤵
                                                                                                                                                PID:7356
                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                  sc create "UserDataSvc_BBBAACABACAABBBAAACCBACBBBAAACBACBCCBCCACAABACACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBCBAAAABCAAABBBCCCCACBABACAABBBCCCAACBBBAACBAACCA.exe" start= auto displayName= "UserDataSvc_BBBAACABACAABBBAAACCBACBBBAAACBACBCCBCCACAABACACCAA"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:7916
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBAACABACAABBBAAACCBACBBBAAACBACBCCBCCACAABACACCAA"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:8068
                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                      sc start "UserDataSvc_BBBAACABACAABBBAAACCBACBBBAAACBACBCCBCCACAABACACCAA"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1752
                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABACCBACCBBCCCCBCCCBCCAAAAAAABAAAACACBABBBCABAAABCC.exe
                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABACCBACCBBCCCCBCCCBCCAAAAAAABAAAACACBABBBCABAAABCC.exe
                                                                                                                                                    1⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:6264
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCABCCAABACBAAACAAACACBCBBCBCCCBBAAABCCBBACBABCBCBAACAACBBCBCBACCCBBCBCBBCBBAABBCCAACAAABABBCBAAAAAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABCCBCCCACCABAAACAACCBACBABAABAABCAABCCABABCAABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1736
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCABCCAABACBAAACAAACACBCBBCBCCCBBAAABCCBBACBABCBCBAACAACBBCBCBACCCBBCBCBBCBBAABBCCAACAAABABBCBAAAAAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABCCBCCCACCABAAACAACCBACBABAABAABCAABCCABABCAABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                          3⤵
                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                          PID:4992
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACCBBCACAACCCCBBCBAABCCBBAACABCBBAAABCAAACACCBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABCCBCCCACCABAAACAACCBACBABAABAABCAABCCABABCAABCCA.exe" start= auto displayName= "UserDataSvc_ABACCBBCACAACCCCBBCBAABCCBBAACABCBBAAABCAAACACCBCAC"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:9732
                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                            sc create "UserDataSvc_ABACCBBCACAACCCCBBCBAABCCBBAACABCBBAAABCAAACACCBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABCCBCCCACCABAAACAACCBACBABAABAABCAABCCABABCAABCCA.exe" start= auto displayName= "UserDataSvc_ABACCBBCACAACCCCBBCBAABCCBBAACABCBBAAABCAAACACCBCAC"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:8492
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACCBBCACAACCCCBBCBAABCCBBAACABCBBAAABCAAACACCBCAC"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:9992
                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                sc start "UserDataSvc_ABACCBBCACAACCCCBBCBAABCCBBAACABCBBAAABCAAACACCBCAC"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:1696
                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCAACABCABAACACCCABBCACBCABBCBBCABCCCCBCCABACCCBAABB.exe
                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCAACABCABAACACCCABBCACBCABBCBBCABCCCCBCCABACCCBAABB.exe
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:6292
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBABCBACCCABAABBCAAACBABBBABCABAABABACBBCACCBCBBABBABACBBCBBBCBAACCABACBAACACBBBCBBCCCCBABCCBABBAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBBCCCBCBCBBCCCCBBBABAAAABACBCACCCBCCAACBAACBCACAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:8852
                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBABCBACCCABAABBCAAACBABBBABCABAABABACBBCACCBCBBABBABACBBCBBBCBAACCABACBAACACBBBCBBCCCCBABCCBABBAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBBCCCBCBCBBCCCCBBBABAAAABACBCACCCBCCAACBAACBCACAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                    PID:9208
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACCBABCACCCABCBABAABAABCCCAABCABCCBBCCBCCACACCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBBCCCBCBCBBCCCCBBBABAAAABACBCACCCBCCAACBAACBCACAABA.exe" start= auto displayName= "UserDataSvc_ABACCBABCACCCABCBABAABAABCCCAABCABCCBBCCBCCACACCAAC"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:9864
                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                      sc create "UserDataSvc_ABACCBABCACCCABCBABAABAABCCCAABCABCCBBCCBCCACACCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBBCCCBCBCBBCCCCBBBABAAAABACBCACCCBCCAACBAACBCACAABA.exe" start= auto displayName= "UserDataSvc_ABACCBABCACCCABCBABAABAABCCCAABCABCCBBCCBCCACACCAAC"
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                      PID:6328
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACCBABCACCCABCBABAABAABCCCAABCABCCBBCCBCCACACCAAC"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:3112
                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                        sc start "UserDataSvc_ABACCBABCACCCABCBABAABAABCCCAABCABCCBBCCBCCACACCAAC"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:10992
                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAAACAABCCCCACCBBBAACCBCACABBBCBAAACCABCBAAACCACBBCB.exe
                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAAACAABCCCCACCBBBAACCBCACABBBCBAAACCABCBAAACCACBBCB.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:6340
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBABCBACCCABAABBCAAACBABBBABCABAABABACBBCACCBCBBABBABACBBCBBBCBAACCABACBAACACBBBCBBCCCCBABCCBABBAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACABAAACBBCACBACCACCBAACAABBBBCBBBACAACCABBCAAACCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:4444
                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBABCBACCCABAABBCAAACBABBBABCABAABABACBBCACCBCBBABBABACBBCBBBCBAACCABACBAACACBBBCBBCCCCBABCCBABBAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACABAAACBBCACBACCACCBAACAABBBBCBBBACAACCABBCAAACCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                            PID:9016
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCABAAACACCCCBBBCACBBACAAABABBABBBCAAABABAACBCBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACABAAACBBCACBACCACCBAACAABBBBCBBBACAACCABBCAAACCCBA.exe" start= auto displayName= "UserDataSvc_ACCABAAACACCCCBBBCACBBACAAABABBABBBCAAABABAACBCBBCB"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:9512
                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                              sc create "UserDataSvc_ACCABAAACACCCCBBBCACBBACAAABABBABBBCAAABABAACBCBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACABAAACBBCACBACCACCBAACAABBBBCBBBACAACCABBCAAACCCBA.exe" start= auto displayName= "UserDataSvc_ACCABAAACACCCCBBBCACBBACAAABABBABBBCAAABABAACBCBBCB"
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:8440
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCABAAACACCCCBBBCACBBACAAABABBABBBCAAABABAACBCBBCB"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:5620
                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                  sc start "UserDataSvc_ACCABAAACACCCCBBBCACBBACAAABABBABBBCAAABABAACBCBBCB"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:9852
                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCAACABCABAACACCCABBCACBCABBCBBCABCCCCBCCABACCCBAABB.exe
                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCAACABCABAACACCCABBCACBCABBCBBCABCCCCBCCABACCCBAABB.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:6472
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBABCBAAABBCABCBBCBCBCBCBCBBABCABBCCBACBACCBBCBBBBABACACCCBABBBBCCABCCBBCCCBCCCCBBACBCAAACCCABBABACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBBBCCAACBCACCBCBCAABBBACCAACABAABBAAAACAAACBBBCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:9212
                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBABCBAAABBCABCBBCBCBCBCBCBBABCABBCCBACBACCBBCBBBBABACACCCBABBBBCCABCCBBCCCBCCCCBBACBCAAACCCABBABACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBBBCCAACBCACCBCBCAABBBACCAACABAABBAAAACAAACBBBCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                      PID:9468
                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABACCBACCBBCCCCBCCCBCCAAAAAAABAAAACACBABBBCABAAABCC.exe
                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABACCBACCBBCCCCBCCCBCCAAAAAAABAAAACACBABBBCABAAABCC.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:6520
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBABCBCBABAABCBABCAACAABBABCCBABACACBACBBCBCBBCACCBCAABCBCCCABBCCCBBCCBCBCBBCCBBCCAAACCCCAAACAACBAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCAACBCABCBACBABACCBBBCABBAABBBAABBACABABCBAABCABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:9140
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBABCBCBABAABCBABCAACAABBABCCBABACACBACBBCBCBBCACCBCAABCBCCCABBCCCBBCCBCBCBBCCBBCCAAACCCCAAACAACBAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCAACBCABCBACBABACCBBBCABBAABBBAABBACABABCBAABCABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                        PID:9556
                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCACCCACBBCBCBBABCBCACACBABACCBCBACBCBCBAAABBCBCBBBAC.exe
                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCACCCACBBCBCBBABCBCACACBABACCBCBACBCBCBAAABBCBCBBBAC.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:6620
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAAABCCBBABCBBACCAABBCCCBCBABCCBAACBBACBBCBBACBCAAACCACBBBBCBCCBACBBABBCBCAABCCBCBCBCCBCCCBBCBABAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBBAAAAAAABCAABBABCBBACBBBBBBACACCABCCBBBABABCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:8668
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAAABCCBBABCBBACCAABBCCCBCBABCCBAACBBACBBCBBACBCAAACCACBBBBCBCCBACBBABBCBCAABCCBCBCBCCBCCCBBCBABAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBBAAAAAAABCAABBABCBBACBBBBBBACACCABCCBBBABABCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:9788
                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCACCCACBBCBCBBABCBCACACBABACCBCBACBCBCBAAABBCBCBBBAC.exe
                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCACCCACBBCBCBBABCBCACACBABACCBCBACBCBCBAAABBCBCBBBAC.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:6628
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABABBBABBACCAAACCBBCBBAABCABCACCCACCCABAABCBAABABBBCBBBABBACBCCCBBCCCCACBACCCBCCCAACAAAABBABBBBBCBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCCABAAABCABCBCACAABBBACABBBABAACBABABCBABBCBCABBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:5276
                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABABBBABBACCAAACCBBCBBAABCABCACCCACCCABAABCBAABABBBCBBBABBACBCCCBBCCCCACBACCCBCCCAACAAAABBABBBBBCBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCCABAAABCABCBCACAABBBACABBBABAACBABABCBABBCBCABBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                              PID:9688
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABABBBACABCCBABBCBCBCBCBCCBBABCBCCABCBCBBBCCBABCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCCABAAABCABCBCACAABBBACABBBABAACBABABCBABBCBCABBBCC.exe" start= auto displayName= "UserDataSvc_ABABBBACABCCBABBCBCBCBCBCCBBABCBCCABCBCBBBCCBABCBAC"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:9544
                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                sc create "UserDataSvc_ABABBBACABCCBABBCBCBCBCBCCBBABCBCCABCBCBBBCCBABCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCCABAAABCABCBCACAABBBACABBBABAACBABABCBABBCBCABBBCC.exe" start= auto displayName= "UserDataSvc_ABABBBACABCCBABBCBCBCBCBCCBBABCBCCABCBCBBBCCBABCBAC"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:1480
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABABBBACABCCBABBCBCBCBCBCCBBABCBCCABCBCBBBCCBABCBAC"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:9560
                                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                    sc start "UserDataSvc_ABABBBACABCCBABBCBCBCBCBCCBBABCBCCABCBCBBBCCBABCBAC"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                    PID:7372
                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAAAACCABCBBABCBBAABAACBCACCACABBAAACCCAABBCBABABCBB.exe
                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAAAACCABCBBABCBBAABAACBCACCACABBAAACCCAABBCBABABCBB.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:6944
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBAAABBBBCCBBBACAABBCBCACACBCCCCCCAACBACCBCCBCCBCCCACCACACCBCABCCCBAACCBBBBCAACAAACBCABCCAAAAABBCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBBCBBCACCCBCBACBCCACACBAACCBABCAABCAABBCCCACAABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:7304
                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBAAABBBBCCBBBACAABBCBCACACBCCCCCCAACBACCBCCBCCBCCCACCACACCBCABCCCBAACCBBBBCAACAAACBCABCCAAAAABBCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBBCBBCACCCBCBACBCCACACBAACCBABCAABCAABBCCCACAABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:5904
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCBABAAACBAABCAABACBCCBCCCACBCBBACACBCBBACCCBCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBBCBBCACCCBCBACBCCACACBAACCBABCAABCAABBCCCACAABAAA.exe" start= auto displayName= "UserDataSvc_CABCBABAAACBAABCAABACBCCBCCCACBCBBACACBCBBACCCBCCCB"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:7388
                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                          sc create "UserDataSvc_CABCBABAAACBAABCAABACBCCBCCCACBCBBACACBCBBACCCBCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBBCBBCACCCBCBACBCCACACBAACCBABCAABCAABBCCCACAABAAA.exe" start= auto displayName= "UserDataSvc_CABCBABAAACBAABCAABACBCCBCCCACBCBBACACBCBBACCCBCCCB"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                          PID:6576
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCBABAAACBAABCAABACBCCBCCCACBCBBACACBCBBACCCBCCCB"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:8020
                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                            sc start "UserDataSvc_CABCBABAAACBAABCAABACBCCBCCCACBCBBACACBCBBACCCBCCCB"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:3264
                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCCACCBBBCCCBABACAABCBAACAACCCACBCACAABACCCBCAA.exe
                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCCACCBBBCCCBABACAABCBAACAACCCACBCACAABACCCBCAA.exe
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:5564
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBCABBCACAABACCABACCBACAAABCACABCCBCACAACCCAAABBBCAAABACACCAABCABCABCBAACCCACABBBAACBBABCBBACBCCCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBAACBACBBCABABCBAAAAAAACCCBCBAABBBCBACBBBCCACBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:7832
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBCABBCACAABACCABACCBACAAABCACABCCBCACAACCCAAABBBCAAABACACCAABCABCABCBAACCCACABBBAACBBABCBBACBCCCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBAACBACBBCABABCBAAAAAAACCCBCBAABBBCBACBBBCCACBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                  PID:5556
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCABACCBAAAACBAACAAABABBACCCCCCCABACCCCBABABCCBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBAACBACBBCABABCBAAAAAAACCCBCBAABBBCBACBBBCCACBACBC.exe" start= auto displayName= "UserDataSvc_ACCABACCBAAAACBAACAAABABBACCCCCCCABACCCCBABABCCBBAC"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:7296
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                    sc create "UserDataSvc_ACCABACCBAAAACBAACAAABABBACCCCCCCABACCCCBABABCCBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBAACBACBBCABABCBAAAAAAACCCBCBAABBBCBACBBBCCACBACBC.exe" start= auto displayName= "UserDataSvc_ACCABACCBAAAACBAACAAABABBACCCCCCCABACCCCBABABCCBBAC"
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:7888
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCABACCBAAAACBAACAAABABBACCCCCCCABACCCCBABABCCBBAC"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:4524
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                        sc start "UserDataSvc_ACCABACCBAAAACBAACAAABABBACCCCCCCABACCCCBABABCCBBAC"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                        PID:3708
                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAAAACCABCBBABCBBAABAACBCACCACABBAAACCCAABBCBABABCBB.exe
                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAAAACCABCBBABCBBAABAACBCACCACABBAAACCCAABBCBABABCBB.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:6672
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABBBBBBABCCCBCCBACCCAAACBCABCBBCABABACCBCCACABCABAACACCAACAACABCBBCCBCBCABCBBAAABBAACBABACACBBBCCCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAACAAABBBBABCBCBAAABAABACABCBBACABBCBBACBBBABCBBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:4624
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABBBBBBABCCCBCCBACCCAAACBCABCBBCABABACCBCCACABCABAACACCAACAACABCBBCCBCBCABCBBAAABBAACBABACACBBBCCCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAACAAABBBBABCBCBAAABAABACABCBBACABBCBBACBBBABCBBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                            PID:7960
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACACABBACBCBCAABACCBBCCACCCBBBBCCCCABCAABBABCABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAACAAABBBBABCBCBAAABAABACABCBBACABBCBBACBBBABCBBABC.exe" start= auto displayName= "UserDataSvc_BAACACABBACBCBCAABACCBBCCACCCBBBBCCCCABCAABBABCABBA"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1568
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                              sc create "UserDataSvc_BAACACABBACBCBCAABACCBBCCACCCBBBBCCCCABCAABBABCABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAACAAABBBBABCBCBAAABAABACABCBBACABBCBBACBBBABCBBABC.exe" start= auto displayName= "UserDataSvc_BAACACABBACBCBCAABACCBBCCACCCBBBBCCCCABCAABBABCABBA"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                              PID:7704
                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCCACCBBBCCCBABACAABCBAACAACCCACBCACAABACCCBCAA.exe
                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCCACCBBBCCCBABACAABCBAACAACCCACBCACAABACCCBCAA.exe
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:6540
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACBABBBCCABCAACCCBACABCBCCCACCCCBAACACBCAAABBCABCBBCCBBCBABAAACABCABCCAACCBAABABACCBCBCCBCBBAACBCBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBBABCCCBCCBACCCAAACBCABCBBCABABACCBCCACABCABAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:7236
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACBABBBCCABCAACCCBACABCBCCCACCCCBAACACBCAAABBCABCBBCCBBCBABAAACABCABCCAACCBAABABACCBCBCCBCBBAACBCBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBBABCCCBCCBACCCAAACBCABCBBCABABACCBCCACABCABAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                  PID:7976
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACACABBACBCBCAABACCBBCCACCCBBBBCCCCABCAABBABCABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBBABCCCBCCBACCCAAACBCABCBBCABABACCBCCACABCABAACA.exe" start= auto displayName= "UserDataSvc_BAACACABBACBCBCAABACCBBCCACCCBBBBCCCCABCAABBABCABBA"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:812
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                    sc create "UserDataSvc_BAACACABBACBCBCAABACCBBCCACCCBBBBCCCCABCAABBABCABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBBABCCCBCCBACCCAAACBCABCBBCABABACCBCCACABCABAACA.exe" start= auto displayName= "UserDataSvc_BAACACABBACBCBCAABACCBBCCACCCBBBBCCCCABCAABBABCABBA"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                    PID:7600
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACACABBACBCBCAABACCBBCCACCCBBBBCCCCABCAABBABCABBA"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:7644
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                      sc start "UserDataSvc_BAACACABBACBCBCAABACCBBCCACCCBBBBCCCCABCAABBABCABBA"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:8088
                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCAAAAACCACABCCCABABBABBCCAABBCAACABBBCCBCCBBABBBB.exe
                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCAAAAACCACABCCCABABBABBCCAABBCAACABBBCCBCCBBABBBB.exe
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:2104
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCAACCABACCABBACABCCCCBAAABACABCACACABACCBBBACBBCABCACCAAACBCCBBCACABABAAABAACBACACCABCBBBBBAACCCBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAACAABBBCACCBCBACBAAAABCAABCBCACABBCABACAAACAABABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:9156
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCAACCABACCABBACABCCCCBAAABACABCACACABACCBBBACBBCABCACCAAACBCCBBCACABABAAABAACBACACCABCBBBBBAACCCBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAACAABBBCACCBCBACBAAAABCAABCBCACABBCABACAAACAABABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                            PID:8312
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCCBACCABACCCCCCCBACAACCCABAABAACCAAAABACACCABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAACAABBBCACCBCBACBAAAABCAABCBCACABBCABACAAACAABABBCC.exe" start= auto displayName= "UserDataSvc_CACCCBACCABACCCCCCCBACAACCCABAABAACCAAAABACACCABAAC"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:8880
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                              sc create "UserDataSvc_CACCCBACCABACCCCCCCBACAACCCABAABAACCAAAABACACCABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAACAABBBCACCBCBACBAAAABCAABCBCACABBCABACAAACAABABBCC.exe" start= auto displayName= "UserDataSvc_CACCCBACCABACCCCCCCBACAACCCABAABAACCAAAABACACCABAAC"
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:1892
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCCBACCABACCCCCCCBACAACCCABAABAACCAAAABACACCABAAC"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:9408
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                  sc start "UserDataSvc_CACCCBACCABACCCCCCCBACAACCCABAABAACCAAAABACACCABAAC"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                  PID:10188
                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCAAAAACCACABCCCABABBABBCCAABBCAACABBBCCBCCBBABBBB.exe
                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCAAAAACCACABCCCABABBABBCCAABBCAACABBBCCBCCBBABBBB.exe
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:6800
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCCCBABACCBCCCCBCCCBCACBBCBAACCABCCBACACBCCBABACBCBABABCCCAABCABBACBCACBABCCCCBACCACBBCBACBACCACBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBACCBABCACCABCBAABCCBCBCACAAACCCBABCBBCABBCBABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:9044
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCCCBABACCBCCCCBCCCBCACBBCBAACCABCCBACACBCCBABACBCBABABCCCAABCABBACBCACBABCCCCBACCACBBCBACBACCACBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBACCBABCACCABCBAABCCBCBCACAAACCCBABCBBCABBCBABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:7796
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACAACCAAAABCACBBBCAAACABACBBCBACAACBAACACAABCBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBACCBABCACCABCBAABCCBCBCACAAACCCBABCBBCABBCBABCAC.exe" start= auto displayName= "UserDataSvc_BBACAACCAAAABCACBBBCAAACABACBBCBACAACBAACACAABCBBBA"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:8336
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                          sc create "UserDataSvc_BBACAACCAAAABCACBBBCAAACABACBBCBACAACBAACACAABCBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBACCBABCACCABCBAABCCBCBCACAAACCCBABCBBCABBCBABCAC.exe" start= auto displayName= "UserDataSvc_BBACAACCAAAABCACBBBCAAACABACBBCBACAACBAACACAABCBBBA"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:8536
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACAACCAAAABCACBBBCAAACABACBBCBACAACBAACACAABCBBBA"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:8768
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                              sc start "UserDataSvc_BBACAACCAAAABCACBBBCAAACABACBBCBACAACBAACACAABCBBBA"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                                                              PID:8840
                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCACABBAAABACBBCCCBABBCAACCCCAABCBCCBACCCCCCBAAACBC.exe
                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCACABBAAABACBBCCCBABBCAACCCCAABCBCCBACCCCCCBAAACBC.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:6140
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACAACCCABACAAACCCCCAACBCABACCACCCBBBCCBABCBCCCCBBAAACBCCCCBCBCCCCAAAAABBACCCACCACACACBCAACBAAACCAABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAACCABCBBCBBBBCBCBACBBAABACAAAABCBBBCACABBCAAAAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:9948
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACAACCCABACAAACCCCCAACBCABACCACCCBBBCCBABCBCCCCBBAAACBCCCCBCBCCCCAAAAABBACCCACCACACACBCAACBAAACCAABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAACCABCBBCBBBBCBCBACBBAABACAAAABCBBBCACABBCAAAAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:8324
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCABBBCCCCCCABCCBBABCAAABBCCCBCCACCACCCCCACCACAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAACCABCBBCBBBBCBCBACBBAABACAAAABCBBBCACABBCAAAAAAAA.exe" start= auto displayName= "UserDataSvc_ABCABBBCCCCCCABCCBBABCAAABBCCCBCCACCACCCCCACCACAAAB"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:2732
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                      sc create "UserDataSvc_ABCABBBCCCCCCABCCBBABCAAABBCCCBCCACCACCCCCACCACAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAACCABCBBCBBBBCBCBACBBAABACAAAABCBBBCACABBCAAAAAAAA.exe" start= auto displayName= "UserDataSvc_ABCABBBCCCCCCABCCBBABCAAABBCCCBCCACCACCCCCACCACAAAB"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                      PID:10960
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCABBBCCCCCCABCCBBABCAAABBCCCBCCACCACCCCCACCACAAAB"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:11676
                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCACABBAAABACBBCCCBABBCAACCCCAABCBCCBACCCCCCBAAACBC.exe
                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCACABBAAABACBBCCCBABBCAACCCCAABCBCCBACCCCCCBAAACBC.exe
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:3932
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABACABCBCBBCBBACBABCBCACACBCCCACCBCAABAABACBAABACABBAAABCBBAABBCCBBABACBACABBABBBCBCBCCABBAAACBCABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCBAABBBBCAABBBABCABAAABAABABBBCCCCCABCBCBBAACBBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:9784
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABACABCBCBBCBBACBABCBCACACBCCCACCBCAABAABACBAABACABBAAABCBBAABBCCBBABACBACABBABBBCBCBCCABBAAACBCABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCBAABBBBCAABBBABCABAAABAABABBBCCCCCABCBCBBAACBBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                            PID:6308
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCACCABCBCAAABABCACCBCCAABCAABCBCACBBABCACCCBBACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCBAABBBBCAABBBABCABAAABAABABBBCCCCCABCBCBBAACBBCCB.exe" start= auto displayName= "UserDataSvc_BCCACCABCBCAAABABCACCBCCAABCAABCBCACBBABCACCCBBACBB"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:6776
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                              sc create "UserDataSvc_BCCACCABCBCAAABABCACCBCCAABCAABCBCACBBABCACCCBBACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCBAABBBBCAABBBABCABAAABAABABBBCCCCCABCBCBBAACBBCCB.exe" start= auto displayName= "UserDataSvc_BCCACCABCBCAAABABCACCBCCAABCAABCBCACBBABCACCCBBACBB"
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:10420
                                                                                                                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCCCBCACCCACBCBBCAAACBCAACAAAAACACCACABBABBBAAAACCC.exe
                                                                                                                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCCCBCACCCACBCBBCAAACBCAACAAAAACACCACABBABBBAAAACCC.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:7776
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBACBBBBCABABBBAAABAACABCBAACBBBCCACAACCCBCAAABCCAABCBCCCCBBBAABBCBBBABBCAABABAABCBAAACABCCACBCBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBABBACBCACBACACCAABABBAAACCBBCCABAABBBCAACBAABBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:10932
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBACBBBBCABABBBAAABAACABCBAACBBBCCACAACCCBCAAABCCAABCBCCCCBBBAABBCBBBABBCAABABAABCBAAACABCCACBCBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBABBACBCACBACACCAABABBAAACCBBCCABAABBBCAACBAABBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                    PID:3100
                                                                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBCBAAAABCAAABBBCCCCACBABACAABBBCCCAACBBBAACBAACCA.exe
                                                                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBCBAAAABCAAABBBCCCCACBABACAABBBCCCAACBBBAACBAACCA.exe
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:7784
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBACBBBBCABABBBAAABAACABCBAACBBBCCACAACCCBCAAABCCAABCBCCCCBBBAABBCBBBABBCAABABAABCBAAACABCCACBCBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBCBCBBCCBCBCCAABCACBCCAACAABBACCACCCCCABBBCAACBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:10920
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBACBBBBCABABBBAAABAACABCBAACBBBCCACAACCCBCAAABCCAABCBCCCCBBBAABBCBBBABBCAABABAABCBAAACABCCACBCBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBCBCBBCCBCBCCAABCACBCCAACAABBACCACCCCCABBBCAACBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                        PID:8188
                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAABAACAABCBBACCBBABCAACAACAABBCCBABBBBCCBAACCCBCBC.exe
                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAABAACAABCBBACCBBABCAACAACAABBCCBABBBBCCBAACCCBCBC.exe
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:7908
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCABAACCBBABABABBCCBAAABBACCBAAABCBABAAABCCCABCBCCBABABBABBAABCABCAAAACCACACCACBBCBACACBBAABABCCAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABCAAACCABCBCBCBACCBCABBBBCBCCCBCAACCACABBACACABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:7376
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCABAACCBBABABABBCCBAAABBACCBAAABCBABAAABCCCABCBCCBABABBABBAABCABCAAAACCACACCACBBCBACACBBAABABCCAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABCAAACCABCBCBCBACCBCABBBBCBCCCBCAACCACABBACACABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                            PID:4100
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABACCCCCCAAABCBBBAACCCAACAACCCACCBABAABCCACBACABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABCAAACCABCBCBCBACCBCABBBBCBCCCBCAACCACABBACACABAA.exe" start= auto displayName= "UserDataSvc_BBABACCCCCCAAABCBBBAACCCAACAACCCACCBABAABCCACBACABA"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:5820
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                              sc create "UserDataSvc_BBABACCCCCCAAABCBBBAACCCAACAACCCACCBABAABCCACBACABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABCAAACCABCBCBCBACCBCABBBBCBCCCBCAACCACABBACACABAA.exe" start= auto displayName= "UserDataSvc_BBABACCCCCCAAABCBBBAACCCAACAACCCACCBABAABCCACBACABA"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                                                                                              PID:7700
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABACCCCCCAAABCBBBAACCCAACAACCCACCBABAABCCACBACABA"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:8172
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                sc start "UserDataSvc_BBABACCCCCCAAABCBBBAACCCAACAACCCACCBABAABCCACBACABA"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                                PID:7980
                                                                                                                                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCCCBCACCCACBCBBCAAACBCAACAAAAACACCACABBABBBAAAACCC.exe
                                                                                                                                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCCCBCACCCACBCBBCAAACBCAACAAAAACACCACABBABBBAAAACCC.exe
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:7940
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBABBABACAAACABCBABBBCABABBBAABBACABABABBCACABAABAAAABAAABBBCBCACAABABBCCAABCBBCCBACAABBCACABABCCCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCCAACBBBBABAAABACBABBBACCBCBBAABBBBABCAACAAACBCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:7736
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBABBABACAAACABCBABBBCABABBBAABBACABABABBCACABAABAAAABAAABBBCBCACAABABBCCAABCBBCCBACAABBCACABABCCCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCCAACBBBBABAAABACBABBBACCBCBBAABBBBABCAACAAACBCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                    PID:3532
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCACAABCCAAABCABBAAAACAAAACCAACCCBACCCCCCBACACCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCCAACBBBBABAAABACBABBBACCBCBBAABBBBABCAACAAACBCAAB.exe" start= auto displayName= "UserDataSvc_BCCACAABCCAAABCABBAAAACAAAACCAACCCBACCCCCCBACACCACA"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:5392
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                      sc create "UserDataSvc_BCCACAABCCAAABCABBAAAACAAAACCAACCCBACCCCCCBACACCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCCAACBBBBABAAABACBABBBACCBCBBAABBBBABCAACAAACBCAAB.exe" start= auto displayName= "UserDataSvc_BCCACAABCCAAABCABBAAAACAAAACCAACCCBACCCCCCBACACCACA"
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                                      PID:7668
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCACAABCCAAABCABBAAAACAAAACCAACCCBACCCCCCBACACCACA"
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:4188
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                        sc start "UserDataSvc_BCCACAABCCAAABCABBAAAACAAAACCAACCCBACCCCCCBACACCACA"
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:3076
                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAABAACAABCBBACCBBABCAACAACAABBCCBABBBBCCBAACCCBCBC.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAABAACAABCBBACCBBABCAACAACAABBCCBABBBBCCBAACCCBCBC.exe
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:8180
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABACCBBBCBBACCBBBBCCBABCBAACCCBBACCBBABCABBBBCACBAACCCBCBBCBBCBBAACCAABAABCAABCCACABCBBAAABCBABAACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABACCBBBBCCCBABBAABBCBABACCBBABBAAABABABABBBACCBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:8816
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABACCBBBCBBACCBBBBCCBABCBAACCCBBACCBBABCABBBBCACBAACCCBCBBCBBCBBAACCAABAABCAABCCACABCBBAAABCBABAACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABACCBBBBCCCBABBAABBCBABACCBBABBAAABABABABBBACCBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                              PID:8868
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCCCABBCCACCBABBBAAABBABCAABCCCBACAACCAABACBACBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABACCBBBBCCCBABBAABBCBABACCBBABBAAABABABABBBACCBBAAA.exe" start= auto displayName= "UserDataSvc_BABCCCABBCCACCBABBBAAABBABCAABCCCBACAACCAABACBACBBA"
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:7468
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                sc create "UserDataSvc_BABCCCABBCCACCBABBBAAABBABCAABCCCBACAACCAABACBACBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABACCBBBBCCCBABBAABBCBABACCBBABBAAABABABABBBACCBBAAA.exe" start= auto displayName= "UserDataSvc_BABCCCABBCCACCBABBBAAABBABCAABCCCBACAACCAABACBACBBA"
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                                                PID:8664
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABCCCABBCCACCBABBBAAABBABCAABCCCBACAACCAABACBACBBA"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:8812
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                  sc start "UserDataSvc_BABCCCABBCCACCBABBBAAABBABCAABCCCBACAACCAABACBACBBA"
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                                                                                  PID:8304
                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAABBBAABBAABCBCAACCBBBCCBCCBBAABCCCAAAACCCBABCBABBBC.exe
                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAABBBAABBAABCBCAACCBBBCCBCCBBAABCCCAAAACCCBABCBABBBC.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:6700
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBAABBAABCCAAAABBABABCABACABBCCACABAAAABBABBABBBBBAACCCBCCCCCABABBBACCABACCCBBBCABACACACCBABBABAAAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCBABABBBCABBABAAABCBACBCAABACBABBACABBBABBBBAAACBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:9024
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBAABBAABCCAAAABBABABCABACABBCCACABAAAABBABBABBBBBAACCCBCCCCCABABBBACCABACCCBBBCABACACACCBABBABAAAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCBABABBBCABBABAAABCBACBCAABACBABBACABBBABBBBAAACBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                      PID:1892
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCAAAAACBABCACBCCBBACCCACCAAACCBABCBCCABCBCACBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCBABABBBCABBABAAABCBACBCAABACBABBACABBBABBBBAAACBCB.exe" start= auto displayName= "UserDataSvc_ABBCAAAAACBABCACBCCBBACCCACCAAACCBABCBCCABCBCACBBAC"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:8612
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                        sc create "UserDataSvc_ABBCAAAAACBABCACBCCBBACCCACCAAACCBABCBCCABCBCACBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCBABABBBCABBABAAABCBACBCAABACBABBACABBBABBBBAAACBCB.exe" start= auto displayName= "UserDataSvc_ABBCAAAAACBABCACBCCBBACCCACCAAACCBABCBCCABCBCACBBAC"
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                                                        PID:9096
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBCAAAAACBABCACBCCBBACCCACCAAACCBABCBCCABCBCACBBAC"
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:3068
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                          sc start "UserDataSvc_ABBCAAAAACBABCACBCCBBACCCACCAAACCBABCBCCABCBCACBBAC"
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                          PID:9584
                                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBABCBAACBBAAABACAACCCBABCCCAAABBACCAABCCCCACAAAAAAB.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBABCBAACBBAAABACAACCCBABCCCAAABBACCAABCCCCACAAAAAAB.exe
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:7232
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCBCACBCBCBBCAAABBCBCAACACBABACABBACAABAACBCBCCBACAACACBBBBBABBBCABBCCCAABBAAACBACBBAACBCBCBBBAABAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACCACCCBABCCABCACCABBACCCABCBCCAAABACABACBBABABCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:6216
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCBCACBCBCBBCAAABBCBCAACACBABACABBACAABAACBCBCCBACAACACBBBBBABBBCABBCCCAABBAAACBACBBAACBCBCBBBAABAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACCACCCBABCCABCACCABBACCCABCBCCAAABACABACBBABABCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                              PID:8988
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABBCACCABAABABBBABCBBABCABBBACCBCCCBCBBCCAABABACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACCACCCBABCCABCACCABBACCCABCBCCAAABACABACBBABABCCAB.exe" start= auto displayName= "UserDataSvc_CCABBCACCABAABABBBABCBBABCABBBACCBCCCBCBBCCAABABACA"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:864
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                sc create "UserDataSvc_CCABBCACCABAABABBBABCBBABCABBBACCBCCCBCBBCCAABABACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACCACCCBABCCABCACCABBACCCABCBCCAAABACABACBBABABCCAB.exe" start= auto displayName= "UserDataSvc_CCABBCACCABAABABBBABCBBABCABBBACCBCCCBCBBCCAABABACA"
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                PID:9540
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABBCACCABAABABBBABCBBABCABBBACCBCCCBCBBCCAABABACA"
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:5600
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                  sc start "UserDataSvc_CCABBCACCABAABABBBABCBBABCABBBACCBCCCBCBBCCAABABACA"
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                  PID:6784
                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBCBAAAABCAAABBBCCCCACBABACAABBBCCCAACBBBAACBAACCA.exe
                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBCBAAAABCAAABBBCCCCACBABACAABBBCCCAACBBBAACBAACCA.exe
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:7092
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBBBABABBCBBCCCCCBBAABAABBAACACAAAABCACABBCCBBCAABAACBBBCAAACBBAACCCBBBBCBABABACCBCCCAACBCCCCCBBACABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBABBCBABACACACCCBACCABABABABBABBBCCBBACBBBCCCCAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:8444
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBBBABABBCBBCCCCCBBAABAABBAACACAAAABCACABBCCBBCAABAACBBBCAAACBBAACCCBBBBCBABABACCBCCCAACBCCCCCBBACABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBABBCBABACACACCCBACCABABABABBABBBCCBBACBBBCCCCAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                      PID:8904
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCBBACCAACCBABBBCBCAAABCBABCCCBCCCAABAABCBBACCBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBABBCBABACACACCCBACCABABABABBABBBCCBBACBBBCCCCAABCB.exe" start= auto displayName= "UserDataSvc_ACCCBBACCAACCBABBBCBCAAABCBABCCCBCCCAABAABCBBACCBCA"
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:1444
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                        sc create "UserDataSvc_ACCCBBACCAACCBABBBCBCAAABCBABCCCBCCCAABAABCBBACCBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBABBCBABACACACCCBACCABABABABBABBBCCBBACBBBCCCCAABCB.exe" start= auto displayName= "UserDataSvc_ACCCBBACCAACCBABBBCBCAAABCBABCCCBCCCAABAABCBBACCBCA"
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                        PID:9616
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCBBACCAACCBABBBCBCAAABCBABCCCBCCCAABAABCBBACCBCA"
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:9172
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                          sc start "UserDataSvc_ACCCBBACCAACCBABBBCBCAAABCBABCCCBCCCAABAABCBBACCBCA"
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                          PID:9380
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBABCBAACBBAAABACAACCCBABCCCAAABBACCAABCCCCACAAAAAAB.exe
                                                                                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBABCBAACBBAAABACAACCCBABCCCAAABBACCAABCCCCACAAAAAAB.exe
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:860
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCBAACBCCCACAACCCAABABBACBBCCAABBBAACBCCBCCBBCBBABAAABCCAAAACBBACCCACACBCBBABAACABBCCACBACCCABCABAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBBBCCBABABCACBABCCBCBBABCCCCABCCCABABAABBBABBABCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:8820
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCBAACBCCCACAACCCAABABBACBBCCAABBBAACBCCBCCBBCBBABAAABCCAAAACBBACCCACACBCBBABAACABBCCACBACCCABCABAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBBBCCBABABCACBABCCBCBBABCCCCABCCCABABAABBBABBABCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                              PID:9524
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABABABAABCCACABCCBABCBCACBCABACCCCBABAAABBABACCBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBBBCCBABABCACBABCCBCBBABCCCCABCCCABABAABBBABBABCAAC.exe" start= auto displayName= "UserDataSvc_ABABABAABCCACABCCBABCBCACBCABACCCCBABAAABBABACCBBAA"
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:8276
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                sc create "UserDataSvc_ABABABAABCCACABCCBABCBCACBCABACCCCBABAAABBABACCBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBBBCCBABABCACBABCCBCBBABCCCCABCCCABABAABBBABBABCAAC.exe" start= auto displayName= "UserDataSvc_ABABABAABCCACABCCBABCBCACBCABACCCCBABAAABBABACCBBAA"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:9848
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABABABAABCCACABCCBABCBCACBCABACCCCBABAAABBABACCBBAA"
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:10372
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                    sc start "UserDataSvc_ABABABAABCCACABCCBABCBCACBCABACCCCBABAAABBABACCBBAA"
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                    PID:8300
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAACAAABBBBABCBCBAAABAABACABCBBACABBCBBACBBBABCBBABC.exe
                                                                                                                                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAACAAABBBBABCBCBAAABAABACABCBBACABBCBBACBBBABCBBABC.exe
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:7172
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABCCACABCBBBBACCBABACCBBBACABACBABCBAACBACAAAABCBACABBBCBCCCAAABCCABBBABCAAAAABCBBCACBAAAACAACBABABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBCCCACBAABBBAABBBBBBCBBACACAAABAABABCABCACCBBBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:8312
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABCCACABCBBBBACCBABACCBBBACABACBABCBAACBACAAAABCBACABBBCBCCCAAABCCABBBABCAAAAABCBBCACBAAAACAACBABABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBCCCACBAABBBAABBBBBBCBBACACAAABAABABCABCACCBBBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                        PID:9488
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCACCACCCCBCBBCCAAACBCBBBCBCCCABABCAAAABBCCCBBBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBCCCACBAABBBAABBBBBBCBBACACAAABAABABCABCACCBBBACBC.exe" start= auto displayName= "UserDataSvc_ABCACCACCCCBCBBCCAAACBCBBBCBCCCABABCAAAABBCCCBBBCAA"
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:10232
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                          sc create "UserDataSvc_ABCACCACCCCBCBBCCAAACBCBBBCBCCCABABCAAAABBCCCBBBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBCCCACBAABBBAABBBBBBCBBACACAAABAABABCABCACCBBBACBC.exe" start= auto displayName= "UserDataSvc_ABCACCACCCCBCBBCCAAACBCBBBCBCCCABABCAAAABBCCCBBBCAA"
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:6232
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCACCACCCCBCBBCCAAACBCBBBCBCCCABABCAAAABBCCCBBBCAA"
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:9928
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                              sc start "UserDataSvc_ABCACCACCCCBCBBCCAAACBCBBBCBCCCABABCAAAABBCCCBBBCAA"
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                              PID:10980
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBBABCCCBCCBACCCAAACBCABCBBCABABACCBCCACABCABAACA.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBBABCCCBCCBACCCAAACBCABCBBCABABACCBCCACABCABAACA.exe
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3008
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBCBBACCCBBCBABCACBAABBBBCBBBACBAAACABBBBCCBCACBBAAABCABACCCCACCCBCBBBBCAABBABAABACBCCAACCBCBCAACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACCABABBCBCAACBBCBAACCCACCACCACAACBAACABBAAAACABBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:9284
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBCBBACCCBBCBABCACBAABBBBCBBBACBAAACABBBBCCBCACBBAAABCABACCCCACCCBCBBBBCAABBABAABACBCCAACCBCBCAACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACCABABBCBCAACBBCBAACCCACCACCACAACBAACABBAAAACABBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                  PID:9884
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACCCCBACCCBCCACBBBAAACABCBBBAABACCBCAAACBBABACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACCABABBCBCAACBBCBAACCCACCACCACAACBAACABBAAAACABBBA.exe" start= auto displayName= "UserDataSvc_BAACCCCBACCCBCCACBBBAAACABCBBBAABACCBCAAACBBABACCAA"
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:9064
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                    sc create "UserDataSvc_BAACCCCBACCCBCCACBBBAAACABCBBBAABACCBCAAACBBABACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACCABABBCBCAACBBCBAACCCACCACCACAACBAACABBAAAACABBBA.exe" start= auto displayName= "UserDataSvc_BAACCCCBACCCBCCACBBBAAACABCBBBAABACCBCAAACBBABACCAA"
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                    PID:8492
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACCCCBACCCBCCACBBBAAACABCBBBAABACCBCAAACBBABACCAA"
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5968
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                      sc start "UserDataSvc_BAACCCCBACCCBCCACBBBAAACABCBBBAABACCBCAAACBBABACCAA"
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                      PID:10524
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBBABCCCBCCBACCCAAACBCABCBBCABABACCBCCACABCABAACA.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBBABCCCBCCBACCCAAACBCABCBBCABABACCBCCACABCABAACA.exe
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5164
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAAACBABCCCCBCBACACAACACCABBBAAABBAACAACAACBCBBCBBBCABACCCAABCCCAACACACBBACACBCBBACCCCCBAABBCBCCACACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACABBACCBBBCBACAABACCCBBCCCAABCAAACBCCAABCCCABAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:8868
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAAACBABCCCCBCBACACAACACCABBBAAABBAACAACAACBCBBCBBBCABACCCAABCCCAACACACBBACACBCBBACCCCCBAABBCBCCACACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACABBACCBBBCBACAABACCCBBCCCAABCAAACBCCAABCCCABAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                          PID:9928
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAACACABBBBCACBACBABAACABBBABACCACCBABCCCCAABCBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACABBACCBBBCBACAABACCCBBCCCAABCAAACBCCAABCCCABAABBC.exe" start= auto displayName= "UserDataSvc_CCAACACABBBBCACBACBABAACABBBABACCACCBABCCCCAABCBAAB"
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:9652
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                            sc create "UserDataSvc_CCAACACABBBBCACBACBABAACABBBABACCACCBABCCCCAABCBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACABBACCBBBCBACAABACCCBBCCCAABCAAACBCCAABCCCABAABBC.exe" start= auto displayName= "UserDataSvc_CCAACACABBBBCACBACBABAACABBBABACCACCBABCCCCAABCBAAB"
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:9712
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAACACABBBBCACBACBABAACABBBABACCACCBABCCCCAABCBAAB"
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:10360
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                sc start "UserDataSvc_CCAACACABBBBCACBACBABAACABBBABACCACCBABCCCCAABCBAAB"
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:10056
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBAACBACBBCABABCBAAAAAAACCCBCBAABBBCBACBBBCCACBACBC.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBAACBACBBCABABCBAAAAAAACCCBCBAABBBCBACBBBCCACBACBC.exe
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:7744
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABCBACAAAABCCCBCBCACCCBCAAAACCBCBBBAACCBBCCACACAACCBBCCCCCACACCCBAABBAACCAABBCBCAACBBABAABBACCCAABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCBABBACBCAACBABBACCCAABACCABBCCBBCCAABCCCABACCACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:10068
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABCBACAAAABCCCBCBCACCCBCAAAACCBCBBBAACCBBCCACACAACCBBCCCCCACACCCBAABBAACCAABBCBCAACBBABAABBACCCAABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCBABBACBCAACBABBACCCAABACCABBCCBBCCAABCCCABACCACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:9264
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACCBBBABBCCCACBBCAAACBACCCABCCCACACBCCBCABCBACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCBABBACBCAACBABBACCCAABACCABBCCBBCCAABCCCABACCACBA.exe" start= auto displayName= "UserDataSvc_CBACCBBBABBCCCACBBCAAACBACCCABCCCACACBCCBCABCBACCBB"
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:11256
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                          sc create "UserDataSvc_CBACCBBBABBCCCACBBCAAACBACCCABCCCACACBCCBCABCBACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCBABBACBCAACBABBACCCAABACCABBCCBBCCAABCCCABACCACBA.exe" start= auto displayName= "UserDataSvc_CBACCBBBABBCCCACBBCAAACBACCCABCCCACACBCCBCABCBACCBB"
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                                          PID:11956
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACCBBBABBCCCACBBCAAACBACCCABCCCACACBCCBCABCBACCBB"
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:11612
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBBCBBCACCCBCBACBCCACACBAACCBABCAABCAABBCCCACAABAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBBCBBCACCCBCBACBCCACACBAACCBABCAABCAABBCCCACAABAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1156
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBACCCBBCABACACACCBCACCBCBCACCAABCBACCBBACACCACAABBCAACAAAAAAACAABAACBBBAABAACCBACBCCABBBBCCBBABCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCAAAABBABAABCABCAACBBACCACBABABAACACCCBBAABBCACCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6084
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBACCCBBCABACACACCBCACCBCBCACCAABCBACCBBACACCACAABBCAACAAAAAAACAABAACBBBAABAACCBACBCCABBBBCCBBABCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCAAAABBABAABCABCAACBBACCACBABABAACACCCBBAABBCACCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                PID:9868
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCBBABCCABABACAAAAABCCCBCCABBCAABACBCBABCBACACBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCAAAABBABAABCABCAACBBACCACBABABAACACCCBBAABBCACCAAB.exe" start= auto displayName= "UserDataSvc_BBBCBBABCCABABACAAAAABCCCBCCABBCAABACBCBABCBACACBBB"
                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:11064
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBBCBBCACCCBCBACBCCACACBAACCBABCAABCAABBCCCACAABAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCBBCBBCACCCBCBACBCCACACBAACCBABCAABCAABBCCCACAABAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:7420
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABBBBACCABCBCAAAABCBCBAAAABBAABACBAAAACABCCBBABBBCBACBBBCABBCCABCACBBCCABBBCBACCCABBACBCAACABAAABABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCABCCCBAACBBCACCCBCABBCAAABCBBBBACACABBCBBAACACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:9696
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABBBBACCABCBCAAAABCBCBAAAABBAABACBAAAACABCCBBABBBCBACBBBCABBCCABCACBBCCABBBCBACCCABBACBCAACABAAABABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCABCCCBAACBBCACCCBCABBCAAABCBBBBACACABBCBBAACACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                      PID:10480
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACACBBAAABCBAACBBCACCBAAAAACCCCCCCABCBACAACBBCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCABCCCBAACBBCACCCBCABBCAAABCBBBBACACABBCBBAACACCAB.exe" start= auto displayName= "UserDataSvc_CAACACBBAAABCBAACBBCACCBAAAAACCCCCCCABCBACAACBBCBAA"
                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:620
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                        sc create "UserDataSvc_CAACACBBAAABCBAACBBCACCBAAAAACCCCCCCABCBACAACBBCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCABCCCBAACBBCACCCBCABBCAAABCBBBBACACABBCBBAACACCAB.exe" start= auto displayName= "UserDataSvc_CAACACBBAAABCBAACBBCACCBAAAAACCCCCCCABCBACAACBBCBAA"
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:12188
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBAACBACBBCABABCBAAAAAAACCCBCBAABBBCBACBBBCCACBACBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCBAACBACBBCABABCBAAAAAAACCCBCBAABBBCBACBBBCCACBACBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBABCCACBBBAABBCAAABAAABCABACCBBBBACBBBBCCACAACBBBBCCBABAAAACAABACACABABCAAACAAAABABACBBBCCBCCCAABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCCBCAACBCBBBABAABBAACCCBBACAABCBBBBCACAAACACBCBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6356
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBABCCACBBBAABBCAAABAAABCABACCBBBBACBBBBCCACAACBBBBCCBABAAAACAABACACABABCAAACAAAABABACBBBCCBCCCAABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCCBCAACBCBBBABAABBAACCCBBACAABCBBBBCACAAACACBCBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                              PID:11228
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBCCABBACCCBBABCCBCABABACCCACCBCBACABCBBBCBBCACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCCBCAACBCBBBABAABBAACCCBBACAABCBBBBCACAAACACBCBCAA.exe" start= auto displayName= "UserDataSvc_CABBCCABBACCCBBABCCBCABABACCCACCBCBACABCBBBCBBCACBA"
                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                sc create "UserDataSvc_CABBCCABBACCCBBABCCBCABABACCCACCBCBACABCBBBCBBCACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCCBCAACBCBBBABAABBAACCCBBACAABCBBBBCACAAACACBCBCAA.exe" start= auto displayName= "UserDataSvc_CABBCCABBACCCBBABCCBCABABACCCACCBCBACABCBBBCBBCACBA"
                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12212
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABCAAACCABCBCBCBACCBCABBBBCBCCCBCAACCACABBACACABAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABCAAACCABCBCBCBACCBCABBBBCBCCCBCAACCACABBACACABAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAACCCCCAABBACBCBBACBCAAABBCACBCBCBBCAACCAAABAABBBBCBBABACCBCABBAACAAACCACABBCCBBCBAAAAABCABBBCAABCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABCBACCBACABBBCCBBBCBCABCCAAACABBCBABABCCBACCACCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11176
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABCAAACCABCBCBCBACCBCABBBBCBCCCBCAACCACABBACACABAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABCAAACCABCBCBCBACCBCABBBBCBCCCBCAACCACABBACACABAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2144
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACBCAABBCBCBCAABBBBCBABBCBCCAACCABAAAACABCCCACBBBBACBAACCCBAAAABAABCAACAABAABACAAAAAAACCABBAAAABCBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCACCBAABCAABAACAACCBCCACBAAACACBCBACAABAABCBBAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11368
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCCAACBBBBABAAABACBABBBACCBCBBAABBBBABCAACAAACBCAAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCCAACBBBBABAAABACBABBBACCBCBBAABBBBABCAACAAACBCAAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8208
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCCBCCBCCCACACBABBAACCBBACBAABCBCBCBCCABBACCBACBCCACCBBCCCACCABAABBABABAACBCBACAACBCBBCACCCBCABACAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAAABBBBCCBCAABAABACACBBCCBAACBBABBBAACCBAACBBCACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12152
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCCAACBBBBABAAABACBABBBACCBCBBAABBBBABCAACAAACBCAAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCCAACBBBBABAAABACBABBBACCBCBBAABBBBABCAACAAACBCAAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8216
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBAABBACACABBAACCBABCBBBACBCCACBBCACCCBAACCBCCBAABCBBCBBBBABCCCCABBCACCBACABCABBCCCAAACABBBCBCABCCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAABCBBAAACBAAAABAABBBBAAACBBABBAAACABBBCBAAACBACCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11948
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABACCBBBBCCCBABBAABBCBABACCBBABBAAABABABABBBACCBBAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABACCBBBBCCCBABBAABBCBABACCBBABBAAABABABABBBACCBBAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8416
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCCCBACCCBACBCABCBAAACCBCAACAAABBABACBBBCCABCCBCCCABAAAAABCCCABCCACCBABAAAAABBABAAABABBCCACBBACCCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCAAAAACBBCACCBCACACAACBBCABBBAAACCBBCBBBACABCBBCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6576
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCCCBACCCBACBCABCBAAACCBCAACAAABBABACBBBCCABCCBCCCABAAAAABCCCABCCACCBABAAAAABBABAAABABBCCACBBACCCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCAAAAACBBCACCBCACACAACBBCABBBAAACCBBCBBBACABCBBCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9960
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBBBCACCBAAACCCCBBBABBBABAABCABCBCAAABACBAAACACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCAAAAACBBCACCBCACACAACBBCABBBAAACCBBCBBBACABCBBCBBB.exe" start= auto displayName= "UserDataSvc_ACCBBBCACCBAAACCCCBBBABBBABAABCABCBCAAABACBAAACACCA"
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9936
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCBABABBBCABBABAAABCBACBCAABACBABBACABBBABBBBAAACBCB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCBABABBBCABBABAAABCBACBCAABACBABBACABBBABBBBAAACBCB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9048
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCCCBACCCBACBCABCBAAACCBCAACAAABBABACBBBCCABCCBCCCABAAAAABCCCABCCACCBABAAAAABBABAAABABBCCACBBACCCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACAAABACCCBABAABCBCCACCCCAACCBABCCCCABAAAABABAAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCCCBACCCBACBCABCBAAACCBCAACAAABBABACBBBCCABCCBCCCABAAAAABCCCABCCACCBABAAAAABBABAAABABBCCACBBACCCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACAAABACCCBABAABCBCCACCCCAACCBABCCCCABAAAABABAAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10344
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACAAABAACCBACABCBCBBCCCCBBABCBCACAABAABCCAABBACBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACAAABACCCBABAABCBCCACCCCAACCBABCCCCABAAAABABAAABBB.exe" start= auto displayName= "UserDataSvc_AACAAABAACCBACABCBCBBCCCCBBABCBCACAABAABCCAABBACBBA"
                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBACCBABCACCABCBAABCCBCBCACAAACCCBABCBBCABBCBABCAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBACCBABCACCABCBAABCCBCBCACAAACCCBABCBBCABBCBABCAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8608
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBABCBACBBCCBBAABABCBABCCAABBCCAAACCACBBBBACCABAAABCCABCBCBAAAABCCCBAABBACBAABCBCAABCACABBAACACCACCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBBCBBACAAAACBCCBCAACCBBBAABABCABCBCCCCBBBBACBBAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBABCBACBBCCBBAABABCBABCCAABBCCAAACCACBBBBACCABAAABCCABCBCBAAAABCCCBAABBACBAABCBCAABCACABBAACACCACCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBBCBBACAAAACBCCBCAACCBBBAABABCABCBCCCCBBBBACBBAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11116
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCBCBBBBBCCCCCBBCCBBBBCAACCCCBAAABBBACAAAABBCBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBBCBBACAAAACBCCBCAACCBBBAABABCABCBCCCCBBBBACBBAACA.exe" start= auto displayName= "UserDataSvc_CACCBCBBBBBCCCCCBBCCBBBBCAACCCCBAAABBBACAAAABBCBCBA"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8056
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBACCBABCACCABCBAABCCBCBCACAAACCCBABCBBCABBCBABCAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCBACCBABCACCABCBAABCCBCBCACAAACCCBABCBBCABBCBABCAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8740
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCBBBCCCBCBCAAAACBAABAABBABACABABBAAACCCABBCCBCABAABABCABCBBCBBBCBBABBBACACCBCACCBBACACBCBAAACCACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCBCBCBABACACCCCCABBAACBCBABBCCBBCCCCACBBBCCCCBCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10112
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCBBBCCCBCBCAAAACBAABAABBABACABABBAAACCCABBCCBCABAABABCABCBBCBBBCBBABBBACACCBCACCBBACACBCBAAACCACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCBCBCBABACACCCCCABBAACBCBABBCCBBCCCCACBBBCCCCBCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6584
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABACCBBBBCCCBABBAABBCBABACCBBABBAAABABABABBBACCBBAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABACCBBBBCCCBABBAABBCBABACCBBABBAAABABABABBBACCBBAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABCBCBBAABCABCAACCBBCCBCACCABBCBCABCCCBCBBBCCCAABBAACACBAABCCBACBAAACCCBBCCABACBBCBBBAABBBBACBBBBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACACABCCACBBBCACBAACCACBACBBCCBCCCBAACACCACBCAACBCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10384
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABCBCBBAABCABCAACCBBCCBCACCABBCBCABCCCBCBBBCCCAABBAACACBAABCCBACBAAACCCBBCCABACBBCBBBAABBBBACBBBBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACACABCCACBBBCACBAACCACBACBBCCBCCCBAACACCACBCAACBCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5652
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACCACCCBABCCABCACCABBACCCABCBCCAAABACABACBBABABCCAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACCACCCBABCCABCACCABBACCCABCBCCAAABACABACBBABABCCAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8744
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBCBCCBBBABABAAAAABBBABABBBBBBCBCABBBACBBAABBACAACBBABCBCBBCAABBABABBABCBACACCBACCABCABCBBCCABAACCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAACCCBCBAAACBBCCCBBCBBCCCBCACCAAAAAAAACCBBBBCCBABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAACAABBBCACCBCBACBAAAABCAABCBCACABBCABACAAACAABABBCC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAACAABBBCACCBCBACBAAAABCAABCBCACABBCABACAAACAABABBCC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCACABBAACCCCAAACAAAAACCCBCACCCBACCACAABACBABABCBAABABBCCBCCCAABBBABCABBBACBBACCBCABBCABBACBCBCABCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACBBBBBACAACBABCBBBCBCCABCABAABCBACBBAABCAABACCBBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACABAAACBBCACBACCACCBAACAABBBBCBBBACAACCABBCAAACCCBA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACABAAACBBCACBACCACCBAACAABBBBCBBBACAACCABBCAAACCCBA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCBABABBBCABBABAAABCBACBCAABACBABBACABBBABBBBAAACBCB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCBABABBBCABBABAAABCBACBCAABACBABBACABBBABBBBAAACBCB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBABBCBABACACACCCBACCABABABABBABBBCCBBACBBBCCCCAABCB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBABBCBABACACACCCBACCABABABABBABBBCCBBACBBBCCCCAABCB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCCABAAABCABCBCACAABBBACABBBABAACBABABCBABBCBCABBBCC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCCABAAABCABCBCACAABBBACABBBABAACBABABCBABBCBCABBBCC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAACAABBBCACCBCBACBAAAABCAABCBCACABBCABACAAACAABABBCC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAACAABBBCACCBCBACBAAAABCAABCBCACABBCABACAAACAABABBCC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABCBCBBAABCABCAACCBBCCBCACCABBCBCABCCCBCBBBCCCAABBAACACBAABCCBACBAAACCCBBCCABACBBCBBBAABBBBACBBBBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAABCCCBCAAAABBCBABBCBCABBBCAABBCACAAABCCBBACCCABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABCBCBBAABCABCAACCBBCCBCACCABBCBCABCCCBCBBBCCCAABBAACACBAABCCBACBAAACCCBBCCABACBBCBBBAABBBBACBBBBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAABCCCBCAAAABBCBABBCBCABBBCAABBCACAAABCCBBACCCABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBBCCCAACBBAAACCCAACCBBCCCBCABBABAACAABCABABABABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAABCCCBCAAAABBCBABBCBCABBBCAABBCACAAABCCBBACCCABBAB.exe" start= auto displayName= "UserDataSvc_CBCBBCCCAACBBAAACCCAACCBBCCCBCABBABAACAABCABABABABC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABCCBCCCACCABAAACAACCBACBABAABAABCAABCCABABCAABCCA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABCCBCCCACCABAAACAACCBACBABAABAABCAABCCABABCAABCCA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACAACBABBAACBABABCBBCBBCBACCBABABAACCABABBBBCBACCCABBCCBCBBBBABACACBCABAAAABACCBAACCBABBCACCAAABAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACABCABCBCBACBBCCBCABCCACACBBCACCABCBCCCBACBCCCCCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACAACBABBAACBABABCBBCBBCBACCBABABAACCABABBBBCBACCCABBCCBCBBBBABACACBCABAAAABACCBAACCBABBCACCAAABAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACABCABCBCBACBBCCBCABCCACACBBCACCABCBCCCBACBCCCCCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBBCCCBCBCBBCCCCBBBABAAAABACBCACCCBCCAACBAACBCACAABA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBBCCCBCBCBBCCCCBBBABAAAABACBCACCCBCCAACBAACBCACAABA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCCBAABCBBCCBCBCCBBAAACCCCBAACCAAACBCCCAAACAAACCCCBABAAAACABBBABABCACACACBACBABBBBCABBBCACBCBCABCCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBABCCBACCABABBBACBCCBCCCABAACBACBABAACBBCAACCCAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCCBAABCBBCCBCBCCBBAAACCCCBAACCAAACBCCCAAACAAACCCCBABAAAACABBBABABCACACACBACBABBBBCABBBCACBCBCABCCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBABCCBACCABABBBACBCCBCCCABAACBACBABAACBBCAACCCAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBCCCACBAABBBAABBBBBBCBBACACAAABAABABCABCACCBBBACBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBCCCACBAABBBAABBBBBBCBBACACAAABAABABCABCACCBBBACBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBACBBBBCABABBBAAABAACABCBAACBBBCCACAACCCBCAAABCCAABCBCCCCBBBAABBCBBBABBCAABABAABCBAAACABCCACBCBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABACCBCAACACABACBBACCABCAACCCACCBAACBCBCBCACABCAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBACBBBBCABABBBAAABAACABCBAACBBBCCACAACCCBCAAABCCAABCBCCCCBBBAABBCBBBABBCAABABAABCBAAACABCCACBCBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABACCBCAACACABACBBACCABCAACCCACCBAACBCBCBCACABCAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACABBACCBBBCBACAABACCCBBCCCAABCAAACBCCAABCCCABAABBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACABBACCBBBCBACAABACCCBBCCCAABCAAACBCCAABCCCABAABBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABBBCABACBCABACAACACBAABBBABAABBAAAAAACACBABABBBAAAACBCACCBAABACAABABCBAABCBBBABABCACBCAABCBABABACCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABBACAABACCAABCBCCBBCACACCCABCACACABBCBBCCCACBCBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBABBCBABACACACCCBACCABABABABBABBBCCBBACBBBCCCCAABCB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBABBCBABACACACCCBACCABABABABBABBBCCBBACBBBCCCCAABCB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABCCBCCCACCABAAACAACCBACBABAABAABCAABCCABABCAABCCA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABCCBCCCACCABAAACAACCBACBABAABAABCAABCCABABCAABCCA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACCACCCBABCCABCACCABBACCCABCBCCAAABACABACBBABABCCAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACCACCCBABCCABCACCABBACCCABCBCCAAABACABACBBABABCCAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBBBCCAACBCACCBCBCAABBBACCAACABAABBAAAACAAACBBBCABC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBBBCCAACBCACCBCBCAABBBACCAACABAABBAAAACAAACBBBCABC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBBBCCBABABCACBABCCBCBBABCCCCABCCCABABAABBBABBABCAAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBBBCCBABABCACBABCCBCBBABCCCCABCCCABABAABBBABBABCAAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACABAAACBBCACBACCACCBAACAABBBBCBBBACAACCABBCAAACCCBA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACABAAACBBCACBACCACCBAACAABBBBCBBBACAACCABBCAAACCCBA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACCABABBCBCAACBBCBAACCCACCACCACAACBAACABBAAAACABBBA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACCABABBCBCAACBBCBAACCCACCACCACAACBAACABBAAAACABBBA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACCABABBCBCAACBBCBAACCCACCACCACAACBAACABBAAAACABBBA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACCABABBCBCAACBBCBAACCCACCACCACAACBAACABBAAAACABBBA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCBAABBBBCAABBBABCABAAABAABABBBCCCCCABCBCBBAACBBCCB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCBAABBBBCAABBBABCABAAABAABABBBCCCCCABCBCBBAACBBCCB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBBAAAAAAABCAABBABCBBACBBBBBBACACCABCCBBBABABCBBBB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBBAAAAAAABCAABBABCBBACBBBBBBACACCABCCBBBABABCBBBB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCAACBCABCBACBABACCBBBCABBAABBBAABBACABABCBAABCABABA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCAACBCABCBACBABACCBBBCABBAABBBAABBACABABCBAABCABABA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACAAABCACACCCBCAACAABCBACBBCCAACACCBCACACABAAACBCCACCBBCABCCAACACBABACBACCCBACCBCCBCCBCCCBBCBBACCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBCAACBAAABACAAABACABACCBACAACACCCCAACCABCCBABBACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBBCCCBCBCBBCCCCBBBABAAAABACBCACCCBCCAACBAACBCACAABA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBBCCCBCBCBBCCCCBBBABAAAABACBCACCCBCCAACBAACBCACAABA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCAAAAACBBCACCBCACACAACBBCABBBAAACCBBCBBBACABCBBCBBB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCAAAAACBBCACCBCACACAACBBCABBBAAACCBBCBBBACABCBBCBBB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBCCCACBAABBBAABBBBBBCBBACACAAABAABABCABCACCBBBACBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBCCCACBAABBBAABBBBBBCBBACACAAABAABABCABCACCBBBACBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCBABBACBCAACBABBACCCAABACCABBCCBBCCAABCCCABACCACBA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCBABBACBCAACBABBACCCAABACCABBCCBBCCAABCCCABACCACBA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAACCABCBBCBBBBCBCBACBBAABACAAAABCBBBCACABBCAAAAAAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAACCABCBBCBBBBCBCBACBBAABACAAAABCBBBCACABBCAAAAAAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACAAABACCCBABAABCBCCACCCCAACCBABCCCCABAAAABABAAABBB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACAAABACCCBABAABCBCCACCCCAACCBABCCCCABAAAABABAAABBB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCCABAAABCABCBCACAABBBACABBBABAACBABABCBABBCBCABBBCC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCCABAAABCABCBCACAABBBACABBBABAACBABABCBABBCBCABBBCC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCAAAABBABAABCABCAACBBACCACBABABAACACCCBBAABBCACCAAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCAAAABBABAABCABCAACBBACCACBABABAACACCCBBAABBCACCAAB.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACABBACCBBBCBACAABACCCBBCCCAABCAAACBCCAABCCCABAABBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACABBACCBBBCBACAABACCCBBCCCAABCAAACBCCAABCCCABAABBC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBBBCCBABABCACBABCCBCBBABCCCCABCCCABABAABBBABBABCAAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBBBCCBABABCACBABCCBCBBABCCCCABCCCABABAABBBABBABCAAC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABACCBCAACACABACBBACCABCAACCCACCBAACBCBCBCACABCAAAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABACCBCAACACABACBBACCABCAACCCACCBAACBCBCBCACABCAAAAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11720

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  System Services

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1569

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Service Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1569.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1614

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1614.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\PerfLogs\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 1e86f8a36ae493da60304653fd7606b70ade109b54b0ec01c524f398ecc97733
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\PerfLogs\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e8640633bb5fa78ec8cb8ab9d5dfba84f11dc14c617dab257c3fb8e92e22bf51
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  appvcleaner.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 21.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b5ee9d4ef89f3e3bf5379ce00a27858f59946ecd5e9d97d32a0056d3e58d04e6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5768553c232b2aec690c7a937d3cc65b46175171aa44cf11d7f7d04bf25e9b46
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files\Common Files\microsoft shared\VSTO\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 6b6bf806734ca377661eff36012cd1856bce56917428aecbc6e2458e2d9d2563
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files\Common Files\microsoft shared\ink\as-IN\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 987431771c5248486b55951bfa4d326b426cfc3ed51ca073efc721b38981f033
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files\Common Files\microsoft shared\ink\as-IN\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 0ffe724dca9a7076cc6048602dd5898b8e479de7645c73b32fc908033308b51b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5d8cf32c31fabb3c8171ce9a6074d963882aeaf45350e91d37e9e29b78dd1b5b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\win_x64\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 dadbfd86139e196b729faa76c0f405aff9c04515faee938b036e2ecfb2786e8c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files\Internet Explorer\es-ES\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 86c4d3fda2dcf4e445e91444fb168350d6d21e0cd632a171345119fd93a5fc48
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files\Java\jdk-1.8\jre\bin\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 cf59793592fe1879ccc98ebea717e767c2e128edb4e1ef7b5594aedec03e60ce
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files\Java\jdk-1.8\jre\lib\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 54f4d991e2cbe4bfae321426c32389dcf939f11a18659b3e384ea08da91e783e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files\Java\jre-1.8\legal\jdk\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4a46469d45a6f6939925812191fddcd4365d87967df26288ee8fa2d5b9b34037
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 eeaa54d54923fcb6aacd24fac9cdb3582c1242d5e03b763d39af1237b22383da
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files\Microsoft Office\root\Office16\FPA_f3\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e68262cc62b3f833491fea6545b64f061731eea72fdb0849b3e1e54fe91819fa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files\Microsoft Office\root\fre\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b86fb11e1394aaeeb8f8d062d1a5e47d669fa8ebfd9c984577259de5878f7be3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 967ce59959f20a2d7d09ba68157a7947a5304bfda2f5e25bdcb692f249e45f51
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 c2ab0df84628c7c18d45386b7fe92cf8ebb7d46a8b93298842a2792ba5f9f906
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 bcb669af509edff80cf8c4de0b5eccb3cad53fdc54f4f2a1b6549b75dd5e5561
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 73fe4faec3dc66b855418221461722b9647285b233402375e655f3e4cd96518c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 585c8ddff3d224b79e9167eaadef128c7db7034fc8b8afc5579f67c2a5f1e3b5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 20f94447d8660bc3542ca1c9e2d74626399c0bf584ba7b9af76a8f3b4b31fae4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 07b033403f389acb30b8626cce7c2d60c2d2f71b254a7b3712f2bfd464738820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  svchost_AABBACBBBCABCABBBCACCACAAABCCBAACABCCCAABCBBBBCAAACBCAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACBBBCABCABBBCACCACAAABCCBAACABCCCAABCBBBBCAAACBCAA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 18.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 dfc318b23dd879364348f4808cb3cc932e08e40bb1366d8b79af7920dda656a1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8fc08901db5b4f0ea7deed5d4f75c2e1d940a33821396c72a85cb41e98ba3d10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 256f4b4382095fc40dedd5418b661e27ad303ed5e88aca8c1ec0e09258a4c8dc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b1dad714a5c3e9893316b108f99cb848327079ea88be185a91cdc93844440810
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 ffbfcfc035af04acc47eef067bb9035d4b11712aa2e662f13ebeafe94aafe663
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 3c43803bfd1aa8103dd8d5b2b124999615677a2cdd2906092218c0ec57f72010
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 3f0a55df0d111ad07521d5fdfccb6c50e22fd09680258d5fba64ef2502d1bf1a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 8KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 70eda2f23a3255e2c99ef558cdad233462883f874fea56ac925b73aa8b5272fe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 9KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 9fae063f16685a08d2112b8c93b625fe3735fde8a436d01ab5e0e087c699003b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 9KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 57fe1ba169b126b5bdfad9dbc55320fa4c04d13b493cc1c73584fff248a97cbc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 9KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 1a2b4abdcc70305d427120cedccd24b5e84c7f48175695bfdc3e4ee8cb9fbc9e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 9KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 63e3a1c6c14157f74c284ce54dd8a867d80bc2199e0db20fa3486805c64a356e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 10KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e8bcb246a71750ecf35631940e9a157cd242dd8325699cd41cc9f6b619ece7ab
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 11KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2a90e4c29a6198e55d46b9aa06165032b8af378fd90f3e656610f661a5d977ef
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 12KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 7149a614c218ebf443fc9dfc4d4f2cca02dddde85ecdbd8b7bf6a545e8c9448b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 daabcd904c80b442853a6ded121811c2af1792af5db919e6eac2c1326ee24047
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 12KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2000b1186ea1436610c33cb104eeec45a29c78c248ac217280bb81a8225938cf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 13KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 993d3a00344cf2893c65aec8a4ccca158eb8ce2b3124227c1307bc19d513eebb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 13KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 362c2844c0458a87c4364f948334fd0ce7c5541c2846e3522bf70e74b84c1c55
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 13KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 ce9012d7323896b7166fba3fc6e7857917dd8a341c28d8468b5abeb7f8ea8bdd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 15KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 db0d542070e6f5da9c66ef8c6cf509e361e2a7e611bd5f62b5917d78e3930134
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 16KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 606391e622b1f972ef9af0ee4be5bb6f68dc66f9d4555521e8eeb4424c8b2b90
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 16KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 82b78764831b81f8a8bad6a3dbc2d1b0758da5091983b5e49b91fd3b880ae45f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4d3deac3573a64340ba43dadaa98305c29f8c7e97431d8e07e2f708f64edf801
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e4fcd627847c88c57b2100f6d2ea937a84740aafe69beaf20d5718c7ca65a789
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2086eb27f31f7ae42817b8e22334c8dfcbbd4aa84ef0168125d147c87fb1a26f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b390787319a5754ded15eaf5cc9c9e38877daa0b9663e8c7e948e0b1fad7a109
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 41b3779b65430a32299ec58e85559d50b1dbe6a9ba693052ad93709ae1ab9fc9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 fefbf1a6f2e0ba1f328bb023038a069c4734bcb123b569ad75898f74d1ae913d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 dc421832598b486b2cb751a37dec5df4e7360b3d298b4d11419da945bdb5a64e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 c00ba029bd8d2195fbff8624afd93653bf86af8bf26352e60c850772c698baa6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/124-198-0x0000000000B50000-0x0000000000B72000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/704-199-0x0000000000B50000-0x0000000000B72000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/788-1661-0x0000000000B00000-0x0000000000B22000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/1728-354-0x0000000000C30000-0x0000000000C52000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/1728-262-0x0000000000C30000-0x0000000000C52000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/1856-236-0x00000000001C0000-0x00000000001E2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/2104-2799-0x0000000000BD0000-0x0000000000BF2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/2140-296-0x0000000000C20000-0x0000000000C42000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/2140-385-0x0000000000C20000-0x0000000000C42000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/2364-1566-0x0000000001000000-0x0000000001022000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/2364-303-0x0000000001000000-0x0000000001022000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/2696-45-0x0000000000100000-0x0000000000122000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/2696-98-0x0000000000100000-0x0000000000122000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/2720-216-0x0000000000990000-0x00000000009B2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/2720-153-0x0000000000990000-0x00000000009B2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/2724-41-0x0000000000E90000-0x0000000000EB2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/2752-1990-0x00000000002F0000-0x0000000000312000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/2864-200-0x0000000000B50000-0x0000000000B72000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/2872-96-0x0000000000470000-0x0000000000492000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/2872-44-0x0000000000470000-0x0000000000492000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/2964-261-0x0000000000C30000-0x0000000000C52000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/2964-350-0x0000000000C30000-0x0000000000C52000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3156-382-0x0000000000310000-0x0000000000332000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/3312-1916-0x0000000000680000-0x00000000006A2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4284-987-0x0000000000340000-0x0000000000362000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4356-39-0x0000000000560000-0x0000000000582000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4356-0-0x0000000000560000-0x0000000000582000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4680-1090-0x00000000003B0000-0x00000000003D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4764-355-0x0000000000890000-0x00000000008B2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4772-1989-0x00000000002F0000-0x0000000000312000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4784-1294-0x00000000003B0000-0x00000000003D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4784-383-0x00000000003B0000-0x00000000003D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4820-151-0x0000000000250000-0x0000000000272000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4868-42-0x0000000000E90000-0x0000000000EB2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/4872-1638-0x0000000000B00000-0x0000000000B22000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5056-152-0x0000000000250000-0x0000000000272000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5176-1954-0x0000000000680000-0x00000000006A2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5260-260-0x00000000001C0000-0x00000000001E2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5564-2658-0x0000000000AE0000-0x0000000000B02000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5760-1985-0x0000000000340000-0x0000000000362000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5760-1299-0x0000000000340000-0x0000000000362000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5760-988-0x0000000000340000-0x0000000000362000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5916-302-0x0000000001000000-0x0000000001022000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5916-1637-0x0000000001000000-0x0000000001022000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/5948-1094-0x0000000000EC0000-0x0000000000EE2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6104-356-0x0000000000890000-0x00000000008B2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6124-295-0x0000000000C20000-0x0000000000C42000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6124-384-0x0000000000C20000-0x0000000000C42000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6264-2014-0x0000000000870000-0x0000000000892000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6264-2786-0x0000000000870000-0x0000000000892000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6292-2583-0x0000000000F50000-0x0000000000F72000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6292-2615-0x0000000000F50000-0x0000000000F72000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6340-2584-0x0000000000770000-0x0000000000792000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6340-2616-0x0000000000770000-0x0000000000792000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6472-2653-0x0000000000F50000-0x0000000000F72000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6520-2706-0x0000000000870000-0x0000000000892000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6520-2654-0x0000000000870000-0x0000000000892000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6620-2707-0x0000000000280000-0x00000000002A2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6620-2655-0x0000000000280000-0x00000000002A2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6628-2708-0x0000000000280000-0x00000000002A2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6628-2656-0x0000000000280000-0x00000000002A2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6672-2792-0x0000000000460000-0x0000000000482000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6672-2797-0x0000000000460000-0x0000000000482000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  memory/6944-2657-0x0000000000460000-0x0000000000482000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download